The following script
#!/bin/sh -e
wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub
wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.32-r0/glibc-2.32-r0.apk
apk add glibc-2.32-r0.apk && rm glibc-2.32-r0.apk
sleep 1
run on an alpine:3.16 image succeeds, while there is definitely an error in the apk add glibc-2.32-r0.apk command.
/ # ./script.sh
Connecting to github.com (140.82.121.3:443)
Connecting to objects.githubusercontent.com (185.199.108.133:443)
saving to 'glibc-2.32-r0.apk'
glibc-2.32-r0.apk 100% |**************************************************************************************************************************************************************************************************| 4331k 0:00:00 ETA
'glibc-2.32-r0.apk' saved
(1/1) Installing glibc (2.32-r0)
ERROR: glibc-2.32-r0: trying to overwrite etc/nsswitch.conf owned by alpine-baselayout-data-3.2.0-r23.
1 error; 44 MiB in 20 packages
/ # echo $?
0
Why isn't the && operator in the following line
apk add glibc-2.32-r0.apk && rm glibc-2.32-r0.apk
work as expected?
Because the shell can't distinguish between a 1 returned because of a failure and a 1 returned to successfully indicate false, any case where you're branching on a command disables set -e behavior for the duration of that command.
Thus, because the && rm glibc-2.32-r0.apk happens conditionally on whether the apk command succeeds, that apk command is "checked", so set -e does not apply for it; the sleep at the last line is executed, and its exit status (of 0) is returned for the script as a whole.