Remove xattr config and alpine tools dependency

* Remove the old way of handling configuration via xattrs
	* this seemed clever at the time and it worked fine, but it was
		finicky and there really aren't great tools for copying that around
		(despite what some utils say, they just didn't work as expected)
	* move to a new way of keeping config in separate directory structure
	* static files are still separate, so they can still be served via
		any web server
* Remove alpine tools dependency
	* we now use the alpine go package to handle generating apkindexes
	* no longer requires having apk and abuild-sign binaries available
* Reorganize the directory and URL structure
	* the above changes requires some minor changes to the dir/url
		structure
	* you know me, while I was there...

Dockerfile

@@ -16,7 +16,7 @@ RUN ["go", "build", "./cmd/api"]
 # we need edge because we built packages for edge
 FROM alpine:edge
 
-LABEL maintainer="iggy@atlascloud.xyz"
+LABEL maintainer="packages@atlascloud.xyz"
 LABEL org.opencontainers.image.source=https://github.com/atlascloud/packages
 LABEL org.opencontainers.image.description="API for managing packages service"
 

README.md

@@ -4,23 +4,22 @@
 
 host packages for distributions
 
-## Notes
-
-Currently we call out to apk, so you either need to run this in an alpine container/host or have a
-standalone apk binary in your path
-
 ## Functionality
+
 ### Implemented
 
+* organizations
+  * support for multiple orgs per server
+  * organization level tokens
 * distributions
   * get info
   * get versions
   * NOTE: only alpine is currently supported
-* organizations
-  * support for multiple orgs per server
-  * organization level tokens
-* repos
-  * support for multiple repos per org
+* repository versions
+* repositories
+  * support for multiple repos per distribution/version
+* architectures
+* packages
 
 
 ### Planned
@@ -34,5 +33,72 @@ standalone apk binary in your path
 * aliases
   * version aliases
     * 10.0 -> buster
-    * 20.04 -> bionic
-  *
+    * 20.04 -> focal
+
+## directory layout
+
+### conceptual
+* root
+  * static
+    * orgs
+      * distros - public keys
+        * distroversion
+          * repos
+            * packages (.apk/.deb/.rpm/etc)
+  * config
+    * orgs - pkg/repo signing private keys / tokens
+      * tokens - org level tokens
+      * distros - pkg/repo signing private keys / tokens
+        * distroversion - pkg/repo signing private keys / tokens
+          * repos - pkg/repo signing private keys / tokens
+
+### examples
+* /srv/packages
+  * /static
+    * /atlascloud
+      * /alpine
+        * /somekey.pub
+        * /edge
+          * /key.pub
+          * /main
+          * /community
+        * /3.19
+          * /main
+      * /ubuntu
+        * /repokey.pub
+        * /dists
+          * /24.04 -> noble
+            * /main
+            * /universe
+            * /multiverse
+            * /restricted
+        * /pool
+          * /main
+            * /a,/b,/c... - debs
+          * /multiverse
+            * /a,/b,/c...
+      * /fedora
+        * /linux
+          * /releases
+            * /39
+              * /Server
+                * x86_64
+                  * /os
+                    * /Packages
+                      * /a,/b,/c - rpms
+  * /config
+    * /atlascloud
+      * /tokens
+      * /alpine
+        * /privkey.key
+        * /tokens
+          * /name
+          * /2
+        * /edge
+          * /privkey.key
+          * /main
+            * /priv.key
+
+### TODO
+* server wide tokens for doing things like creating orgs, etc
+

Taskfile.yml

@@ -20,6 +20,8 @@ tasks:
       # -o /local/gen/packages
 
   build:
+    env:
+      CGO_ENABLED: 0
     cmds:
       - go build ./cmd/api
 

cmd/api/main.go

@@ -17,7 +17,7 @@ import (
 )
 
 func main() {
-	var port = flag.Int("port", 8888, "Port for test HTTP server")
+	var port = flag.Int("port", 8888, "Port for HTTP server")
 	flag.Parse()
 
 	swagger, err := repoApi.GetSwagger()
@@ -36,7 +36,7 @@ func main() {
 	// This is how you set up a basic Echo router
 	e := echo.New()
 	// Enable metrics middleware
-	p := prometheus.NewPrometheus("echo", nil)
+	p := prometheus.NewPrometheus("packages", nil)
 	p.Use(e)
 
 	// Log all requests
@@ -50,14 +50,11 @@ func main() {
 	validatorOptions := &middleware.Options{}
 
 	validatorOptions.Options.AuthenticationFunc = func(ctx context.Context, input *openapi3filter.AuthenticationInput) error {
-		// log.Debug().
-		// 	Interface("ctx", ctx).
-		// 	Interface("input.PathParams", input.RequestValidationInput.PathParams).
-		// 	Interface("input.Route", input.RequestValidationInput.Route).
-		// 	Msg("authenticator input")
 		orgName := input.RequestValidationInput.PathParams["org"]
-		repoName := input.RequestValidationInput.PathParams["slug"]
-		validTokens := repoApi.GetValidTokens(orgName, repoName)
+		validTokens := repoApi.GetValidTokens(orgName)
+		if input.RequestValidationInput.Request.Header.Get("Authorization") == "" {
+			return errors.New("no auth token")
+		}
 		token := strings.Split(input.RequestValidationInput.Request.Header["Authorization"][0], " ")[1]
 		for _, t := range validTokens {
 			if token == t {

go.mod

@@ -1,68 +1,84 @@
 module github.com/iggy/packages
 
-go 1.19
+go 1.21
+
+toolchain go1.21.5
+
+// replace gitlab.alpinelinux.org/alpine/go => /home/iggy/projects/gitlab.alpinelinux.org/iggy/go
 
 require (
+	github.com/aws/aws-sdk-go-v2 v1.24.1
+	github.com/aws/aws-sdk-go-v2/config v1.26.3
+	github.com/aws/aws-sdk-go-v2/credentials v1.16.14
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.48.0
 	github.com/deepmap/oapi-codegen v1.13.0
 	github.com/getkin/kin-openapi v0.118.0
 	github.com/labstack/echo-contrib v0.15.0
-	github.com/labstack/echo/v4 v4.11.1
-	github.com/pkg/xattr v0.4.9
+	github.com/labstack/echo/v4 v4.11.4
+	github.com/oapi-codegen/runtime v1.1.1
 	github.com/rs/zerolog v1.29.1
 	github.com/steinfletcher/apitest v1.5.15
+	github.com/viant/afs v1.25.0
+	gitlab.alpinelinux.org/alpine/go v0.9.0
 )
 
 require (
+	github.com/MakeNowJust/heredoc/v2 v2.0.1 // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
+	github.com/aws/smithy-go v1.19.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bytedance/sonic v1.9.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
-	github.com/gin-contrib/sse v0.1.0 // indirect
-	github.com/gin-gonic/gin v1.9.1 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/swag v0.21.1 // indirect
-	github.com/go-playground/locales v0.14.1 // indirect
-	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.14.0 // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/gorilla/mux v1.8.0 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/uuid v1.5.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/invopop/yaml v0.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.4 // indirect
-	github.com/labstack/gommon v0.4.0 // indirect
-	github.com/leodido/go-urn v1.2.4 // indirect
+	github.com/labstack/gommon v0.4.2 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/perimeterx/marshmallow v1.1.4 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.14.0 // indirect
 	github.com/prometheus/client_model v0.3.0 // indirect
 	github.com/prometheus/common v0.40.0 // indirect
 	github.com/prometheus/procfs v0.9.0 // indirect
 	github.com/rogpeppe/go-internal v1.10.0 // indirect
-	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.2.11 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
-	golang.org/x/arch v0.3.0 // indirect
-	golang.org/x/crypto v0.11.0 // indirect
-	golang.org/x/net v0.12.0 // indirect
-	golang.org/x/sys v0.10.0 // indirect
-	golang.org/x/text v0.11.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
+	golang.org/x/crypto v0.17.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	google.golang.org/protobuf v1.32.0 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+// replace gitlab.alpinelinux.org/alpine/go => gitlab.alpinelinux.org/abemedia/go v0.8.1-0.20231202003941-ea851dc19408