docs: packages.md counts what world.lock actually holds

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EVRhxi9zpdW2uDUN4FVcao
This commit is contained in:
Nexoniarz 2026-10-26 08:08:25 +01:00
commit 42008c26c0

View file

@ -48,7 +48,7 @@ It is the only root; `sysroot/` is what schos-base is packaged from. Only
`alpine-lock` asks Alpine what is current. A normal build installs exactly what `alpine-lock` asks Alpine what is current. A normal build installs exactly what
`world.lock` names — files in `dist/alpine/`, fetched once and checked against the `world.lock` names — files in `dist/alpine/`, fetched once and checked against the
lock's sha256, and against Alpine's signatures by apk — and never asks what is newer. lock's sha256, and against Alpine's signatures by apk — and never asks what is newer.
`world.lock` resolves the handful of names in `world` into a few hundred files, every `world.lock` resolves the thirty-odd names in `world` into about 180 packages, every
dependency included, so every image after the first is reproducible. dependency included, so every image after the first is reproducible.
schos-base and its repository index are signed with a key made on the first build schos-base and its repository index are signed with a key made on the first build