Sender: =?UTF-8?Q?Timo_Ter=C3=A4s?= <timo.teras@gmail.com>
Date: Thu, 29 Nov 2012 08:40:44 +0200
From: Timo Teras <timo.teras@iki.fi>
To: Dubiousjim <lists+alpine-devel@jimpryor.net>
Cc: alpine-devel@lists.alpinelinux.org
Subject: Re: [alpine-devel] Some questions about apk-tools
Message-ID: <20121129084044.29515fc1@vostro>
In-Reply-To: <20121128234406.GD2390@vaio.jimpryor.net>
References: <20121128234406.GD2390@vaio.jimpryor.net>
Precedence: list
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Wed, 28 Nov 2012 18:44:06 -0500 Dubiousjim
<lists+alpine-devel@jimpryor.net> wrote:

> Here are a few things I don't understand about apk-tools. Can anyone
> help fill in the picture?
> 
> What exactly is the difference between `apk add ...` and `apk
> fix ...`?

"add" will record in the '/etc/apk/world' that the package is something
user wanted explicitly to be installed.

"fix" will just re-install it only if it is already installed. "fix"
will always also re-install the package, "add" will only do things if
it was not installed.

> What is the difference between `apk add -u ...` and `apk fix -u ...`
> and `apk fix -r ...` and `apk upgrade` (except for the fact that the
> last operates on a broader set of packages)?

"add -u" will record the package in world. "fix -u" will do almost same
thing except not record the package in world.

With "fix -r" will operate on the specified package list, and can
re-install most of the package. "upgrade" works with world - it
upgrades all packages. "upgrade -a" is also notable, and in addition to
regular "upgrade" it also resets all versioned world dependencies, and
tries to make sure all packages come from some active repository.

> What exactly is the effect of `apk add --initdb`?

It creates the apk databases in /lib/apk/db/. Basically, this is needed
when you are creating a new rootfs, or chroot install.

> What exactly is the effect of the "generic options" --clean-protected
> and --purge? I see that they have to do with .apk-new files, but would
> appreciate hearing them explained more fully.

In /etc/apk/protected_paths.d/*.list you can define which system
directories are treated specially. Generally this is /etc. On these
"protected directories" apk never overwrites modified files. Normally,
if file is modified, the new file will be extracted with .apk-new
extension (e.g. updated sample or default config file).

--clean-protected will make apk not create those .apk-new files. The
updated config files are just silently discarded and not made available.

--purge affects only "del" command. If package is deleted, and it has
modified config file, it is normally left intact. With --purge all
config files will be deleted regardless if they are modified or not.

> What exactly is the behavior of `apk audit`? Does it work only in
> cooperation with lbu? What is the exact effect of the --backup and
> --recursive options for this command?

You can use "audit" independently and it can be useful. It was created
for lbu, though. Basically, lbu uses "audit" to figure out which files
need to go into the overlay tarball.

"audit" requires you to specify --backup or --system to determine mode
of operation. --backup makes it only consider "protected files", that
is the special directories marked as to contain configuration files.
Where as --system makes apk consider all installed files - this can be
used to do security audit that no system binary is changed.

--recursive option changes audit output. Normally if there is a new
directory inside /etc, apk would just report the directory entry.
--recursive makes apk scan the new directory for all files/subdirs and
report them individually. This was created to help 'lbu' pass the full
filelist to tar. I believe we needed this to properly store minimal set
of changes with tar in case someone modified permissions of
protected directory. Basically it makes output to something which can
be just passed on to "tar --no-recursion".

> If I do get to understand these things better, I'll try to help make
> sure they're better documented.

Thanks!

Please do ask if there's additional things you want to know. Many of
apk's features are not documented well enough. So thank you for helping
in this!

- Timo


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---