Hello everyone,

The e-mail thread I wrote earlier about apk-tools culminated in
a fairly lengthy discussion in IRC, that I believe has been quite
useful.

The primary concern with risk management was figuring out the
safest way to handle migration from apk2 to apk3. I am pleased
to report that we appear to have found a workable solution for
distributions like Alpine to follow!

The conclusion that we have reached consensus on is that apk3
should continue to support APKv2 packages for some period of
time. This allows for us to provide both an APKv2 and APKv3
index referencing the APKv2 packages. By doing so, we can have
a seamless migration to apk-tools 3.0 in a safe way that allows
for testing.

While we do not have the full details worked out quite yet on
what a transition would ideally look like, a rough idea would
be something along these lines:

1. apk-tools 3.0 is released to the testing repository.
2. Users who opt into the testing repository could at that
time opt into testing apk-tools 3 if they wish by adding
it as a tagged dependency (apk add apk-tools@testing).
3. apk-tools 3 uses the APKv3 indices, while apk-tools uses
the legacy APKv2 indices.
4. If apk-tools 3 is stable and APKv3 package support is
completed, it replaces legacy apk-tools in Alpine 3.12.
5. At some point down the road, we swap over to APKv3
packages and stop providing APKv2 indices. We call that
release Alpine 4.0.

It is suggested that other distributions use the same basic
migration strategy.

In the event of a problem, we simply hold apk-tools 3.0
migration from testing to main to a future release, such as
Alpine 3.13.

Another question that has been asked is how apk-tools-static
will be handled. The plan there is to provide a signed
apk-tools-static binary that Alpine and other distributions
can use for bootstrapping purposes. More details on that
will be available once we have a specific plan for it.

Thanks everyone for your feedback!

Ariadne