Change in package repository for wolfi-base?

[cflee]

Roughly 13 days ago, I was still able to install some older packages like nodejs-20-20.13.1-r0 (using apk add --no-cache nodejs-20=~20.13.1) to run testing on whether vulnerability scanners were reporting correctly on that older package version. Previous comment from a maintainer also showed that apk search would reflect many older versions.

However, on a cgr.dev/chainguard/wolfi-base:latest image as of today, it is no longer possible to get that specific package. This apk error indicates that the specified package version is not available in the repository.

be4d91484812:/# apk add --no-cache nodejs-20=~20.13.1
fetch https://apk.cgr.dev/chainguard/aarch64/APKINDEX.tar.gz
ERROR: unable to select packages:
  nodejs-20-20.19.2-r1:
    breaks: world[nodejs-20~20.13.1]
be4d91484812:/# apk update
fetch https://apk.cgr.dev/chainguard/aarch64/APKINDEX.tar.gz
 [https://apk.cgr.dev/chainguard]
OK: 104395 distinct packages available
be4d91484812:/# apk search -a -x nodejs-20
nodejs-20-20.16.0-r0
nodejs-20-20.17.0-r0
nodejs-20-20.18.0-r0
nodejs-20-20.18.0-r1
nodejs-20-20.18.1-r0
nodejs-20-20.18.1-r1
nodejs-20-20.18.1-r2
nodejs-20-20.18.2-r0
nodejs-20-20.18.3-r0
nodejs-20-20.19.0-r0
nodejs-20-20.19.0-r1
nodejs-20-20.19.0-r2
nodejs-20-20.19.1-r0
nodejs-20-20.19.2-r0
nodejs-20-20.19.2-r1

It looks to me that there has been a change in what cgr.dev/chainguard/wolfi-base uses as apk repository, from https://packages.wolfi.dev/os to https://apk.cgr.dev/chainguard. There's a distinctly different number of packages available on the Wolfi repository:

be4d91484812:/# vi /etc/apk/repositories
be4d91484812:/# apk update
fetch https://packages.wolfi.dev/os/aarch64/APKINDEX.tar.gz
 [https://packages.wolfi.dev/os]
OK: 171760 distinct packages available
be4d91484812:/# apk search -a -x nodejs-20 | wc -l
50

Questions

I can't find a commit in the wolfi-dev/os repository to match this change, am I looking in the wrong spot?

Is this just a repository URL migration and the older packages will be made available on apk.cgr.dev soon?

Or is there a distinct change in what cgr.dev/chainguard/wolfi-base image now is?

In particular, I had the impression that this image is supposed to be Wolfi, since the README says "Base image for the Wolfi Linux Distribution" and this repo's README refers to packages.wolfi.dev as the APK repository for Wolfi. Is this wolfi-base image now becoming something else like Chainguard OS instead of Wolfi?

Will there be any future impact to the availability of packages.wolfi.dev and its contents?

[jaimewukb]

I think im having a similar issue (yet different issue) that the package repository is broken?

Im seeing this error in my docker build which runs in aws. Works locally and seems to be only broken since the last couple of days and possibly linked to https://packages.wolfi.dev/os to https://apk.cgr.dev/chainguard

11:17:04  > [stage-0  2/19] RUN apk update --no-check-certificate     && apk add --no-check-certificate     nodejs-20=~20.18 yarn python-3.12=~3.12 build-base:
11:17:04 0.370 fetch https://apk.cgr.dev/chainguard/x86_64/APKINDEX.tar.gz
11:17:04 938.9 WARNING: updating and opening https://apk.cgr.dev/chainguard: Permission denied
11:17:04 938.9 2 unavailable, 0 stale; 15 distinct packages available

EDIT: Im my case, it looks like i need to update some firewall policy stuff. But still interesting to know why the package repo is now changed to https://apk.cgr.dev/chainguard

@cflee also looks like it might be a part of this change chainguard-images/images@eac6d64

[xnox]

--no-check-certificate

Is dangerous and insecure. If you need to add certificates to access your proxy, please do so using https://github.com/chainguard-dev/incert

I will ponder to remove this option and always enforce certificate checking, because without ensuring TLS connectivity you are subjecting yourself to man-in-the middle attacks and undermine the security of the supply chain.

EDIT: Im my case, it looks like i need to update some firewall policy stuff. But still interesting to know why the package repo is now changed to https://apk.cgr.dev/chainguard

About a year ago we have started to dual publish packages to packages.wolfi.dev/os and apk.cgr.dev/chainguard and are starting to migrate from two publication locations to the new one. The new location has better CDN and better support for dual-signing & key rotations, compared to the old destination.

[xnox]

@jaimewukb please note for commercial support and SLAs, Chainguard offers per-customer container image & packages registries (such as apk.cgr.dev/yourcompany and cgr.dev/yourcompany). Please contact us to get started at https://www.chainguard.dev/contact

[cflee]

@jaimewukb Thanks for the pointer to the chainguard-images/images commit! I didn't think to look there.

[xnox]

Last year we started to publish packages both to packages.wolfi.dev/os and apk.cgr.dev/chainguard. The horizon of history in the two is different. If you want to access packages.wolfi.dev/os you still can, but you need install wolfi-keys and add that repository.

Note that we provide historical archives of packages, but they are frozen in time and do not support security support.

The package in question is nodejs-20-20.13.1-r0 has become obsolete in May 28 18:19:32 2024 and no longer supported. @cflee Why do you need fresh access to it today in June 2025?

nodejs-20-20.13.1-r0 is unchanged, meaning an image built with it back in May 27 2024 can still be used directly, and you should have cached it rather than rebuilding it a fresh.

[xnox]

Note it is best practice to standup private mirror of packages and images; build them and cache them; for ongoing access. For example using artifactory if you really want access to over a year old nodejs which is vulnerable and insecure.

[cflee]

If you want to access packages.wolfi.dev/os you still can, but you need install wolfi-keys and add that repository.

Note that we provide historical archives of packages, but they are frozen in time and do not support security support.

Thanks for explaining this and the pointer to how we can continue to use it. Yes, I understand the no security support aspect of it, certainly expect that e.g. the older packages won't be rebuilt if their dependencies are bumped.

My initial thought (before I identified the repository change) was that there was some kind of storage cost optimization to only store the latest package, similar to how Alpine and some other distros does it, so it's good to know that generally the past packages are still intended to be available, albeit with the horizon difference due to when the dual publish started and limited backfilling.

@xnox Are there any plans to cease publishing packages to packages.wolfi.dev/os? If yes, will apk.cgr.dev/chainguard continue to be available in the same way as packages.wolfi.dev/os, in support of Wolfi as the open-source upstream project?

I was trying to understand the current package/image building with melange/apko to assess the effort required to add some packages, but such investments would only make sense if Wolfi will continue existing in the same way. If this Wolfi package repository will go away in favor of the Chainguard-customer private APK repositories then it wouldn't make sense for anyone to contribute to Wolfi.

The package in question is nodejs-20-20.13.1-r0 has become obsolete in May 28 18:19:32 2024 and no longer supported. @cflee Why do you need fresh access to it today in June 2025?

Do I really need it? No, it just happened to be the version we were doing some testing with for some historical reasons. And I guess it's a coincidence that it is older than the dual-publish date. I agree that any user using nodejs-20 ideally would be up-to-date or almost up-to-date within that major version.

Continuing along the lines of the earlier point, I want to say that I see significant value in keeping past minor/patch version packages around – sometimes there are regressions and users need to pin back to some slightly older package until there is another release with the bugfix. And we often have some combination of packages and want to bump those we can and only pin the minimum, so reusing the previously built image is not great. Sometimes it is not so 'slightly' time-wise if it takes time to land the fix.

So it would be great if older packages continue to be available, as is done now in apk.cgr.dev/chainguard. On other distros where only latest package is kept in the package repository, there's often an official (Debian/Ubuntu) or unofficial (Alpine) package archive where we can manually fish out the older package if we really need it for reasons.

Note it is best practice to standup private mirror of packages and images; build them and cache them; for ongoing access.

Yes, agree that it should be good practice to keep a copy of the packages.

It would certainly be cool if it's possible for community to standup a package repository mirror (pulling over rsync), but I guess that may not be straightforward if the repository is backed by an object store. Taking a scraping/spidering approach to build a mirror from a repository that only contains latest package is a bit messy.

[xnox]

@cflee to discuss all of the above questions please contact your Chainguard representative, which btw your work affiliation already has.

[cflee]

OK thanks, I guess that's the answer for Wolfi project.