Creating an Alpine package for a Go application — APKBUILD
A practical walkthrough for packaging a simple Go application for Alpine Linux using APKBUILD, from setup and checksums to building and submitting.
This article is a practical walkthrough for creating an Alpine package for a small Go application using APKBUILD.
Before starting, I recommend skimming:
Step 1: Create a small Go app
package main
import "fmt"
func main() {
fmt.Println("Hello from Alpine package!")
}
Push it to GitHub and include basic project files like a LICENSE. My example project was hello-alpine.
Step 2: prepare Alpine packaging tools
I used Docker because I was working from macOS, but you can do the same on an Alpine environment directly.
docker volume create alpine_data
docker run -it --name alpine_container -v alpine_data:/data alpine:latest /bin/sh
apk update
apk add alpine-sdk abuild sudo doas
adduser -D builder
addgroup builder abuild
Step 3: create the APKBUILD
Alpine provides newapkbuild to generate a starting point. From there you can update metadata, architecture, sources, and install steps.
newapkbuild -r \
-u "https://github.com/manzil-infinity180/hello-alpine" \
-d "A simple hello alpine go application" \
-l "Apache-2.0 license" \
"hello-alpine"
After editing APKBUILD, run the standard packaging flow:
abuild checksum
abuild -r
apkbuild-lint APKBUILD
Step 4: inspect and install the package
Once the package is built, Alpine places the resulting .apk under the packages directory. You can inspect it with tar and test installation with apk add --allow-untrusted.
tar tvvf hello-alpine-1.0.2-r0.apk
doas apk add --allow-untrusted ~/packages/builder/aarch64/hello-alpine-1.0.2-r0.apk
hello-alpine
Step 5: submit to Alpine
Since new packages generally go to testing, the usual flow is to add testing/<pkgname>/APKBUILD, commit it, and open a merge request on Alpine’s GitLab.
One review comment I hit was that the package should build from source rather than depending on a binary release. So I updated the APKBUILD to use a source tarball and go build directly.
makedepends="go"
source="$pkgname-$pkgver.tar.gz::https://github.com/manzil-infinity180/hello-alpine/archive/refs/tags/v$pkgver.tar.gz"
build() {
go build -o hello-alpine .
}
package() {
install -Dm755 "$srcdir/hello-alpine" "$pkgdir/usr/bin/hello-alpine"
}
That source-based approach is the better final version.
More posts
Introduction to Witness: Verifying Software Supply Chain Attestations
Aug 23, 2025 3 min readA practical introduction to Witness: generating keys, recording attestations, signing policy, and verifying a simple Go binary against supply chain requirements.
Alpine Linux Package Management + Practice
Jul 28, 2025 6 min readA hands-on overview of Alpine package management with apk, including update, add, delete, search, inspect, verify, and graphing package dependencies.
Why I Joined TestifySec and Contribute to Witness & Archivista
Oct 11, 2025 2 min readWhy I decided to join TestifySec, explore software supply chain security more deeply, and contribute to Witness and Archivista under the in-toto ecosystem.
Written by Rahul Vishwakarma — this is the first-party home for this article on rahulxf.com. A copy also lives on Medium .