Wolfi Community Packages

An APK repository for Wolfi OS with packages that are not in the official wolfi-dev/os repository. The project is independent of Chainguard.

The recipes are melange YAML files in packages/. GitHub Actions builds them, and the signed packages and APKINDEX are published on SourceForge.

Available packages

307 recipes, listed with versions and licenses in PACKAGES.md (github.com) (generated from the recipes by scripts/package-list.py). By area:

Area	Packages
Media	mpv, vlc, stremio (GTK4) and stremio-qt5, stremio-server-launcher (headless streaming server, downloads server.js on the first start), libplacebo, libass9, libbluray, libdvdnav, libdvdread, libcdio, libmatroska, taglib, rubberband, shaderc, zimg, mujs
GNOME and Qt5	webkitgtk-6.0, libadwaita, libsoup3, glib-networking, appstream, xdg-dbus-proxy, qt5-qtwebengine and other Qt5 modules
Debian tooling on Wolfi	apt, aptitude, mmdebstrap, debhelper (with dh-autoreconf, strip-nondeterminism, po-debconf), dwz, debootstrap, debconf, ucf, fakeroot, fakechroot, dctrl-tools, debian-archive-keyring, debian-keyring, distro-info-data, arch-test, sequoia-sq, sequoia-sqv, sequoia-chameleon-gnupg
TeX	texlive 2026 (programs) and texmf-dist (the TeX Live 2026 tree, split by collection: 38 collections with their documentation), hevea, auctex, tex-common
OCaml	80 libraries and tools on Wolfi's ocaml, dune and findlib: menhir, js_of_ocaml, odoc, lwt, ppxlib and the Jane Street ppx set, dose3 (apt-cudf), cudf, the dune libraries
Haskell	ghc-bootstrap and cabal-install-bootstrap (upstream binaries), pandoc-cli, shellcheck
Cross toolchains	binutils-cross (as, ld and binutils for 16 architectures), mingw-w64 (Windows headers and import libraries)
Solvers	gringo, clasp, aspcud, xapian-core
JVM and Scala	scala-2.12, scala-2.13, scala-xml, coursier, mill, metals, jbang, gatling, joern
Perl and Python	55 Perl modules (the Perl::Critic chain, ikiwiki's dependencies), black, pycodestyle, pyflakes, python-apt, python-debian
Fonts	47 font packages (Debian's fonts-*, needed by TeX Live and the test suites)
Documentation	docbook-xsl and docbook-xsl-ns (Debian's DocBook XSL stylesheets, with their images), docbook5-xml
Others	ikiwiki, elinks, expect (Tcl 9, from Debian), moreutils, genext2fs, squashfs-tools-ng, capnproto, xwpe, algol68g

Many of them are converted from their Debian or Alpine packaging with the tools of this repository, autopkgtests included, and built and tested with melange.

The recipes in packages/ are the reference for versions. Packages are built for x86_64 and aarch64, except qt5-qtwebengine and stremio-qt5, which are x86_64 only: qt5-qtwebengine takes longer than GitHub's 6-hour job limit on ARM runners (see packages/CI-SKIP). Scala libraries can be built from a dh-scala scala-build file with the scala/build pipeline (docs/scala-build.md (github.com)).

Using these packages

Repository base URL and signing key:

Repository: https://wolfi.vejeta.com
Key:        https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub
Browse:     https://sourceforge.net/projects/wolfi/files/

apk, melange and apko append the architecture (x86_64/, aarch64/) to the base URL automatically.

wolfi.vejeta.com is the repository's address: it serves the key and redirects to where the packages are stored, SourceForge today, so the storage can change without changing the address. Systems set up with https://downloads.sourceforge.net/project/wolfi keep working; switching them to https://wolfi.vejeta.com (same key) makes them independent of the storage.

On a running Wolfi system

wget -O /etc/apk/keys/vejeta-wolfi.rsa.pub \
  https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub
echo "https://wolfi.vejeta.com" >> /etc/apk/repositories
apk update
apk add mpv stremio        # or stremio-qt5 for the Qt5 shell

stremio is the Stremio desktop client 1.x (GTK4/WebKitGTK). stremio-qt5 is the earlier Qt5 shell 4.x, installed as stremio-qt5; both can be installed together. Systems that have stremio 4.x from this repository need apk del stremio && apk add stremio stremio-qt5, because apk does not replace a package with a lower version.

As build dependencies in a melange recipe

package:
  name: my-player
  version: 1.0.0
  epoch: 0
  description: Example package linking against libmpv
  copyright:

    - license: GPL-3.0-or-later

environment:
  contents:
    keyring:

      - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
      - https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub
    repositories:
      - https://packages.wolfi.dev/os
      - https://wolfi.vejeta.com
    packages:
      - build-base
      - mpv-dev
      - libass9-dev

pipeline:
  # ...

In an apko image

contents:
  keyring:

    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
    - https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub
  repositories:
    - https://packages.wolfi.dev/os
    - https://wolfi.vejeta.com
  packages:
    - wolfi-base
    - mpv

entrypoint:
  command: /usr/bin/mpv

archs:

  - x86_64

In a Dockerfile

FROM cgr.dev/chainguard/wolfi-base

RUN wget -O /etc/apk/keys/vejeta-wolfi.rsa.pub \
      https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub \
 && echo "https://wolfi.vejeta.com" >> /etc/apk/repositories \
 && apk add --no-cache mpv

Retired packages

Packages are retired when an official or better-suited alternative exists.

Package	Here since	In official Wolfi since¹	Retired	Reason / replacement
libass	2025-11	2026-01-31	2026-10	Replaced by libass9: official Wolfi's libass is built static-only and ships no libass.so
stremio 4.x	2025-11	—	2026-10	Renamed to stremio-qt5 (Stremio shell 4.x, Qt5). The name stremio now belongs to the GTK4/WebKitGTK client (1.x)
stremio-server	2025-11	—	2026-10	Replaced by stremio-server-installer, converted from the Debian package with debian-to-melange
libvpx	2025-11	2026-09-25	2026-10	Available in official Wolfi (newer version)
libxcb	2025-11	2025-08-07 or earlier	2026-10	Available in official Wolfi (all xcb libraries in one package)
vulkan-loader	2025-11	2025-09-26 or earlier	2026-10	Available in official Wolfi (newer version)
zlib	2025-11	2025-01-16 or earlier	2026-10	Available in official Wolfi (newer version)
qt5-qtbase	2025-11	2026-04-01	2026-10	Available in official Wolfi (5.15.19); the Qt5 modules here build against it
qt5-qtwebengine, stremio-qt5 (aarch64)	2025-11	—	2026-10	Old builds that need libvpx.so.11, no longer in Wolfi; x86_64 builds remain. Rebuilt on request

¹ Earliest build of the package in the official Wolfi APKINDEX (x86_64), checked 2026-10-14.

Retired packages are listed in packages/RETIRED; every publish removes them, and their subpackages, from the repository index.

Recipes of retired packages stay in the git history. To ask for one back, open an issue.

Contributing

See Contributing on GitHub.

Tools

See Tools on GitHub.

Contributions to Wolfi

Fixes found while building these packages go to wolfi-dev/os too:

• intltool: escape { in regexes, which Perl 5.26+ warns about at every run (wolfi-dev/os#78761)
• ocaml: depend on gcc and zstd-dev, which ocamlopt and programs linked with the OCaml runtime need
• ocaml-findlib: keep findlib's bytes package, which code written for older OCaml still requires

Scope

The repository is for packages outside the scope of official Wolfi. The recipes use the same tools (melange, apko) and conventions as Wolfi. When official Wolfi starts shipping a package, the recipe here is retired (see Retired packages).

Infrastructure

GitHub Actions                       SourceForge                                  wolfi.vejeta.com
  melange build, in waves      --->  signed APKs + APKINDEX               <---  302 redirect: the address
  RSA signing, APKINDEX              https://sourceforge.net/projects/wolfi/      users configure
  rsync over SSH

• build-packages.yml (github.com): builds the changed recipes, or those given in package_filter, in dependency order.
• sign-and-publish.yml (github.com): signs, indexes and publishes a build run (full or incremental=true).
• cleanup-old-packages.yml (github.com): removes superseded versions.
• repository-url.yml (github.com): checks every week that wolfi.vejeta.com serves the indexes (as Go clients fetch them) and the key.

# Build one package and publish it incrementally
gh workflow run build-packages.yml -f package_filter="mujs" -R vejeta/wolfi-packages
gh workflow run sign-and-publish.yml -f run_id=<RUN_ID> -f incremental=true -R vejeta/wolfi-packages

SourceForge hosts the packages because it has no per-file size limit (qt5-qtwebengine is about 300 MB) and a mirror network. wolfi.vejeta.com is the address in the documentation, so moving the storage does not change what users have configured. Its Apache serves the signing key itself, over HTTPS, and redirects (302) everything else to http://downloads.sourceforge.net/project/wolfi/: to http because clients written in Go (apko, melange) send a Referer when they follow a redirect, SourceForge answers a foreign Referer with its HTML download page, and Go sends none from https to http. The content cannot be altered on the way: apk checks the signed APKINDEX and the hash of every package.

Contact

• Maintainer: Juan Manuel Méndez Rey (@vejeta)
• Issues and package requests: GitHub Issues
• Security reports: open an issue with the security label

Co-maintainers are welcome. Maintainers of Wolfi packages that are not in the official repository can open an issue or a pull request.

Acknowledgments

• The Wolfi project and Chainguard, for Wolfi, melange and apko.
• SourceForge, for hosting.
• The upstream authors of the packaged projects.

License

Copyright (C) 2025-2026 Juan Manuel Méndez Rey.

Build recipes, scripts, workflows and tools in this repository are licensed under the GNU General Public License v3.0 or later (SPDX-License-Identifier: GPL-3.0-or-later in each file). NOTICE lists the exceptions (Debian-derived recipes, upstream patches, test fixtures).

Each built package keeps its upstream license, declared in its recipe.

---

This page follows the README on GitHub; last updated 2026-10-20.