In Alpine Linux, when I run the command apk update it looks at my /etc/apk/repositories file and downloads the APKINDEX.tar.gz file from each repository. It then renames each APKINDEX tar file using a checksum to be in the format APKINDEX.12345678.tar.gz where 12345678 represent some checksum.

I've been trying to understand how this checksum works because I'd like to update the package listing for an offline Alpine installation. To better understand it, I am reading the source code for the apk tool. From the source, I understand that the checksum is 4 bytes of a SHA1 hash, but I can't figure out what the SHA1 hash is taken on.

Where are the 4 bytes of the APKINDEX checksum coming from? Specifically, what is the algorithm for recalculating it? I apologize if this has already been answered but I've spent multiple days searching the internet and not come up with anything.

1 Answer 1


Found the answer. It is a straightforward 4 bytes of the SHA1 hash of the repository name. So, like, if the repository is https://dl-cdn.alpinelinux.org/alpine/v3.18/main, the SHA1 hash of that URL is 49104001a9bfdb6b41229ce23bb30b7aec6c4fdd and the APKINDEX file will be APKINDEX.49104001.tar.gz

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .