How to configure updates for APK packages?

[charleskorn]

I've got a Dockerfile that looks like this:

RUN apk add --no-cache \
    bash=5.0.17-r0 \
    curl=7.69.1-r1 \
    openjdk11-jre-headless=11.0.9_p11-r0 \
    python3=3.8.5-r0

I'm trying to set up a regex manager using Repology to keep those packages up to date automatically. I've got the following configuration in my renovate.json:

{
  "regexManagers": [
    {
      "fileMatch": ["(^|/)Dockerfile$"],
      "matchStrings": [
        "(?:RUN apk add --no-cache\\s+|\\\\\\s+)(?<depName>[a-zA-Z0-9-]+)=(?<currentValue>[a-zA-Z0-9-._]+)"
      ],
      "versioningTemplate": "loose",
      "datasourceTemplate": "repology",
      "lookupNameTemplate": "alpine_3_12/{{depName}}"
    }
  ]
}

This correctly picks up all of the packages (I can see them in the debug logs). However, some of them (openjdk11-jre-headless and python3) aren't updated automatically - I can see Failed to look up dependency openjdk11-jre-headless error messages in the logs.

Digging through the code, this seems to be because the Repology datasource assumes the depName or lookupName matches the Repology project name, but this isn't true for these dependencies - in the case of openjdk11-jre-headless, it's a package on the openjdk project, not a top-level project in its own right, and this is the similar for python3 (it's on the python project).

Is there some way to configure the project Renovate uses when querying Repology? Alternatively, is there a way for Renovate to search by package name rather than project name?

[rarkins]

depName and lookupName can be different. So this sounds like a case where depName could be python3 and lookupName could be python, for example. But I'm not sure of the best place to do such mappings.

[charleskorn]

I'm not sure that setting depName and lookupName to different values will help - looking at the Repology datasource, it only considers lookupName (and this matches with my experience of trying different things), and expects the Repology project and package names to be the same.

Maybe in addition to the current <repo>/<project> format for lookupName, the Repology datasource could accept a <repo>/<project>/<package> format? Another option would be adding a dedicated APK datasource that pulls data directly from the package mirrors.

[rarkins]

lookupName can be modified to accept whatever format the datasource supports, so if it's backwards-compatible then go ahead. But I suggest trying to get the attention @danez or @ppmathis who might understand your problem better than I do

[danez]

It seems I broke this with #7833 because I assumed that projectName == packageName is always the case in repology. It probably worked before that. My bad sorry.

I will create a PR restoring the old behaviour in case packageName != projectName to use the urls from this tool https://repology.org/tools/project-by which can translate packageNames to projects. (e.g.: https://repology.org/tools/project-by?repo=alpine_3_12&name_type=binname&target_page=api_v1_project&noautoresolve=on&name=python3)

[viceice]

@rarkins should we move this to an issue and track as bug?

[rarkins]

Unfortunately it's not possible to move discussions back to issues so I have created #7988 to track the bug. @danez if you can add a comment there then I will be allowed to assign it to you