Extras packages

[henriquevcosta]

I saw hashicorp vault be moved to "enterprise packages" on wolfi-dev/advisories#4501 and I would like to know if there's an established policy on which packages are moved and when.
I'm using these packages and it's always good to understand if a given package may stop receiving updates because it is moved to an enterprise tier.

Thanks!

[xnox]

Wolfi OS contains latest opensource versions of the software. Due to Hashicorp Vault upstream license change (https://www.hashicorp.com/license-faq) to a more restrictive one, non-eol and up-to-date vault package versions are no longer published in wolfi-dev/os repository. Currently there is no better way to publish Vault, with clear caveats w.r.t. licensing like Chainguard Images have in SBOM/licensing tab. We don't yet have openbao or a similar alternative packaged. You can use latest vault versions via Chainguard Image see pull urls at https://images.chainguard.dev/directory/image/vault/versions.

[xnox]

@henriquevcosta I stand corrected. the APK were moved out of wolfi/os (aka packages.wolfi.dev/os/x86_64 ) but they are available from extras (aka packages.cgr.dev/extras/x86_64) for the latest supported versions. Note it is under BUSL licensing terms as mentioned above.

See vault 1.15, 1.16, 1.17 packages in that index https://apk.dag.dev/https/packages.cgr.dev/extras/x86_64/APKINDEX.tar.gz@etag:a413d0bad4d1db827af8067d0451870e/APKINDEX?full=false&search=vault&depend=&provide=

[henriquevcosta]

Thank you @xnox! Would you also be able to provide some generic info about in what situations packages are moved out of wolfi into these other repositories? Is it something that's expected to happen for relatively popular packages to support Chainguard's business model, or would that be very rare? No judgement either way, I'm just trying to understand how much I can commit to the ecosystem 😄

[xnox]

@henriquevcosta the extras repository contains what is deemed non-open source software or software with additional EULA. It is unrelated to Chainguard's business model. It is to do with upstream software. Do ensure you read license terms for every package there. Some of them are without source code (NVIDIA), and some of them have restirctions (i.e. vault's BUSL license) and similar. Wolfi OS remains fully open source software.

This is similar to how other distributions split publish things - i.e. Ubuntu's restricted, Debian's non-free, and so on.

https://edu.chainguard.dev/chainguard/chainguard-images/faq/#what-packages-are-available-in-chainguard-images explains in detail which packages are available in wolfi os and wolfi extras.

[henriquevcosta]

Awesome stuff, thanks for the detail!
All I needed to know, keep up with the great work.