fix(recipes): retry setup-apkrepos until the apk lock frees

internal/recipes/bundled/devtools/install.sh

@@ -6,7 +6,15 @@ set -e
 
 # -c enables community (where most of these live outside the base set); -1
 # picks a mirror and refreshes indexes, so no separate `apk update`.
-setup-apkrepos -c -1
+# setup-apkrepos runs apk update with no lock-wait, so another apk that holds
+# the database lock fails it with exit 99. Retry until the lock frees, up to
+# ~60s.
+n=0
+until setup-apkrepos -c -1; do
+    n=$((n + 1))
+    [ "$n" -ge 30 ] && { echo "apk database stayed locked; giving up" >&2; exit 1; }
+    sleep 2
+done
 
 # build-base is Alpine's meta-package for gcc/make/libc-dev: the equivalent of
 # Debian's build-essential. Alpine has no package called "build-essential".

internal/recipes/bundled/docker/install.sh

@@ -7,7 +7,15 @@ set -e
 # no docker package at all). -1 picks the fastest mirror and refreshes the
 # indexes, so a separate `apk update` would be redundant work that only widens
 # the window for a transient network drop to kill the run under `set -e`.
-setup-apkrepos -c -1
+# setup-apkrepos runs apk update with no lock-wait, so another apk that holds
+# the database lock fails it with exit 99. Retry until the lock frees, up to
+# ~60s.
+n=0
+until setup-apkrepos -c -1; do
+    n=$((n + 1))
+    [ "$n" -ge 30 ] && { echo "apk database stayed locked; giving up" >&2; exit 1; }
+    sleep 2
+done
 
 # Verified against pkgs.alpinelinux.org: both are in community, and compose is
 # a SEPARATE package from docker (docker alone gives you no `docker compose`).

internal/recipes/bundled/tailscale/install.sh

@@ -11,7 +11,15 @@ set -e
 
 # -c enables community, where tailscale lives; -1 picks a mirror and refreshes
 # indexes, so no separate `apk update`.
-setup-apkrepos -c -1
+# setup-apkrepos runs apk update with no lock-wait, so another apk that holds
+# the database lock fails it with exit 99. Retry until the lock frees, up to
+# ~60s.
+n=0
+until setup-apkrepos -c -1; do
+    n=$((n + 1))
+    [ "$n" -ge 30 ] && { echo "apk database stayed locked; giving up" >&2; exit 1; }
+    sleep 2
+done
 
 # --wait 60 makes apk wait up to 60s for the lock instead of failing with
 # exit 99 when another apk run holds it.

internal/recipes/bundled/xfce/install-alpine.sh

@@ -2,12 +2,15 @@
 # Installs XFCE and starts it. Runs as root over ssh, on a booted Alpine live VM.
 set -e
 
-# setup-apkrepos -c -1 already refreshes the indexes ("Updating repository
-# indexes... done"), so a separate `apk update` here is redundant work that
-# only widens the window for a transient ssh/network drop under `set -e` to
-# kill the whole provision. Don't add retries either: a real apk failure
-# should still fail loudly.
-setup-apkrepos -c -1
+# setup-apkrepos -c -1 refreshes the indexes, so no separate `apk update` runs
+# here. It runs apk update with no lock-wait, so another apk that holds the
+# database lock fails it with exit 99. Retry until the lock frees, up to ~60s.
+n=0
+until setup-apkrepos -c -1; do
+    n=$((n + 1))
+    [ "$n" -ge 30 ] && { echo "apk database stayed locked; giving up" >&2; exit 1; }
+    sleep 2
+done
 
 setup-xorg-base
 # --wait 60 makes apk wait up to 60s for the lock instead of failing with