Packages and repositories

Packages

A Core Linux package is a plain .txz file: an xz-compressed tarball of the files it installs, rooted at /. It carries no metadata and no install scripts. Everything else about it lives in the repository's index.

Packages come from two places:

• Repacked Alpine packages. repack turns an Alpine .apk into <name>-<version>.txz. It moves bin/, lib/, lib64/ and sbin/ under usr/ to fit the usr-merged layout, and drops the apk's control files, so no install scripts run.
• Core Linux's own packages, like core-base and core-rc. Each is a directory with a version file, an mtree that names every entry, and the files/ themselves. mkpkg packs them.

note

busybox's own install script would create its applet links. Since repacked packages run no scripts, repacking busybox also writes a busybox-links package with those links, minus sh.

Repositories

A repository is a directory of packages, an index and a set of profiles:

pkgrepo/

repo/<repo>/<name>-<version>.txz
repo/<repo>/pkgindex             # name version file size sha256
repo/<repo>/profiles/<profile>   # package names, one per line

Each directory under repo/ is a separate repository. corefs uses core.

The package index

pkgindex has one line per package, with five space-separated fields:

Field	Example
name	busybox
version	1.37.0-r30
file	busybox-1.37.0-r30.txz
size	443408 (bytes)
sha256	da0c83cf1b9a…

repo/core/pkgindex (excerpt)

bash 5.3.3-r1 bash-5.3.3-r1.txz 389392 aca57b0170709bd3…
busybox 1.37.0-r30 busybox-1.37.0-r30.txz 443408 da0c83cf1b9a873d…
core-base 0.1 core-base-0.1.txz 816 f008fd59566f8706…

The index is never written by hand: make index generates it from the package files, sorted, so the same packages always produce the same index.

Why isn't the index JSON?

A package manager running inside Core Linux may have nothing but a shell to work with. With one package per line, a single loop is the entire parser:

while read -r name ver file size sha; do
    ...
done < pkgindex

New fields, such as dependencies, can go on the end of each line without breaking existing readers.

Profiles

A profile is what corefs install <profile> installs: package names, one per line, with # comments. There are no dependencies yet, so a profile lists everything its packages need. Here's the end of base:

repo/core/profiles/base (excerpt)

# compression
xz
xz-libs

# data
tzdata

# boot: init's scripts, the kernel, and what builds its initramfs
core-rc
linux-virt
mkinitfs

The whole base profile:

Packages	For
core-base	Accounts, os-release and the rest of /etc
musl	C library
busybox, busybox-links, busybox-binsh	Shell and userland
bash, readline, libncursesw, ncurses-terminfo-base	Bash
xz, xz-libs	Compression
tzdata	Time zone data
core-rc, linux-virt, mkinitfs	Booting

How corefs installs a profile

1. Create the root filesystem skeleton and the usr-merge links.
2. Download pkgindex and the profile.
3. Look up every package in the index. An unknown package stops corefs before anything is downloaded.
4. Download every package.
5. Check each package's size and SHA-256 against the index.
6. Unpack each package and record its version and file list in /var/lib/corefs/<name>/.
7. Delete the downloads, unless COREFS_CACHE is set.

Nothing is unpacked until every package has been checked.

The index isn't signed yet

The size and checksum checks catch corrupted downloads, but whoever controls the mirror can change the index too. A signed index is planned.