Monthly Wolfi Package Removal Notice – September 2025

[javacruft]

Chainguard is scheduled to remove non-latest versions of Wolfi APK packages older than 12 months from public Wolfi repositories as part of our newly announced Wolfi package archive policy.

This is the first package removal notice under the new policy. The removals listed below are scheduled for September 10, 2025.

---

Planned Removal Date

Wednesday, September 10, 2025 (second Wednesday of September)

---

Packages Versions Scheduled for Removal

The full list of packages scheduled for removal is provided in the attached file:

wolfi-packages-scheduled-for-removal-sept-2025.txt

These packages:

• Were built more than 12 months ago, and
• Are not required as dependencies for other retained packages, and
• Are not used in Chainguard Container Images.

---

Why Is This Happening?

Please reference the Wolfi package archive policy announcement.

---

What Do You Need To Do?

• If you pin to specific package versions, check the attached list to ensure your pinned versions are not affected.
• Update to newer package versions as needed.
• Mirror copies of older packages if you require continued access after September 10.

---

Future Removal Schedule

• Removals occur monthly on the second Wednesday.
• Next Notice: September 10, 2025 - for packages scheduled to be removed on October 8, 2025.

---

Questions or Help

• Paid Chainguard customers: contact your account team.
• Free users: please comment on this discussion on the Wolfi GitHub page if you have questions or comments.

[javacruft]

The first Wolfi package archive event is now complete. The final list of packages archived is attached here:

withdrawn-packages.txt

This list is a subset of the candidate list published in the initial announcement. Several packages were exempted for September based on customer feedback, but will still be included in the October candidate list.

What’s Next:

• The next package archive event is scheduled for Wednesday, October 8, 2025 (second Wednesday of October).
• The October candidate list will be posted in a separate GitHub announcement later today.

Questions or Help

• Paid Chainguard customers: please contact your account team or support.
• Free users: please comment on this discussion if you have questions or comments.

[farcop]

Hi guys,

I have some questions:

1. Is there a chance to restore some packages from the deleted ones?
   Unfortunately we saw this announcement late.

APKs affected:
keycloak-23.0.7-r0.apk
pgaudit-15-1.7.0-r2.apk

2. Does the community suggest any ways to work around this?
   For example, setting up proxying of repositories.

[tuananh]

I think Sonatype Repository support this https://community.sonatype.com/t/nexus-repository-3-alpine-linux-apk-format/2626

[johncslack]

@farcop - we've temporarily restored both packages to give you additional time to mitigate any issues. By default, they'll be archived again next month on October 8. Does that sound reasonable?

[farcop]

@johncslack
@tuananh
We've actually set up a proxy repository in Nexus + the nexus-repository-apk plugin.
Now both packages are proxied to our repository and can be removed.
Thank you! I really appreciate it!