Why https://packages.wolfi.dev/os/x86_64/gtk-0.95-r1.apk was removed?

[farcop]

We use apko to build hermetic and most importantly repeatable base images.

But today we couldn't build the project because gtk-0.95-r1.apk is no longer available
Download from https://packages.wolfi.dev/os/x86_64/gtk-0.95-r1.apk failed: class java.io.FileNotFoundException GET returned 404 Not Found

% docker run --rm -it cgr.dev/chainguard/wolfi-base:latest /bin/sh -c "apk update && apk search gtk" | grep gtk-0.95
gtk-0.95-r0
mtr-gtk-0.95-r3

Why did this happen and how then is it possible to build repeatable builds?

[farcop]

Find this commit e707da3
but for me if this is the reason then this commit violates the whole idea of ​​wolfi os

[xnox]

It had provides; that was breaking installing up to date packages and causing install & runtime failures of webkit, chromium, and other images.

We had no choice, but to remove that, as otherwise APK & apko were preferring that old package instead of latest packages named differently. There should be withdrawal log and PRs explaining that.

I also wish we would make public the .apk that we removed at a different endpoint ie. packages.wolfi.dev/removed-os/ or some such. But currently we only have those in internal-only cold storage.

[xnox]

We had similar examples when migration from python3.yaml to python-3.[8..13].yaml we had to withdraw python3-3.11*.apks as otherwise they were getting installed at higher priority than equivalent python-3.11-3.11.* packages.