buildpack.toml: uri for a dependency

[ildar]

Now that I can use a local buildpack, I can build an app with the local copy of paketo-buildpacks/bellsoft-liberica: bp1.log

But if I change uri for a tar.gz file it fails (bp2.log). My change:

--- buildpack.toml.ORIG 2025-02-17 09:34:30.039317943 +0000
+++ buildpack.toml      2025-02-17 20:02:06.882340945 +0000
@@ -227,7 +227,7 @@
     source = "https://github.com/bell-sw/Liberica/releases/download/17.0.14+10/bellsoft-jdk17.0.14+10-src.tar.gz"
     source-sha256 = "b8fb8ca787323607d748a422698692d4cefe4f0376646f383eb1421461968fba"
     stacks = ["*"]
-    uri = "https://github.com/bell-sw/Liberica/releases/download/17.0.14+10/bellsoft-jdk17.0.14+10-linux-amd64.tar.gz"
+    uri = "http://10.10.100.109/bellsoft-jdk17.0.14+10-linux-amd64.tar.gz"
     version = "17.0.14"

     [[metadata.dependencies.licenses]]

pack cannot find the file located in the local http server. tcpdump says there wasn't any request.

Docs says uri can be an URL of a file but for another section. [[metadata.dependencies]] subsection is not documented.

Q1: What kind of uris I can use in [[metadata.dependencies]] subsection?
Q2: Are there alternatives to referencing to these tarballs for a dependencies? (maybe containers? just a wild guess)

Thanks in advance.

[ildar]

@dmikusa , maybe you know ?

[dmikusa]

Q1: What kind of uris I can use in [[metadata.dependencies]] subsection?

It supports file://, http:// and https://. I don't see anything obvious about why it's failing to download the file from your HTTP server, besides maybe network problems. Make sure that you have an HTTP server running and that you can download files from it in a container from where you're running your builds. Also, you can enable debug logging by adding -v -e BP_LOG_LEVEL=DEBUG to your pack build command (or however those are set with your build tool of choice). This will generate more output when the build runs. Idk if it'll provide anything illuminating, but it's worth a try.

You don't need to rebuild the buildpack to change the URLs though.

Dependency mirrors are a great way to do this, see https://paketo.io/docs/howto/configuration/#dependency-mirrors. At this point, there's no tooling to create a dependency mirror so that part is manual but from the consumer standpoint, it's very easy to point buildpacks to a dependency mirror.

There is also the binding-tool which will generate dependency mapping files for you. It will also download dependencies and write the dependency mapping files to point to these files. See https://paketo.io/docs/howto/configuration/#dependency-mappings and https://github.com/dmikusa/binding-tool/

Q2: Are there alternatives to referencing to these tarballs for a dependencies? (maybe containers? just a wild guess)

That's the primary method. There are some efforts to use UBI base images and dependencies provided through those images, see https://github.com/paketo-community/ubi-java-extension.