3. APKO & Melange Example

1. Install Melange & Apko

Install Melange

curl -Lo melange.tar.gz https://github.com/chainguard-dev/melange/releases/latest/download/melange-linux-amd64.tar.gz
tar -xvf melange.tar.gz
sudo mv melange /usr/local/bin/

Install Apko

curl -Lo apko.tar.gz https://github.com/chainguard-dev/apko/releases/latest/download/apko-linux-amd64.tar.gz
tar -xvf apko.tar.gz
sudo mv apko /usr/local/bin/

Verify installations:

melange --version
apko --version

---

2. Create a Simple Go "Hello World" App

Let's create a minimal Go app.

mkdir go-hello && cd go-hello
cat <<EOF > main.go
package main
import "fmt"
func main() {
    fmt.Println("Hello, World!")
}
EOF

---

3. Create a Melange Build Configuration

Melange is used to build the Go application and package it.

Create melange.yaml:

package:
  name: hello-go
  version: 1.0.0
  epoch: 0
  description: "A simple hello world app in Go"
  copyright:
    - paths: ["."]
      license: "MIT"

pipeline:
  - uses: fetch
    with:
      uri: "."

  - uses: go/build
    with:
      package: "main.go"
      output: "hello-go"

  - uses: strip

environment:
  contents:
    packages:
      - go

---

4. Build the Go Package using Melange

Run the build process:

melange build melange.yaml --arch x86_64

This generates an apk package in the packages/ directory.

---

5. Create an Apko Configuration for Container Image

Apko is used to create a container image from the built package.

Create apko.yaml:

contents:
  packages:
    - hello-go

entrypoint:
  command: ["/usr/bin/hello-go"]

---

6. Build and Sign the Container Image using Apko

6.1 Generate Signing Key (if not already available)

melange keygen

This generates:

• melange.rsa (private key)
• melange.rsa.pub (public key)

6.2 Build the Container Image

apko build --arch x86_64 apko.yaml myregistry.example.com/hello-go:latest hello-go.tar

This creates a container image.

6.3 Sign the Image

apko publish --keyring melange.rsa.pub --signing-key melange.rsa apko.yaml myregistry.example.com/hello-go:latest

---

7. Verify the Signed Image

cosign verify --key melange.rsa.pub myregistry.example.com/hello-go:latest

---