Identify apk packages based on .PKGINFO depend entry

Question

I am interested in resolving apk package dependencies, ideally with a scripting language like python. Basically I want to be able to derive a dependency tree of a package, without the need to run on a alpine environment.

So far I am analyzing the .PKGINFO file and the dependencies. And fetch the other apk's using http://dl-cdn.alpinelinux.org/alpine/edge/main/{arch}/{package}-{version}.apk. However from the .PKGINFO depencd entries it is not possible so far. An excerpt of the Python3 apk as example:

...
depend = so:libbz2.so.1
depend = so:libc.musl-s390x.so.1
depend = so:libcrypto.so.3
depend = so:libexpat.so.1
...

I know the post How to search for a file in apk packages and liked the idea of fetching information from the API https://api.alpinelinux.org, which isn't accessible anymore. Does someone know if a similar API is still running?

Is there any option other option to identify the package based on the .so file other than webscraping similar to apkfile as mentioned above?

Or does anybody see a more suited way of deriving the dependency tree for a package?

Answer 1

Is there any option other option to identify the package based on the .so file other than webscraping similar to apkfile as mentioned above?

Yes: do it the same way the apk command does. Download the package index and parse it for dependency information. You can see the index URLs when you run `apk update:

/ # apk update
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz
v3.16.2-161-gc2ac19fd6b [https://dl-cdn.alpinelinux.org/alpine/v3.16/main]
v3.16.2-163-g5c02fd86e3 [https://dl-cdn.alpinelinux.org/alpine/v3.16/community]
OK: 17028 distinct packages available

These archives each contain an APKINDEX file that contains metadata about all the packages in the corresponding repository. For example, the python3 entry looks like:

C:Q1MVpLjE5vLqKS+ZuzxsuVdc+Xe5A=
P:python3
V:3.10.5-r0
A:x86_64
S:14513129
I:49467392
T:A high-level scripting language
U:https://www.python.org/
L:PSF-2.0
o:python3
m:Natanael Copa <ncopa@alpinelinux.org>
t:1658764328
c:0b726d39d903e8ccb50cd92798afb35e6d7acce6
D:so:libbz2.so.1 so:libc.musl-x86_64.so.1 so:libcrypto.so.1.1 so:libexpat.so.1 so:libffi.so.8 so:libgdbm.so.6 so:libgdbm_compat.so.4 so:liblzma.so.5 so:libmpdec.so.3 so:libncursesw.so.6 so:libpanelw.so.6 so:libreadline.so.8 so:libsqlite3.so.0 so:libssl.so.1.1 so:libz.so.1
p:so:libpython3.10.so.1.0=1.0 so:libpython3.so=0 cmd:2to3-3.10=3.10.5-r0 cmd:2to3=3.10.5-r0 cmd:pydoc3.10=3.10.5-r0 cmd:pydoc3=3.10.5-r0 cmd:python3.10=3.10.5-r0 cmd:python3=3.10.5-r0

If we want to find the package that provides so:libbz2.so., we would search for an entry that lists that dependency on the p: line (for provides).

That gets us:

C:Q1n7yd9034EvCCluHKeoNvh+KF4Iw=
P:libbz2
V:1.0.8-r1
A:x86_64
S:27057
I:73728
T:Shared library for bz2
U:http://sources.redhat.com/bzip2
L:bzip2-1.0.6
o:bzip2
m:Natanael Copa <ncopa@alpinelinux.org>
t:1586114186
c:596cd15e692776222d49da2700c6041b39ffbea9
D:so:libc.musl-x86_64.so.1
p:so:libbz2.so.1=1.0.8

So now we know that package (P:) libbz2 provides (p:) libbz2.so.1=1.0.8.

---

You can find the APK index format documented here.