ARTIFACTORY: Step by Step guide to enable RSA key for an Alpine Repository

Alpine Linux requires RSA keys by default. If you do not configure RSA keys, the apk client will give an “UNTRUSTED signature” error and users have to use the allow-untrusted flag to fetch packages from the Alpine repositories. 

This guide will help you to generate and configure RSA keys for Alpine repositories in the Artifactory.

To Generate RSA Key

Private key:

openssl genrsa -out myrsaalpine 2048

File name : myrsaalpine

Public key:

openssl rsa -in myrsaalpine -pubout -out myalpine.rsa.pub

File name: myalpine.rsa.pub

To upload RSA Keys 

1. In the JFrog Platform UI, go to the Administration module and then go to Artifactory | Security | Keys Management.
2. Click + Add Keys, and from the dropdown, select RSA Keys.
3. Enter the RSA parameters generated when creating the RSA Key Pair.
4. Click Add RSA Key to save the new key.

Configure RSA key for Local/Virtual Alpine Repository

1. To create an Alpine Linux local/Virtual repository, navigate to the Administration module, go to Repositories| Repositories
2. Create a new Local/Virtual repository
3. Select Alpine as the Package Type.

• For local, In the Advanced tab, you can select an RSA key from the list to sign the Alpine Linux index file.
• For virtual, in the Basic settings, you can select an RSA key pair from the list to sign the Alpine Linux packages.

Configure Alpine repository in APK client

sh -c "echo 'http://<username>:<password_encrypted>@localhost:8081/artifactory/test-alpine/v3.18/main'" >> /etc/apk/repositories

Configure RSA pub key in APK client

wget -O /etc/apk/keys/alpinersa.rsa.pub http://<username>:<password_encrypted>@localhost:8081/artifactory/api/security/keypair/public/repositories/test-alpine

Note: Please ensure to use the same key name you have selected in the Virtual/Local repositories to configure in the Alpine machine as well or the Artifactory won’t accept it. Here, the pub key is saved as alpinersa.rsa.pub, because the name we selected in the repository is ‘alpinersa’.

You can verify this by doing an ‘apk update’ and if it results without a “UNTRUSTED signature” error then validation is successful. 

/ # apk update
fetch http://admin:*@localhost:8081/artifactory/test-alpine/v3.18/main/x86_64/APKINDEX.tar.gz
OK: 5156 distinct packages available

References

RSA key: https://wiki.alpinelinux.org/wiki/Include:Abuild-keygen
Alpine repo in Artifactory: https://jfrog.com/help/r/jfrog-artifactory-documentation/alpine-linux-repositories