Date: Mon, 10 Jan 2022 11:48:33 -0600
From: Winston Weinert <winston@ml1.net>
To: ~alpine/users@lists.alpinelinux.org
Subject: Re: Compare /etc against package defaults?
Message-ID: <20220110174833.5geeie3fqpxnvdoj@ml1.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220109013908.349f0156064dbe8936527b9f@googlemail.com>

> Using apk audit will handle this,

Bingo!  It appears older version of apk does list an audit subcommand in the
'apk --help' usage, so I hadn't heard of 'apk audit' before :).  Never-the-less
this 'apk audit' subcommand does work on these old crufty servers.

Based on the discussion in this thread, I came up with a solution:

1) Ensure all .apk files for your installed packages are available locally.
  a) run 'setup-apkcache'
  b) run 'apk cache download'
  c) If some packages are missing, I guess one could compare against a .apk
     that has a different version number.
2) Loop over the output of 'apk audit'
  a) Determine what package owns the file: 'apk -v info -W FILE'
  b) Try to find a .apk that looks like it is for the given package:
     'find /path/to/apkcache -type f -name "PKG.*.apk"'
  c) Run diff against the file from the 'apk audit' output and the file
     extracted from the .apk ('tar -xzOf the-pkg.apk FILE' seems to work)

There might be some oversights in the above steps, I'm interested to hear about
them.

Thanks,
-- 
  Winston Weinert
  winston@ml1.net
  https://winny.tech/