Wolfi Community Packages

An APK repository for Wolfi OS with packages that are not in the official wolfi-dev/os repository. The project is independent of Chainguard.

The recipes are melange YAML files in packages/. GitHub Actions builds them, and the signed packages and APKINDEX are published on SourceForge.

307 recipes, listed with versions and licenses in PACKAGES.md (generated from the recipes by scripts/package-list.py). By area:

Many of them are converted from their Debian or Alpine packaging with the tools of this repository, autopkgtests included, and built and tested with melange.

The recipes in packages/ are the reference for versions. Packages are built for x86_64 and aarch64, except qt5-qtwebengine and stremio-qt5, which are x86_64 only: qt5-qtwebengine takes longer than GitHub's 6-hour job limit on ARM runners (see packages/CI-SKIP). Scala libraries can be built from a dh-scala scala-build file with the scala/build pipeline (docs/scala-build.md).

Repository base URL and signing key:

Repository: https://wolfi.vejeta.com
Key:        https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub
Browse:     https://sourceforge.net/projects/wolfi/files/

apk, melange and apko append the architecture (x86_64/, aarch64/) to the base URL automatically.

wolfi.vejeta.com is the repository's address: it serves the key and redirects to where the packages are stored, SourceForge today, so the storage can change without changing the address. Systems set up with https://downloads.sourceforge.net/project/wolfi keep working; switching them to https://wolfi.vejeta.com (same key) makes them independent of the storage.

wget -O /etc/apk/keys/vejeta-wolfi.rsa.pub \
  https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub
echo "https://wolfi.vejeta.com" >> /etc/apk/repositories
apk update
apk add mpv stremio        # or stremio-qt5 for the Qt5 shell

stremio is the Stremio desktop client 1.x (GTK4/WebKitGTK). stremio-qt5 is the earlier Qt5 shell 4.x, installed as stremio-qt5; both can be installed together. Systems that have stremio 4.x from this repository need apk del stremio && apk add stremio stremio-qt5, because apk does not replace a package with a lower version.

stremio-distroless builds distroless images from these packages with apko: no shell, no package manager, nonroot, amd64 and arm64, signed with cosign. Stremio's streaming server, headless, for a home server or a NAS:

docker run -d --name stremio-server --restart unless-stopped \
  --read-only --cap-drop=ALL --security-opt=no-new-privileges:true \
  --tmpfs /tmp:rw,noexec,nosuid,size=512m \
  -v stremio-server:/home/nonroot/.stremio-server \
  -p 11470:11470 -p 12470:12470 \
  ghcr.io/vejeta/stremio-server:latest

Then, in Stremio (web.stremio.com or an app), Settings → Streaming server URL: http://<host>:11470. On the first start stremio-server-launcher downloads Stremio's server.js (not free software, so not in the image), checks its sha256 and keeps it in the volume.

package:
  name: my-player
  version: 1.0.0
  epoch: 0
  description: Example package linking against libmpv
  copyright:
    - license: GPL-3.0-or-later

environment:
  contents:
    keyring:
      - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
      - https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub
    repositories:
      - https://packages.wolfi.dev/os
      - https://wolfi.vejeta.com
    packages:
      - build-base
      - mpv-dev
      - libass9-dev

pipeline:
  # ...

contents:
  keyring:
    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
    - https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub
  repositories:
    - https://packages.wolfi.dev/os
    - https://wolfi.vejeta.com
  packages:
    - wolfi-base
    - mpv

entrypoint:
  command: /usr/bin/mpv

archs:
  - x86_64

FROM cgr.dev/chainguard/wolfi-base

RUN wget -O /etc/apk/keys/vejeta-wolfi.rsa.pub \
      https://wolfi.vejeta.com/keys/vejeta-wolfi.rsa.pub \
 && echo "https://wolfi.vejeta.com" >> /etc/apk/repositories \
 && apk add --no-cache mpv

Packages are retired when an official or better-suited alternative exists.

¹ Earliest build of the package in the official Wolfi APKINDEX (x86_64), checked 2026-10-14.

Retired packages are listed in packages/RETIRED; every publish removes them, and their subpackages, from the repository index.

Recipes of retired packages stay in the git history. To ask for one back, open an issue.

New packages and updates are accepted through pull requests:

1. Fork vejeta/wolfi-packages.
2. Add packages/<name>.yaml (and packages/<name>/ for patches or extra files).
3. Build it locally with melange.
4. Open a pull request with the checklist below completed.

packages/
├── mpv.yaml                  # recipe (flat layout, same as wolfi-dev/os)
├── stremio-qt5.yaml
└── stremio-qt5/              # optional: patches and auxiliary files
    ├── 001-release-makefile-fhs.patch
    └── stremio-wrapper.sh

Pull request checklist:

• The package does not exist in official wolfi-dev/os (tools/pkg-check helps)
• The license is OSI-approved (or explicitly redistributable and documented)
• The recipe includes a test: pipeline
• It builds locally with melange
• An update: section is configured (release monitor or git tags)

Pull requests are reviewed by @vejeta. CONTRIBUTING.md covers local builds and the review process.

The tools/ directory has packaging tools for moving packages between Debian, Alpine and Wolfi. melange recipes are the common format: Debian and Alpine packaging can be converted into a recipe, and a recipe into Debian packaging. Each tool is a single Python script with its own README and unit tests, run in CI by tools.yml.

Typical uses:

# Is it packaged anywhere already?
python3 tools/pkg-check/pkg-check.py -t all -p foo

# Debian package -> Wolfi recipe, built to verify it
tools/debian-to-melange/debian-to-melange.py --from-debian foo --check-wolfi --build

# Alpine package -> Wolfi recipe
tools/alpine-to-melange/alpine-to-melange.py --from-alpine foo --check-wolfi

# An upstream release instead of the APKBUILD's source (texlive)
tools/alpine-to-melange/alpine-to-melange.py --from-alpine texlive --check-wolfi --download \
  --source-url https://ftp.tu-chemnitz.de/pub/tug/historic/systems/texlive/2026/texlive-20260301-source.tar.xz

# Wolfi recipe -> debian/ for a new Debian package
tools/melange-to-debian/melange-to-debian.py packages/foo.yaml --out ~/src/foo --check-debian

Every tool reports what it could not convert on stderr and marks it with a TODO(<tool>) comment in its output. A melange-to-alpine converter is planned.

See also docs/research-tools.md (existing conversion tools), docs/design-notes.md (recipe and CI decisions) and TODO.md.

Fixes found while building these packages go to wolfi-dev/os too:

• intltool: escape { in regexes, which Perl 5.26+ warns about at every run (wolfi-dev/os#78761)
• tcl: install the script library in usr/lib/tcl9.1, where programs that embed Tcl (Tcl_Init) look for init.tcl (wolfi-dev/os#78762)
• ocaml-findlib: keep findlib's bytes package, which code written for older OCaml still requires (wolfi-dev/os#78763)
• ocaml: depend on gcc and zstd-dev, which ocamlopt and programs linked with the OCaml runtime need (wolfi-dev/os#78764)

The repository is for packages outside the scope of official Wolfi. The recipes use the same tools (melange, apko) and conventions as Wolfi. When official Wolfi starts shipping a package, the recipe here is retired (see Retired packages).

GitHub Actions                       SourceForge                                  wolfi.vejeta.com
  melange build, in waves      --->  signed APKs + APKINDEX               <---  302 redirect: the address
  RSA signing, APKINDEX              https://sourceforge.net/projects/wolfi/      users configure
  rsync over SSH

• build-packages.yml: builds the changed recipes, or those given in package_filter, in dependency order.
• sign-and-publish.yml: signs, indexes and publishes a build run, merged with the packages already published. It keeps the newest keep_versions (3) versions of each package, and deletes from SourceForge what the index no longer lists (older versions, retired packages).
• repository-url.yml: checks every week that wolfi.vejeta.com serves the indexes (as Go clients fetch them) and the key.

# Build one package and publish it incrementally
gh workflow run build-packages.yml -f package_filter="mujs" -R vejeta/wolfi-packages
gh workflow run sign-and-publish.yml -f run_id=<RUN_ID> -f incremental=true -R vejeta/wolfi-packages

SourceForge hosts the packages because it has no per-file size limit (qt5-qtwebengine is about 300 MB) and a mirror network. wolfi.vejeta.com is the address in the documentation, so moving the storage does not change what users have configured. Its Apache serves the signing key itself, over HTTPS, and redirects (302) everything else to http://downloads.sourceforge.net/project/wolfi/: to http because clients written in Go (apko, melange) send a Referer when they follow a redirect, SourceForge answers a foreign Referer with its HTML download page, and Go sends none from https to http. The content cannot be altered on the way: apk checks the signed APKINDEX and the hash of every package.

• Maintainer: Juan Manuel Méndez Rey (@vejeta)
• Issues and package requests: GitHub Issues
• Security reports: open an issue with the security label

Co-maintainers are welcome. Maintainers of Wolfi packages that are not in the official repository can open an issue or a pull request.

• The Wolfi project and Chainguard, for Wolfi, melange and apko.
• SourceForge, for hosting.
• The upstream authors of the packaged projects.

Copyright (C) 2025-2026 Juan Manuel Méndez Rey.

Build recipes, scripts, workflows and tools in this repository are licensed under the GNU General Public License v3.0 or later (SPDX-License-Identifier: GPL-3.0-or-later in each file). NOTICE lists the exceptions (Debian-derived recipes, upstream patches, test fixtures).

Each built package keeps its upstream license, declared in its recipe.