Skip to content

Automatic package updates bypass custom feeds exclusion #1867

Description

@Tbaile

Steps to reproduce

  • Add a custom feed via customfeeds.list (see docs/design/distfeed.md).
  • Wait for the nightly package-update cron to run, or trigger a package update check/install from the UI.

Expected behavior

Automatic update paths (nightly cron and UI update flow) should ignore customfeeds.list and only consider packages from the official NethSecurity distfeed, since custom-feed packages are not rebuilt or QA'd by NethSecurity.

Actual behavior

Nightly updates and the UI's update check/install flow call apk directly, so custom feeds are considered like any other repo. This can cause a package to be upgraded from an upstream/custom feed by mistake, bypassing NethSecurity's QA channel. Manual apk invocations are unaffected either way.

Components

ns-plug 1.3.1
ns-api 3.7.1

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

Status
In Progress 🛠

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions