Steps to reproduce
- Add a custom feed via
customfeeds.list (see docs/design/distfeed.md).
- Wait for the nightly package-update cron to run, or trigger a package update check/install from the UI.
Expected behavior
Automatic update paths (nightly cron and UI update flow) should ignore customfeeds.list and only consider packages from the official NethSecurity distfeed, since custom-feed packages are not rebuilt or QA'd by NethSecurity.
Actual behavior
Nightly updates and the UI's update check/install flow call apk directly, so custom feeds are considered like any other repo. This can cause a package to be upgraded from an upstream/custom feed by mistake, bypassing NethSecurity's QA channel. Manual apk invocations are unaffected either way.
Components
ns-plug 1.3.1
ns-api 3.7.1
Steps to reproduce
customfeeds.list(seedocs/design/distfeed.md).Expected behavior
Automatic update paths (nightly cron and UI update flow) should ignore
customfeeds.listand only consider packages from the official NethSecurity distfeed, since custom-feed packages are not rebuilt or QA'd by NethSecurity.Actual behavior
Nightly updates and the UI's update check/install flow call
apkdirectly, so custom feeds are considered like any other repo. This can cause a package to be upgraded from an upstream/custom feed by mistake, bypassing NethSecurity's QA channel. Manualapkinvocations are unaffected either way.Components
ns-plug 1.3.1
ns-api 3.7.1