feat: detect platform compatibility from wheel tags and image libc

Stop hardcoding platform tag lists per architecture. Instead, parse
wheel platform tags dynamically by checking the machine suffix and
prefix (musllinux_, manylinux, linux_). Detect the image libc from
/etc/os-release (ID=alpine → musl, otherwise glibc) and only accept
wheels matching the correct libc. Replace the scoring system with
simple binary-over-pure-python preference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: EyeCantCU

internal/cli/lock.go

@@ -254,7 +254,7 @@ func LockCmd(ctx context.Context, output string, archs []types.Architecture, opt
 			return fmt.Errorf("unknown ecosystem: %s", name)
 		}
 		for _, arch := range archs {
-			resolved, err := installer.Resolve(ctx, ecoConfig, arch, auth.DefaultAuthenticators)
+			resolved, err := installer.Resolve(ctx, ecoConfig, arch, "glibc", auth.DefaultAuthenticators)
 			if err != nil {
 				return fmt.Errorf("resolving %s packages for %s: %w", name, arch, err)
 			}

pkg/ecosystem/ecosystem.go

@@ -18,6 +18,7 @@ import (
 	"context"
 	"fmt"
 	"maps"
+	"strings"
 	"sync"
 
 	"chainguard.dev/apko/pkg/apk/auth"
@@ -53,7 +54,8 @@ type Installer interface {
 	// Name returns the ecosystem name (e.g., "python").
 	Name() string
 	// Resolve resolves the requested packages to specific versions and URLs.
-	Resolve(ctx context.Context, config types.EcosystemConfig, arch types.Architecture, a auth.Authenticator) ([]ResolvedPackage, error)
+	// libc is "musl" or "glibc", detected from the image filesystem.
+	Resolve(ctx context.Context, config types.EcosystemConfig, arch types.Architecture, libc string, a auth.Authenticator) ([]ResolvedPackage, error)
 	// Install extracts resolved packages into the filesystem.
 	// Returns environment variables that should be set in the image configuration.
 	Install(ctx context.Context, fs apkfs.FullFS, packages []ResolvedPackage, config types.EcosystemConfig, a auth.Authenticator) (map[string]string, error)
@@ -108,6 +110,21 @@ func Get(name string) (Installer, bool) {
 	return factory(), true
 }
 
+// detectLibc checks /etc/os-release to determine the image's libc.
+// Alpine uses musl; everything else uses glibc.
+func detectLibc(fs apkfs.FullFS) string {
+	data, err := fs.ReadFile("etc/os-release")
+	if err != nil {
+		return "glibc"
+	}
+	for line := range strings.SplitSeq(string(data), "\n") {
+		if line == "ID=alpine" {
+			return "musl"
+		}
+	}
+	return "glibc"
+}
+
 // OwnerTagger is implemented by filesystems that support tagging files
 // with an owner name for layering purposes.
 type OwnerTagger interface {
@@ -125,12 +142,14 @@ func InstallAll(ctx context.Context, fs apkfs.FullFS, ecosystems map[string]type
 	env := map[string]string{}
 	var installed []ResolvedPackage
 
+	libc := detectLibc(fs)
+
 	for name, config := range ecosystems {
 		installer, ok := Get(name)
 		if !ok {
 			return nil, nil, fmt.Errorf("unknown ecosystem: %s", name)
 		}
-		resolved, err := installer.Resolve(ctx, config, arch, a)
+		resolved, err := installer.Resolve(ctx, config, arch, libc, a)
 		if err != nil {
 			return nil, nil, fmt.Errorf("resolving %s packages: %w", name, err)
 		}

pkg/ecosystem/python/platform.go

@@ -16,69 +16,46 @@ package python
 
 import (
 	"fmt"
-	"slices"
 	"strings"
 
 	"chainguard.dev/apko/pkg/build/types"
 )
 
-// platformTags returns the list of compatible wheel platform tags for the
-// given architecture, ordered from most specific to least specific.
-func platformTags(arch types.Architecture) []string {
-	switch arch {
-	case types.ParseArchitecture("amd64"):
-		return []string{
-			"manylinux_2_17_x86_64",
-			"manylinux2014_x86_64",
-			"manylinux_2_5_x86_64",
-			"manylinux1_x86_64",
-			"linux_x86_64",
-		}
-	case types.ParseArchitecture("arm64"):
-		return []string{
-			"manylinux_2_17_aarch64",
-			"manylinux2014_aarch64",
-			"linux_aarch64",
-		}
-	case types.ParseArchitecture("arm/v7"):
-		return []string{
-			"manylinux_2_17_armv7l",
-			"manylinux2014_armv7l",
-			"linux_armv7l",
-		}
-	case types.ParseArchitecture("arm/v6"):
-		return []string{
-			"manylinux_2_17_armv6l",
-			"linux_armv6l",
-		}
-	case types.ParseArchitecture("386"):
-		return []string{
-			"manylinux_2_17_i686",
-			"manylinux2014_i686",
-			"manylinux_2_5_i686",
-			"manylinux1_i686",
-			"linux_i686",
-		}
-	case types.ParseArchitecture("ppc64le"):
-		return []string{
-			"manylinux_2_17_ppc64le",
-			"manylinux2014_ppc64le",
-			"linux_ppc64le",
-		}
-	case types.ParseArchitecture("s390x"):
-		return []string{
-			"manylinux_2_17_s390x",
-			"manylinux2014_s390x",
-			"linux_s390x",
-		}
-	case types.ParseArchitecture("riscv64"):
-		return []string{
-			"manylinux_2_17_riscv64",
-			"linux_riscv64",
-		}
-	default:
-		return []string{"any"}
+// archToMachine maps OCI architecture strings to the Python/Linux machine
+// string used in wheel platform tags.
+var archToMachine = map[types.Architecture]string{
+	types.ParseArchitecture("amd64"):   "x86_64",
+	types.ParseArchitecture("arm64"):   "aarch64",
+	types.ParseArchitecture("arm/v7"):  "armv7l",
+	types.ParseArchitecture("arm/v6"):  "armv6l",
+	types.ParseArchitecture("386"):     "i686",
+	types.ParseArchitecture("ppc64le"): "ppc64le",
+	types.ParseArchitecture("s390x"):   "s390x",
+	types.ParseArchitecture("riscv64"): "riscv64",
+	types.ParseArchitecture("loong64"): "loongarch64",
+}
+
+// isLinuxPlatformTag checks whether a single platform tag (e.g.
+// "musllinux_1_2_x86_64") targets the given machine architecture and
+// is compatible with the image's libc. musl images only accept musllinux
+// wheels; glibc images only accept manylinux wheels.
+func isLinuxPlatformTag(tag, machine string, libc string) bool {
+	if !strings.HasSuffix(tag, "_"+machine) {
+		return false
 	}
+	if tag == "linux_"+machine {
+		return true
+	}
+	if libc == "musl" {
+		return strings.HasPrefix(tag, "musllinux_")
+	}
+	return strings.HasPrefix(tag, "manylinux")
+}
+
+// isBinaryWheel returns true if the wheel targets a specific platform
+// (not pure-python "any").
+func isBinaryWheel(w wheelFileParts) bool {
+	return w.PlatformTag != "any"
 }
 
 // wheelFileParts holds the parsed components of a wheel filename per PEP 427.
@@ -124,8 +101,8 @@ func parseWheelFilename(filename string) (wheelFileParts, error) {
 }
 
 // isCompatibleWheel checks whether a wheel file is compatible with the given
-// Python version and architecture.
-func isCompatibleWheel(w wheelFileParts, pythonVersion string, arch types.Architecture) bool {
+// Python version, architecture, and libc.
+func isCompatibleWheel(w wheelFileParts, pythonVersion string, arch types.Architecture, libc string) bool {
 	// Check python tag compatibility
 	if !isCompatiblePythonTag(w.PythonTag, pythonVersion) {
 		return false
@@ -137,7 +114,7 @@ func isCompatibleWheel(w wheelFileParts, pythonVersion string, arch types.Archit
 	}
 
 	// Check platform compatibility
-	return isCompatiblePlatform(w.PlatformTag, arch)
+	return isCompatiblePlatform(w.PlatformTag, arch, libc)
 }
 
 // isCompatiblePythonTag checks if the wheel's python tag is compatible.
@@ -166,56 +143,29 @@ func isCompatibleABI(tag, pythonVersion string) bool {
 	return false
 }
 
-// isCompatiblePlatform checks if the wheel's platform tag is compatible.
-func isCompatiblePlatform(tag string, arch types.Architecture) bool {
+// isCompatiblePlatform checks if the wheel's platform tag is compatible
+// with the given architecture and libc, without version limits.
+func isCompatiblePlatform(tag string, arch types.Architecture, libc string) bool {
 	if tag == "any" {
 		return true
 	}
-	compatible := platformTags(arch)
+	machine, ok := archToMachine[arch]
+	if !ok {
+		return false
+	}
 	for t := range strings.SplitSeq(tag, ".") {
-		if slices.Contains(compatible, t) {
+		if isLinuxPlatformTag(t, machine, libc) {
 			return true
 		}
 	}
 	return false
 }
 
-// wheelScore returns a priority score for the wheel. Higher is better.
-// Binary wheels for the exact platform are preferred over pure-Python wheels.
-func wheelScore(w wheelFileParts, pythonVersion string, arch types.Architecture) int {
-	score := 0
-
-	// Prefer exact CPython tag over generic py3
-	cpTag := "cp" + strings.ReplaceAll(pythonVersion, ".", "")
-	for t := range strings.SplitSeq(w.PythonTag, ".") {
-		if t == cpTag {
-			score += 100
-			break
-		}
-	}
-
-	// Prefer specific ABI over none/abi3
-	for t := range strings.SplitSeq(w.ABITag, ".") {
-		switch t {
-		case cpTag:
-			score += 50
-		case "abi3":
-			score += 25
-		}
-	}
-
-	// Prefer specific platform over any
-	if w.PlatformTag != "any" {
-		platTags := platformTags(arch)
-		for i, pt := range platTags {
-			for pp := range strings.SplitSeq(w.PlatformTag, ".") {
-				if pp == pt {
-					// More specific platforms (earlier in list) get higher scores
-					score += 10 * (len(platTags) - i)
-				}
-			}
-		}
+// isBetterWheel returns true if candidate is a better choice than current.
+// Prefers binary wheels over pure-python.
+func isBetterWheel(current, candidate wheelFileParts) bool {
+	if !isBinaryWheel(current) && isBinaryWheel(candidate) {
+		return true
 	}
-
-	return score
+	return false
 }