Upcoming Archive Policy for Older Wolfi Packages

[javacruft]

Planned Change Date: September 10, 2025

Chainguard will begin implementing a package archive policy for Wolfi APK repositories starting September 10, 2025. This means that non-latest package versions older than 12 months will be removed from public Wolfi repositories on a monthly basis moving forward.

Over time, we plan to reduce this retention period to 3 months for non-latest packages in public Wolfi repositories. Any future change will be announced well in advance.

---

Why Are We Making This Change?

The Wolfi package manager (apk) relies on an APKINDEX (a metadata file that lists every available package version) for package installs, upgrades, and searches. Over the past two years, the APKINDEX for the public Wolfi repository has grown from about 4,600 unique package versions to over 186,000, an increase of more than 4,000%. This growth slows down common apk operations and is unsustainable.

The reason for this growth is straightforward: we’ve rapidly expanded Wolfi by adding many new packages and frequently publishing updates to existing ones. Until now, we have retained every package version indefinitely unless it posed an immediate security or stability risk. As a result, even very old and unused package versions have remained in the repositories, steadily increasing the size of the APKINDEX and weighing on the efficiency of apk operations.

By implementing this policy and archiving older package versions, we:

• Improve performance for apk commands.
• Maintain secure-by-design repositories, in line with industry norms (most major Linux distros only keep the latest version of each package in their primary package repositories).

---

How This Affects You

• Starting September 10, 2025, public Wolfi repositories will no longer host non-latest package versions older than 12 months.
• If you pin to specific package versions in your builds or Dockerfiles, those versions may no longer be available.
• If you rely on older package versions, you should mirror copies internally.

Note for Chainguard customers: If you have a paid account and need guidance or access to older packages, please contact your account team.

---

What You Should Do

1. Check your pinned package versions - ensure they are less than 12 months old by September 10, 2025.
2. Update regularly - aim to use recent package versions, ideally less than 3 months old moving forward.
3. Mirror if necessary - if you need to keep an older version, retain your own copy.

---

Removal Schedule

• Frequency: Once a month, on the second Wednesday of the month.
• First Removal: September 10, 2025.
• Advance Notice: This announcement is being published alongside the first “packages to be removed” notice, which lists the non-latest package versions older than 12 months scheduled for removal on September 10, 2025.

---

Questions or Help

• Paid Chainguard customers: contact your account team.
• Free users: please comment on this discussion on the Wolfi GitHub page if you have questions or comments.