Add an Alpine APK repository client for v2 indexes

[andrew]

Part of #62: the v2 APKINDEX.tar.gz side. v3 Packages.adb decoding waits on an ADB decoder shared with git-pkgs/archives#30 and a fixture generated with apk mkndx.

Adds an apk registry with no default URL, so a missing URL gets the existing "no registry URL configured" error. The URL is one architecture directory such as https://dl-cdn.alpinelinux.org/alpine/v3.23/main/x86_64, or an exact index URL in one. Nothing is inferred from a mirror root. For a directory the client asks for Packages.adb first and falls back to APKINDEX.tar.gz only on a 404, as apk-tools does. If a Packages.adb is served, it returns ErrV3IndexUnsupported rather than reading the other index, so v3 support can later turn that error into a result without changing what any repository resolves to today. The index is fetched once per registry instance.

The parser reads the APKINDEX member across the signature and index gzip streams and maps the fields from apk-tools' apk_adb.c: name, version, description, URL, license, arch, build time (PublishedAt), maintainer, file and installed size, origin, commit, provider priority, depends, provides, replaces and install-if. Malformed lines, records with no P or V, bad numbers, truncated archives and archives with no APKINDEX member return ErrMalformedIndex. Versions sort with the apk scheme from vers, so -r10 sorts above -r9, and lookups match the exact version including the revision.

FetchDependencies returns D entries as runtime dependencies with the operator kept in Requirements (libcurl / =8.22.0-r0), and leaves out ! conflicts. Everything is also in version metadata. Maintainers in Name <email> form are split; anything else is kept whole as the name. Names may carry the PURL vendor namespace: alpine/curl looks up curl and FetchPackage returns Namespace: "alpine".

The C: checksum is not used as integrity. On curl-8.22.0-r0.apk, the Q1 value 25ef42c2…8161 is the SHA-1 of the package's second gzip stream (the control section), while the whole file's SHA-1 is b9119fc5…1e73. Putting it in Integrity would make a consumer that verifies downloads, such as git-pkgs/proxy, reject every package. It's exposed in metadata as checksum (raw), checksum_algorithm (sha1, or md5 for legacy hex), checksum_hex and checksum_covers: control.

Each version has one artifact, <name>-<version>.apk beside the index, with S: as its size and arch in its metadata. URLs().Download builds the same URL without loading the index, so fetch.Resolver resolves APKs with no request.

The test fixture is four records trimmed from the live v3.23 main/x86_64 index, packed into the same two-stream layout in the test. Against dl-cdn.alpinelinux.org, v3.23/main/x86_64 and v3.23/main/aarch64/APKINDEX.tar.gz resolve curl 8.22.0-r0 with sizes matching the files, and edge/community/x86_64 (about 2.5 MB compressed) loads in under a second.

https://claude.ai/code/session_01NxsA75HBjdWQKcdx7FDTDc

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.