apko resolver resolves to older version of py3.13-pip

[kranurag7]

using the following apko config, If I generate the locks then apko is resolving to older version of py3.13-pip which is 25.2-r1 however latest present in index is 25.3-r1

contents:
  keyring:
    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
  repositories:
    - https://packages.wolfi.dev/os

  packages:
    - py3.13-pip

archs:
- arm64

entire locked json config is following

Details

{
  "version": "v1",
  "config": {
    "name": "new.yaml",
    "checksum": "sha256-rhqz58mgUJ8w9vu6KWCUmfJLdHpsYdqAIR7ULasivpo="
  },
  "contents": {
    "keyring": [
      {
        "name": "packages.wolfi.dev/os/wolfi-signing.rsa.pub",
        "url": "https://packages.wolfi.dev/os/wolfi-signing.rsa.pub"
      }
    ],
    "build_repositories": [],
    "runtime_repositories": [],
    "repositories": [
      {
        "name": "packages.wolfi.dev/os/aarch64",
        "url": "https://packages.wolfi.dev/os/aarch64/APKINDEX.tar.gz",
        "architecture": "aarch64"
      }
    ],
    "packages": [
      {
        "name": "wolfi-baselayout",
        "url": "https://packages.wolfi.dev/os/aarch64/wolfi-baselayout-20230201-r24.apk",
        "version": "20230201-r24",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-1806",
          "checksum": "sha1-Gphf+Rdii6FuTSLtvlPuOR/xIlI="
        },
        "data": {
          "range": "bytes=1807-13352",
          "checksum": "sha256-Qz+j5Bra2RYCbNiQPiWwMGjbpz6RbQgb+DHSkxgAMXQ="
        },
        "checksum": "Q1Gphf+Rdii6FuTSLtvlPuOR/xIlI="
      },
      {
        "name": "ca-certificates-bundle",
        "url": "https://packages.wolfi.dev/os/aarch64/ca-certificates-bundle-20251003-r0.apk",
        "version": "20251003-r0",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-6609",
          "checksum": "sha1-g3pe+QYG4ISthpZzbnolf/zIPm0="
        },
        "data": {
          "range": "bytes=6610-138293",
          "checksum": "sha256-pM1Bq1QY3atLJGp7JUaD4XP5XIzkhKMTTHGhHd4AE4U="
        },
        "checksum": "Q1g3pe+QYG4ISthpZzbnolf/zIPm0="
      },
      {
        "name": "libgcc",
        "url": "https://packages.wolfi.dev/os/aarch64/libgcc-15.2.0-r5.apk",
        "version": "15.2.0-r5",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-6562",
          "checksum": "sha1-ebSoO1Pnk1O48wzWTInoYpZqJWQ="
        },
        "data": {
          "range": "bytes=6563-82897",
          "checksum": "sha256-VTk3VH4ipEUbfLoqxVbBQ5RRr9Ka8xep8rVyPD5M1FE="
        },
        "checksum": "Q1ebSoO1Pnk1O48wzWTInoYpZqJWQ="
      },
      {
        "name": "glibc-locale-posix",
        "url": "https://packages.wolfi.dev/os/aarch64/glibc-locale-posix-2.42-r4.apk",
        "version": "2.42-r4",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-11285",
          "checksum": "sha1-S0WiV2WxQz48h8B4r4PeGjexdbk="
        },
        "data": {
          "range": "bytes=11286-87351",
          "checksum": "sha256-NoghpmYjwGRz7CYTbnb3tfmmEChCUJDaK7I18gCMF8c="
        },
        "checksum": "Q1S0WiV2WxQz48h8B4r4PeGjexdbk="
      },
      {
        "name": "glibc",
        "url": "https://packages.wolfi.dev/os/aarch64/glibc-2.42-r4.apk",
        "version": "2.42-r4",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-11516",
          "checksum": "sha1-oUg098E5w6cByVmFXLR6X67Q8fA="
        },
        "data": {
          "range": "bytes=11517-2148034",
          "checksum": "sha256-8j8feEdE+5FdoLQ8zDB3aeKaVXfpGucePITntNH4Q9o="
        },
        "checksum": "Q1oUg098E5w6cByVmFXLR6X67Q8fA="
      },
      {
        "name": "ld-linux",
        "url": "https://packages.wolfi.dev/os/aarch64/ld-linux-2.42-r4.apk",
        "version": "2.42-r4",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-11300",
          "checksum": "sha1-gZBqUMkEKDXNl+usidNJgSBD3qo="
        },
        "data": {
          "range": "bytes=11301-121764",
          "checksum": "sha256-bk0TW/eYMmiWYapQV5WZAvzgK+fRLcgCbGMVjiX3On4="
        },
        "checksum": "Q1gZBqUMkEKDXNl+usidNJgSBD3qo="
      },
      {
        "name": "zlib",
        "url": "https://packages.wolfi.dev/os/aarch64/zlib-1.3.1-r51.apk",
        "version": "1.3.1-r51",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-7324",
          "checksum": "sha1-tsMFsix2JCqVx/gQd+2yCWxJYSU="
        },
        "data": {
          "range": "bytes=7325-56968",
          "checksum": "sha256-jASYiEAr7PdGaa+2YwD6gtrSOcUkUh+UZ5I7IQShGQA="
        },
        "checksum": "Q1tsMFsix2JCqVx/gQd+2yCWxJYSU="
      },
      {
        "name": "ncurses-terminfo-base",
        "url": "https://packages.wolfi.dev/os/aarch64/ncurses-terminfo-base-6.5_p20251025-r1.apk",
        "version": "6.5_p20251025-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-4662",
          "checksum": "sha1-HgzZS77q0kxHK5qWn+09DoVuq54="
        },
        "data": {
          "range": "bytes=4663-106095",
          "checksum": "sha256-ewpLgwYF4ZYVJSZIhb5IM954U3XJF0FOYMhNL7e2jMU="
        },
        "checksum": "Q1HgzZS77q0kxHK5qWn+09DoVuq54="
      },
      {
        "name": "ncurses",
        "url": "https://packages.wolfi.dev/os/aarch64/ncurses-6.5_p20251025-r1.apk",
        "version": "6.5_p20251025-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-4772",
          "checksum": "sha1-QKM49gIelJUotM3opr6B6b+A5h8="
        },
        "data": {
          "range": "bytes=4773-450353",
          "checksum": "sha256-9BxOLT6An6sgMp0dOGdW6c68QMAXjvv4rM+d/+TYHPE="
        },
        "checksum": "Q1QKM49gIelJUotM3opr6B6b+A5h8="
      },
      {
        "name": "readline",
        "url": "https://packages.wolfi.dev/os/aarch64/readline-8.3-r1.apk",
        "version": "8.3-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-3933",
          "checksum": "sha1-U8GDjvDj9eHCB+1NdgXp4NKzmPE="
        },
        "data": {
          "range": "bytes=3934-335034",
          "checksum": "sha256-PU16uzdKxlk7V28YHwwE6EgxQfcPeQdbqV4nrD0wyC0="
        },
        "checksum": "Q1U8GDjvDj9eHCB+1NdgXp4NKzmPE="
      },
      {
        "name": "libstdc++",
        "url": "https://packages.wolfi.dev/os/aarch64/libstdc++-15.2.0-r5.apk",
        "version": "15.2.0-r5",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-6587",
          "checksum": "sha1-yJRZURp54qn++AzGPUJXSSFqR+U="
        },
        "data": {
          "range": "bytes=6588-1077616",
          "checksum": "sha256-4nK8VRUAL7ONbflY4ppFdDsRQEsA7keJjUMrtBjqEYc="
        },
        "checksum": "Q1yJRZURp54qn++AzGPUJXSSFqR+U="
      },
      {
        "name": "mpdecimal",
        "url": "https://packages.wolfi.dev/os/aarch64/mpdecimal-4.0.1-r3.apk",
        "version": "4.0.1-r3",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-3814",
          "checksum": "sha1-XjsB519+9L0aJPetumirbHyNfUI="
        },
        "data": {
          "range": "bytes=3815-124422",
          "checksum": "sha256-rDKSWsuiiqzF8NqyAjMoumxxlEqkUzfhJF5pjJZLwAY="
        },
        "checksum": "Q1XjsB519+9L0aJPetumirbHyNfUI="
      },
      {
        "name": "gdbm",
        "url": "https://packages.wolfi.dev/os/aarch64/gdbm-1.26-r1.apk",
        "version": "1.26-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-4336",
          "checksum": "sha1-OUORz/SIO9lrZBhqTbh5oYed1EY="
        },
        "data": {
          "range": "bytes=4337-258396",
          "checksum": "sha256-2CMAwQ1McxnIuGBtrQRQ66YMOCbhyrvdeHaBMKW1ytg="
        },
        "checksum": "Q1OUORz/SIO9lrZBhqTbh5oYed1EY="
      },
      {
        "name": "libexpat1",
        "url": "https://packages.wolfi.dev/os/aarch64/libexpat1-2.7.3-r0.apk",
        "version": "2.7.3-r0",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-5040",
          "checksum": "sha1-R1SC1ZKzwY/ZbmJPUAG3UPObYRA="
        },
        "data": {
          "range": "bytes=5041-85330",
          "checksum": "sha256-lqwcDJK4VYnRgZlUY/rwfYj+t5NBOSSQhMZA7Iooa2c="
        },
        "checksum": "Q1R1SC1ZKzwY/ZbmJPUAG3UPObYRA="
      },
      {
        "name": "libbz2-1",
        "url": "https://packages.wolfi.dev/os/aarch64/libbz2-1-1.0.8-r21.apk",
        "version": "1.0.8-r21",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-6515",
          "checksum": "sha1-PkJ24QH0yEGuZPocU8f/Rxy+kAc="
        },
        "data": {
          "range": "bytes=6516-47334",
          "checksum": "sha256-KBRRtcCs5w5vBA+rlAi1HPOYLYvqgQ+V7FuahXjw4sM="
        },
        "checksum": "Q1PkJ24QH0yEGuZPocU8f/Rxy+kAc="
      },
      {
        "name": "libffi",
        "url": "https://packages.wolfi.dev/os/aarch64/libffi-3.5.2-r1.apk",
        "version": "3.5.2-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-7176",
          "checksum": "sha1-Qs5aiy7dw4QkhVYDhQOYQ6730es="
        },
        "data": {
          "range": "bytes=7177-32172",
          "checksum": "sha256-37r9+rbrYFrtP6s76Iohxff6JOsFiwUoYy2roDpiNwY="
        },
        "checksum": "Q1Qs5aiy7dw4QkhVYDhQOYQ6730es="
      },
      {
        "name": "xz",
        "url": "https://packages.wolfi.dev/os/aarch64/xz-5.8.1-r6.apk",
        "version": "5.8.1-r6",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-6317",
          "checksum": "sha1-AI0MZFQ1M4IVEjUB+5ZjAmh2JQE="
        },
        "data": {
          "range": "bytes=6318-386068",
          "checksum": "sha256-K+FiZ+TwLgb3bF/WrTYt2QNN2cVhlPjdM9h0KPxzaQY="
        },
        "checksum": "Q1AI0MZFQ1M4IVEjUB+5ZjAmh2JQE="
      },
      {
        "name": "libuuid",
        "url": "https://packages.wolfi.dev/os/aarch64/libuuid-2.41.2-r1.apk",
        "version": "2.41.2-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-7085",
          "checksum": "sha1-V6uqpPdMfoWcc8lsNswuJSFdWt0="
        },
        "data": {
          "range": "bytes=7086-59471",
          "checksum": "sha256-lNDh/vSOGPIBGPCUCp0UNf13BGLtV5kYfkOTsQIJWfc="
        },
        "checksum": "Q1V6uqpPdMfoWcc8lsNswuJSFdWt0="
      },
      {
        "name": "sqlite-libs",
        "url": "https://packages.wolfi.dev/os/aarch64/sqlite-libs-3.51.0-r0.apk",
        "version": "3.51.0-r0",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-4714",
          "checksum": "sha1-MEnaByKhsjvTSQ7M8abA4GF45jo="
        },
        "data": {
          "range": "bytes=4715-878417",
          "checksum": "sha256-e8bCx5lWIimn/pZhC2j3SZmB/PTzrGgDufDE6XtaLXo="
        },
        "checksum": "Q1MEnaByKhsjvTSQ7M8abA4GF45jo="
      },
      {
        "name": "libcrypto3",
        "url": "https://packages.wolfi.dev/os/aarch64/libcrypto3-3.6.0-r3.apk",
        "version": "3.6.0-r3",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-8841",
          "checksum": "sha1-bgSiaz2fspc+IkJH0DkpgoFIA9s="
        },
        "data": {
          "range": "bytes=8842-2201581",
          "checksum": "sha256-gV+SIkyrO+dHQJuLmuhit8GkWN+M0rUZr0lTc7wdZE4="
        },
        "checksum": "Q1bgSiaz2fspc+IkJH0DkpgoFIA9s="
      },
      {
        "name": "libssl3",
        "url": "https://packages.wolfi.dev/os/aarch64/libssl3-3.6.0-r3.apk",
        "version": "3.6.0-r3",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-8842",
          "checksum": "sha1-ion6MDf5qVSZK39kO1jGMIErgZ0="
        },
        "data": {
          "range": "bytes=8843-485674",
          "checksum": "sha256-xyB823dMxveTlnKGvmege85Hsk3qLin81icjS+cQDuI="
        },
        "checksum": "Q1ion6MDf5qVSZK39kO1jGMIErgZ0="
      },
      {
        "name": "py3-pip-wheel",
        "url": "https://packages.wolfi.dev/os/aarch64/py3-pip-wheel-25.3-r1.apk",
        "version": "25.3-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-8594",
          "checksum": "sha1-egFAaaC/LI1fkuij9LzRh5xoB0U="
        },
        "data": {
          "range": "bytes=8595-1760470",
          "checksum": "sha256-yPxD9pwLr8Qbkzs1exKo3K6prqWvAmrolE5Wb4kMeJk="
        },
        "checksum": "Q1egFAaaC/LI1fkuij9LzRh5xoB0U="
      },
      {
        "name": "python-3.13-base",
        "url": "https://packages.wolfi.dev/os/aarch64/python-3.13-base-3.13.9-r1.apk",
        "version": "3.13.9-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-9529",
          "checksum": "sha1-V68YSgQ2lP8KQcju7pmJ5NHGVCU="
        },
        "data": {
          "range": "bytes=9530-11623781",
          "checksum": "sha256-rLbLjsxlwJB7i+Urmr3eqxTD3+7B7K++1TcKsXS2Ifg="
        },
        "checksum": "Q1V68YSgQ2lP8KQcju7pmJ5NHGVCU="
      },
      {
        "name": "py3.13-setuptools",
        "url": "https://packages.wolfi.dev/os/aarch64/py3.13-setuptools-80.9.0-r2.apk",
        "version": "80.9.0-r2",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-6939",
          "checksum": "sha1-9fG96KH8tRNQVVZwydMLISZVoFk="
        },
        "data": {
          "range": "bytes=6940-2968582",
          "checksum": "sha256-HO6EaEeejRLvQstlGoA2TAG+Fv5LpBdN+8vvKpdp/Cw="
        },
        "checksum": "Q19fG96KH8tRNQVVZwydMLISZVoFk="
      },
      {
        "name": "py3.13-pip-base",
        "url": "https://packages.wolfi.dev/os/aarch64/py3.13-pip-base-25.3-r1.apk",
        "version": "25.3-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-8633",
          "checksum": "sha1-47xnTJzLoxD+8087rjCVjCgTSuY="
        },
        "data": {
          "range": "bytes=8634-3820799",
          "checksum": "sha256-LWOVlnulKIdPVhaOcXB6RQtrGAnKyvY1RI66FvgsrU0="
        },
        "checksum": "Q147xnTJzLoxD+8087rjCVjCgTSuY="
      },
      {
        "name": "py3.13-pip",
        "url": "https://packages.wolfi.dev/os/aarch64/py3.13-pip-25.2-r1.apk",
        "version": "25.2-r1",
        "architecture": "aarch64",
        "signature": {
          "range": "",
          "checksum": ""
        },
        "control": {
          "range": "bytes=0-8792",
          "checksum": "sha1-6phsKRuLXtZRxsrAEeuk55NrG84="
        },
        "data": {
          "range": "bytes=8793-10264",
          "checksum": "sha256-q10FYp4t10nuv1BoHXvbxQg3rRJNZirFeyX8z0fDjAc="
        },
        "checksum": "Q16phsKRuLXtZRxsrAEeuk55NrG84="
      }
    ]
  }
}

to me I always thought that newer versions should resolve first over anything but that doesn't seem to be the case above.

latest py3.13-pip in Wolfi Index

$ wolfictl apk ls https://packages.wolfi.dev/os/x86_64/APKINDEX.tar.gz --latest | rg py3.13-pip-25
py3.13-pip-25.3-r2.apk

I've not yet investigated why older version is getting resolved.

[philroche]

This is not reproducible using apk alone

apk add py3.13-pip
fetch https://apk.cgr.dev/chainguard-private/x86_64/APKINDEX.tar.gz
(1/12) Installing py3-pip-wheel (25.3-r1)
(2/12) Installing libbz2-1 (1.0.8-r21)
(3/12) Installing libexpat1 (2.7.3-r0)
(4/12) Installing libffi (3.5.2-r1)
(5/12) Installing xz (5.8.1-r6)
(6/12) Installing libstdc++ (15.2.0-r5)
(7/12) Installing mpdecimal (4.0.1-r3)
(8/12) Installing libuuid (2.41.2-r1)
(9/12) Installing python-3.13-base (3.13.9-r1)
(10/12) Installing py3.13-setuptools (80.9.0-r3)
(11/12) Installing py3.13-pip-base (25.3-r1)
(12/12) Installing py3.13-pip (25.3-r1)
Executing busybox-1.37.0-r50.trigger
OK: 91 MiB in 50 packages

[javacruft]

Some more detail - a change to py3-pip dropped the py3-pip provides and associated priority on the py3.XX-pip subpackages, resulting in new subpackages having and effective priority of 0 - apk-tools appeared to cope with this fine however apko resolved to the older package version with the higher priority at the same major upstream release.