alpine package & sign 구조

 

 

https://wiki.alpinelinux.org/wiki/Apk_spec

 

 

 

$ binwalk acct-6.6.4-r1.apk 
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
667           0x29B           gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
1267          0x4F3           gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)

=> 1.tar.gz, 2.tar.gz, 3.tar.gz 으로 나눔

$ sha256sum ../*.tar.gz
b766d7550c830f399dd7a6b297fcc1fadb7bd2e4099c20a13afe3698ba3c2535  ../1.tar.gz
5622e400faa3b36b9233633ac372c743aa4c22ca93348a53c0d037a52dee090a  ../2.tar.gz
a3d2a035ca0c3a7191ccbd4b2d16936ecd04e90b47aa68d3c42712bc28e95aa9  ../3.tar.gz
0e9aa9a74b2bce6a919b24ee4a840f1f00f5dabb66397615886bf16cc973cfee  ../APKINDEX.tar.gz

1.tar.gz
- .SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub

2.tar.gz (control.tar.gz)
- .PKGINFO

3.tar.gz (data.tar.gz)
- files

$ cat .PKGINFO 
# Generated by abuild 3.9.0-r0
# using fakeroot version 1.25.3
# Mon Mar 14 17:23:49 UTC 2022
pkgname = acct
pkgver = 6.6.4-r1
pkgdesc = The GNU Accounting Utilities
url = https://www.gnu.org/software/acct/
builddate = 1647278629
packager = Buildozer <alpine-devel@lists.alpinelinux.org>
size = 229376
arch = x86_64
origin = acct
commit = a8d72a50d7175c264e9694b613226632adc3b1f0
maintainer = Natanael Copa <ncopa@alpinelinux.org>
license = GPL-3.0-or-later
# automatically detected:
provides = cmd:ac=6.6.4-r1
provides = cmd:accton=6.6.4-r1
provides = cmd:dump-acct=6.6.4-r1
provides = cmd:dump-utmp=6.6.4-r1
provides = cmd:lastcomm=6.6.4-r1
provides = cmd:sa=6.6.4-r1
depend = so:libc.musl-x86_64.so.1
datahash = a3d2a035ca0c3a7191ccbd4b2d16936ecd04e90b47aa68d3c42712bc28e95aa9

$ openssl dgst -verify pub.pem -sha1 -signature .SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub ../2.tar.gz 
Verified OK

 

 

APKINDEX 도 마찬가지임

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
666           0x29A           gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)