update(uri): support for .cnb files in dependencies by till · Pull Request #420 · paketo-buildpacks/jam

till · 2025-08-21T20:02:43Z

Summary

Adds support for .cnb files for dependencies, leaving them untouched
during an update process. Supports both local paths, but an archive
from a http/https server alike.

I extracted the code from commands into its own file, to be able to
add a bit of test coverage.

Also extracted some of the check code (for suffix/prefix) into the uri
file to be able to reuse it and make it a bit more readable (hopefully).

LBNL, update the parser to keep http/https scheme around so the uri in
the dependencies doesn't get the scheme stripped.

Resolves: #358

Use Cases

A cnb file in the local file system or on a remote http/https server.

Checklist

I have viewed, signed, and submitted the Contributor License Agreement.
I have linked issue(s) that this PR should close using keywords or the Github UI (See docs)
I have added an integration test, if necessary.
I have reviewed the styleguide for guidance on my code quality.
I'm happy with the commit history on this PR (I have rebased/squashed as needed).

linux-foundation-easycla · 2025-08-21T20:02:48Z

The committers listed above are authorized under a signed CLA.

✅ login: jericop / name: Jerico Pena (affca14)

pacostas · 2025-09-04T12:07:05Z

Hello @till ! Is on my todo list for reviewing it. I just need to find some time :S

pacostas

Nice contribution! Could please rebase your branch and adjust your code to match the latest changes as the --no-cnb-registry flag has been deprecated.

I have also added two comments. Feel free to change your code accordingly or not as is mostly aesthetics :)

internal/uri.go

internal/package_config.go

pacostas · 2025-09-19T10:41:29Z

@till Ping

internal/uri.go

internal/package_config.go

commands/update_buildpack.go

internal/package_config.go

pacostas · 2025-11-24T15:39:50Z

internal/package_config.go

@@ -37,16 +37,25 @@ func (d *PackageConfigDependency) UnmarshalTOML(v interface{}) error {
 	}

 	if d.URI != "" {


Can you also please add some tests for covering the changes on the package_config file?

till · 2025-12-03T16:05:58Z

internal/package_config.go


-			d.URI = strings.TrimPrefix(uri.String(), "//")
+		// Static URIs with http/https scheme are left unchanged
+		if uri.Scheme == "http" || uri.Scheme == "https" {


I think this is the only change. And it should be covered by the integration test?

till · 2025-12-03T16:06:32Z

internal/package_config.go

 	}

 	if d.URI != "" {
-		if !strings.HasPrefix(d.URI, "urn:cnb:registry") {


This just removes the if wrapping and exists earlier.

till · 2025-12-03T16:13:00Z

@pacostas Can you add the label? I think minor is fine.

Adds support for .cnb files and directories for dependencies, leaving them untouched during the update process. Supports cnb files from a local paths and from a http/https server alike. Extracted some of the check code (for suffix/prefix) into the uri file to be able to reuse it and make it a bit more readable (hopefully). LBNL, update the parser to keep http/https scheme around so the uri in the dependencies doesn't get the scheme stripped. Resolves: paketo-buildpacks#358

pacostas · 2025-12-12T14:59:00Z

internal/package_config.go


-			uri.Scheme = ""
+		// Parse the URI to check its scheme
+		uri, err := url.Parse(d.URI)


This will not work, in case you have a ./hello/world.tgz

pacostas · 2025-12-12T15:01:46Z

internal/package_config.go

 	for i, dependency := range config.Dependencies {
-		if !strings.HasPrefix(dependency.URI, "docker://") && !strings.HasPrefix(dependency.URI, "urn:cnb:registry") {
+		// Skip static URIs (local paths, HTTP URLs, etc.) - leave them unchanged
+		if IsStaticURI(dependency) {


This will not get inside the if statement, in case you have a ./hello/world.tgz uri

pacostas · 2025-12-12T15:05:29Z

internal/package_config.go


-			d.URI = strings.TrimPrefix(uri.String(), "//")
+		// Static URIs with http/https scheme are left unchanged
+		if uri.Scheme == "http" || uri.Scheme == "https" {


I think here you can use the buildpack.GetLocatorType function

pacostas · 2025-12-12T15:12:50Z

internal/package_config.go

+		if uri.Scheme == "http" || uri.Scheme == "https" {
+			return nil
 		}
+


On this function, somewhere we should validate that local files that are referenced on the package.toml, actually exists locally

pacostas · 2025-12-12T15:15:23Z

integration/update_buildpack_test.go

 		})
 	})
+
+	context("when dependencies include .cnb archives", func() {


It seems like we dont need a new section just for the .cnb archives. Can you add the .cnb testing scenarios in an existing integration test? It would be nice not to increase the amount of integration tests if is not necessary.

pacostas · 2025-12-12T15:18:43Z

internal/uri_test.go

+			expected: true,
+		},
+		{
+			name:     "non-existent relative path",


I think this one is failing, not due to the file path does not exist, but because the getlocator function can not recognize it as a buildpack.URILocator. Extra code is necessary to ensure that is a file path.

pacostas · 2025-12-12T15:19:03Z

internal/uri_test.go

+			expected: true,
+		},
+		{
+			name:     "non-existent relative path",


Can you also add a scenario when the file exists?

pacostas · 2025-12-12T15:19:13Z

internal/uri_test.go

+			expected: false,
+		},
+		{
+			name:     "non-existent absolute path",


I think this one is failing, not due to the file path does not exist, but because the getlocator function can not recognize it as a buildpack.URILocator. Extra code is necessary to ensure that is a file path.

pacostas · 2025-12-12T15:19:18Z

internal/uri_test.go

+			expected: false,
+		},
+		{
+			name:     "non-existent absolute path",


Can you also add a scenario when the file exists?

till requested a review from a team as a code owner August 21, 2025 20:02

till requested review from paketo-bot-reviewer and robdimsdale August 21, 2025 20:02

till force-pushed the improve-cnb-handling branch 2 times, most recently from 54c180e to 1590fdc Compare August 22, 2025 19:49

pacostas requested changes Sep 11, 2025

View reviewed changes

internal/uri.go Outdated Show resolved Hide resolved

internal/package_config.go Outdated Show resolved Hide resolved

till force-pushed the improve-cnb-handling branch 2 times, most recently from d022aef to 991d4dc Compare November 19, 2025 14:27

till requested a review from pacostas November 19, 2025 14:28

till force-pushed the improve-cnb-handling branch from 991d4dc to cd4de74 Compare November 20, 2025 14:25

pacostas requested changes Nov 22, 2025

View reviewed changes

pacostas requested changes Nov 24, 2025

View reviewed changes

till force-pushed the improve-cnb-handling branch from 73db74b to 3f1e867 Compare December 3, 2025 16:04

till commented Dec 3, 2025

View reviewed changes

till requested a review from pacostas December 10, 2025 09:04

till force-pushed the improve-cnb-handling branch from 3f1e867 to 3eefac2 Compare December 12, 2025 14:02

pacostas requested changes Dec 12, 2025

View reviewed changes

jpena-r7 approved these changes Dec 15, 2025

View reviewed changes

jericop approved these changes Dec 15, 2025

View reviewed changes

Merge branch 'main' into improve-cnb-handling

affca14

jericop self-requested a review December 15, 2025 16:14

		@@ -37,16 +37,25 @@ func (d *PackageConfigDependency) UnmarshalTOML(v interface{}) error {
		}

		if d.URI != "" {

Conversation

till commented Aug 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Use Cases

Checklist

Uh oh!

linux-foundation-easycla bot commented Aug 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pacostas commented Sep 4, 2025

Uh oh!

pacostas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pacostas commented Sep 19, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

till commented Dec 3, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

till commented Aug 21, 2025 •

edited

Loading

linux-foundation-easycla bot commented Aug 21, 2025 •

edited

Loading