Commit Graph

358 Commits

Author SHA1 Message Date
Juan Bustamante 94348a5314
Execution Environment RFC Implementation (#2324)
* WIP - adding flag to set the CNB_EXEC_ENV

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* adding . and - to the regular expression to validate and cnn exec env

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* WIP - adding exec-env on project.toml schema verion 0.3, it is still in progress

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* fixing some lint errors

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* WIP - refacting test case

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* adding more test cases

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* adding exec-env to builder.toml

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* adding exec-env to builder.toml

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Adding unit test for exec-env in buildpack.toml

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Removing for now the platform API version validation

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Fixing unit tests

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* fixing some unit tests

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Fixing formatting issue

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Test Coverage Improvements Summary

  Changes Made:

  1. internal/build/lifecycle_executor.go (2 lines added)
    - Added Platform API versions 0.14 and 0.15 to SupportedPlatformAPIVersions
    - This allows pack to support the new execution environment feature which requires Platform API 0.15
  2. internal/build/phase_config_provider.go (1 line changed)
    - Updated the Platform API version check from 0.13 to 0.15 for the CNB_EXEC_ENV environment variable
  3. internal/build/fakes/fake_builder.go (7 lines added)
    - Added WithExecutionEnvironment() helper function for tests
    - Allows tests to easily set the execution environment in lifecycle options
  4. internal/build/phase_config_provider_test.go (41 lines added)
    - Added comprehensive tests for the execution environment feature:
        -  Test that CNB_EXEC_ENV is set when Platform API >= 0.15
      -  Test that CNB_EXEC_ENV is NOT set when Platform API < 0.15
    - Added import for "github.com/buildpacks/lifecycle/api" package

  Existing Test Coverage (Already in PR):

  1. internal/commands/build_test.go
    -  Tests that default exec-env is 'production'
    -  Tests with valid characters (letters, numbers, dots, hyphens)
    -  Tests with invalid characters (shows proper error)
    -  Comprehensive validation tests for exec-env flag
  2. builder/config_reader_test.go
    -  Tests reading exec-env from builder configuration
  3. pkg/project/project_test.go
    -  Tests reading exec-env from project.toml (schema v0.3)
    -  Tests for buildpack groups, pre-groups, and post-groups

  Test Results:

  - All phase config provider tests: PASSING 
  - All build command tests: PASSING 
  - Coverage for exec-env flag validation: COMPLETE 
  - Coverage for CNB_EXEC_ENV environment variable: COMPLETE 
  - Coverage for Platform API version gating: COMPLETE 

  The test coverage for your ExecutionEnvironment feature is now comprehensive and covers:
  - Command-line flag validation
  - Environment variable setting based on Platform API version
  - Builder and project configuration reading
  - Edge cases and error conditions

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Fixing Acceptance Tests API Platform expected versions

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* fix: add missing api import in phase_config_provider_test

Add missing import for github.com/buildpacks/lifecycle/api package
required by execution environment tests that use api.MustParse().

The tests added in this branch for CNB_EXEC_ENV functionality
reference api.Version and api.MustParse() but the import was missing,
causing compilation errors after merging latest changes from main.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

---------

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-22 20:45:27 -05:00
Juan Bustamante 812530673f
chore: migrate from docker/docker to moby/moby client (#2512)
* chore: migrate from docker/docker to moby/moby client

Migrates all Docker client usage from github.com/docker/docker to
github.com/moby/moby/client following imgutil's PR #299 migration.

Key changes:
- Updated all DockerClient interfaces to use moby Result types
  (ImageHistoryResult, ContainerInspectResult, etc.)
- Migrated to Options pattern for API calls (ImagePullOptions,
  ContainerInspectOptions, etc.)
- Updated Result field access patterns (result.Items, result.Info, etc.)
- Fixed platform validation by passing dist.Target directly to
  ImagePull instead of string conversion
- Regenerated mocks for moby's APIClient interface
- Updated test assertions for moby's type system changes
- Fixed go.mod dependencies (moby packages now direct)

All tests passing (304 tests across pkg/client, pkg/image, internal/build).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* chore: migrate acceptance test manager to moby client

Updated acceptance/managers/image_manager.go to use the new moby client API.

Key changes:
- Updated imports from github.com/docker/docker to github.com/moby/moby
- Changed dockerCli type from client.APIClient to *client.Client
- Updated method signatures to use Options pattern:
  - Info() now requires client.InfoOptions{} and accesses .Info.OSType
  - ImageTag() uses client.ImageTagOptions with Source/Target fields
  - ImageInspect() returns Result type, access .InspectResponse field
  - ContainerCreate() uses client.ContainerCreateOptions struct
  - ContainerStart() uses client.ContainerStartOptions{}
  - ContainerKill() uses client.ContainerKillOptions{Signal: "SIGKILL"}
  - ContainerRemove() uses client.ContainerRemoveOptions{Force: true}
  - ContainerInspect() requires client.ContainerInspectOptions{} and returns Result
- Updated network port types:
  - Use network.MustParsePort() to create network.Port values
  - Changed from nat.PortSet/PortMap to network.PortSet/PortMap
  - Updated PortBinding from nat.PortBinding to network.PortBinding
- Fixed Result type accesses:
  - ContainerInspect: access result.Container instead of result directly
  - ImageInspect: access result.InspectResponse
  - Info: access result.Info.OSType

This completes the migration from docker/docker to moby/moby client across all test code.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* fix: use concrete Client type in acceptance tests

Changed all dockerCli parameter and variable types from client.APIClient
interface to *client.Client concrete type to match the updated helper
functions and managers that now require the concrete type.

Changes:
- Updated global dockerCli variable type
- Updated createStack() and createStackImage() parameter types
- Changed dockertypes.ImageBuildOptions to client.ImageBuildOptions
- Removed unused github.com/docker/docker/api/types import

This fixes compilation errors where the interface type couldn't be
used as the concrete type without type assertion.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* fixing format issues

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* fix: migrate to client.New() and remove deprecated APIs

Updated all docker client initialization to use the new client.New()
function instead of the deprecated NewClientWithOpts(). The new API
enables API version negotiation by default, so WithAPIVersionNegotiation()
is no longer needed.

Changes:
- Replaced all NewClientWithOpts() calls with New()
- Removed WithAPIVersionNegotiation() option (now default behavior)
- Updated cmd/docker_init.go, pkg/client/client.go, and all test files
- Ran go mod tidy to clean up dependencies

Note: internal/build/testdata/fake-lifecycle/phase.go still uses the old
API since it references the legacy github.com/docker/docker/client package
and is built in a separate container context during tests.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* test: skip report tests for pack versions < v0.40.0

The report tests expect the fixture to show Platform API 0.14 and 0.15,
which are only supported in lifecycle 0.21.0+. Pack versions before
v0.40.0 use lifecycle 0.20.x which only supports Platform APIs up to 0.13.

Added PlatformAPI_0_14 feature flag that checks if pack >= v0.40.0.
The report tests now skip when testing with older pack versions that
don't support Platform APIs 0.14, 0.15.

This fixes the acceptance-combo (current, current, previous) test failure
where current pack (with lifecycle 0.21.0) outputs Platform APIs 0.3-0.15,
but the test was incorrectly expecting 0.3-0.13 due to the fixture override
file that was being picked up.

Removed the pack_previous_fixtures_overrides/report_output.txt file as
the override directory approach didn't work correctly for this test case.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* fix: add Platform API 0.14 and 0.15 support

When we updated to lifecycle 0.21.0, we updated the fixture file to
expect Platform APIs 0.14 and 0.15, but forgot to update the
SupportedPlatformAPIVersions in the code.

The pack report command reads from build.SupportedPlatformAPIVersions
to display which Platform APIs are supported, so this was causing a
mismatch between the fixture expectation and the actual output.

Changes:
- Added api.MustParse("0.14") and api.MustParse("0.15") to
  SupportedPlatformAPIVersions in internal/build/lifecycle_executor.go
- Removed the PlatformAPI_0_14 feature flag and skip logic from
  acceptance tests (no longer needed)

This fixes the acceptance test failures where the fixture expected
Platform APIs up to 0.15 but pack was only reporting up to 0.13.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

---------

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-20 07:20:36 -05:00
Vaibhav Yadav e45b434cd4
fix: update lifecycle API validation for experimental flag solve issue #2414 (#2432)
* fix: allow image extensions based on buildpack API

Signed-off-by: vky5 <vky05@proton.me>

* Move extension validation to client layer and check Platform API version

- Move validation from command layer (builder_create.go, create_builder.go)
  to client layer (pkg/client/create_builder.go)
- Check Platform API version instead of lifecycle version to determine
  if extensions are stable (>= 0.13) or experimental (< 0.13)
- Use lifecycle's LessThan() method for version comparison
- Add comprehensive tests for Platform API validation scenarios:
  * Platform API >= 0.13 allows extensions without experimental flag
  * Platform API < 0.13 requires experimental flag for extensions
  * Builders without extensions work regardless of Platform API version
- Create platform-0.13 test lifecycle data with Platform API 0.3-0.13
- Add prepareExtensions() test helper that configures both extensions
  and appropriate lifecycle for testing

This fixes the issue where users get experimental extension errors even
when using lifecycle with Platform API 0.13 where extensions are stable.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Run make format to remove extra blank lines

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Fix linting errors by removing deprecated API usage

- Remove fallback to deprecated descriptor.API.PlatformVersion
- Use only descriptor.APIs.Platform.Supported (new API)
- Skip validation if Platform API information is unavailable
- Remove unused github.com/buildpacks/lifecycle/api import

This fixes staticcheck SA1019 warnings about using deprecated API fields.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

---------

Signed-off-by: vky5 <vky05@proton.me>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-11-23 16:08:54 -05:00
Natalie Arellano 53ab88ce7a
When fetching lifecycle image, use a platform-specific digest (#2467)
* When fetching lifecycle image, use a platform-specific digest to avoid containerd storage issues

Signed-off-by: Natalie Arellano <natalie.p.arellano@gmail.com>

* Log platform-specific digest resolution

Add debug message showing original tag and resolved digest when
FetchForPlatform resolves manifest lists, improving visibility
and maintaining test compatibility.

Signed-off-by: Natalie Arellano <natalie.p.arellano@gmail.com>

* Make lifecycle image cleanup optional

Ignore errors when lifecycle image doesn't exist by tag during cleanup,
as it may have been pulled by digest instead.

Signed-off-by: Natalie Arellano <natalie.p.arellano@gmail.com>

* Add comprehensive test coverage for FetchForPlatform method

This commit adds test coverage for the FetchForPlatform implementation,
specifically testing the platform-specific digest resolution logic
including the manifest list code path.

Changes:
- Add 10 test cases covering various scenarios:
  * Nil target delegation to regular Fetch
  * Multi-platform image resolution for different architectures
  * True manifest list handling with multiple platforms
  * Platform matching and mismatch error cases
  * Single-platform image validation
  * Insecure registry support
  * Platform variant handling
  * Non-existent image error handling

- Add SetUpRandomRemoteIndexWithPlatforms helper in testhelpers
  * Uses imgutil for image creation and index management
  * Follows the pattern from manifest_create.go
  * Creates multi-platform indexes using CNBIndex
  * Properly sets platform metadata (OS, Architecture)

All 41 tests in the image package pass successfully.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Fix platform mismatch in insecure registries test

The test was creating an image without specifying a platform (defaulting
to linux/amd64) but then trying to fetch it with runtime.GOOS/GOARCH,
which fails on Windows runners where the OS is "windows".

Now the test creates the image with the same platform it will fetch,
ensuring consistency across all platforms.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

---------

Signed-off-by: Natalie Arellano <natalie.p.arellano@gmail.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-11-23 09:56:37 -05:00
Juan Bustamante 019eb747e2
fix(security): Resolve CVE-GHSA-cgrx-mc8f-2prm by upgrading selinux to v1.13.0 (#2476)
* build(deps): bump @octokit/plugin-paginate-rest, @actions/github and @octokit/rest (#2338)

Bumps [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js) to 9.2.2 and updates ancestor dependencies [@octokit/plugin-paginate-rest](https://github.com/octokit/plugin-paginate-rest.js), [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) and [@octokit/rest](https://github.com/octokit/rest.js). These dependencies need to be updated together.

Updates `@octokit/plugin-paginate-rest` from 2.2.3 to 9.2.2
- [Release notes](https://github.com/octokit/plugin-paginate-rest.js/releases)
- [Commits](https://github.com/octokit/plugin-paginate-rest.js/compare/v2.2.3...v9.2.2)

Updates `@actions/github` from 4.0.0 to 6.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)

Updates `@octokit/rest` from 18.0.0 to 21.1.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](https://github.com/octokit/rest.js/compare/v18.0.0...v21.1.1)

---
updated-dependencies:
- dependency-name: "@octokit/plugin-paginate-rest"
  dependency-type: indirect
- dependency-name: "@actions/github"
  dependency-type: direct:production
- dependency-name: "@octokit/rest"
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* build(deps): bump @octokit/request, @actions/github and @octokit/rest (#2370)

Bumps [@octokit/request](https://github.com/octokit/request.js) to 8.4.1 and updates ancestor dependencies [@octokit/request](https://github.com/octokit/request.js), [@actions/github](https://github.com/actions/toolkit/tree/HEAD/packages/github) and [@octokit/rest](https://github.com/octokit/rest.js). These dependencies need to be updated together.

Updates `@octokit/request` from 5.6.3 to 8.4.1
- [Release notes](https://github.com/octokit/request.js/releases)
- [Commits](https://github.com/octokit/request.js/compare/v5.6.3...v8.4.1)

Updates `@actions/github` from 4.0.0 to 6.0.0
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/github/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/github)

Updates `@octokit/rest` from 18.0.0 to 21.1.1
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](https://github.com/octokit/rest.js/compare/v18.0.0...v21.1.1)

---
updated-dependencies:
- dependency-name: "@octokit/request"
  dependency-version: 8.4.1
  dependency-type: indirect
- dependency-name: "@actions/github"
  dependency-version: 6.0.0
  dependency-type: direct:production
- dependency-name: "@octokit/rest"
  dependency-version: 21.1.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* build(deps): bump the go-dependencies group with 8 updates (#2453)

Bumps the go-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/docker/cli](https://github.com/docker/cli) | `28.5.0+incompatible` | `28.5.1+incompatible` |
| [github.com/docker/docker](https://github.com/docker/docker) | `28.5.0+incompatible` | `28.5.1+incompatible` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.42.0` | `0.43.0` |
| [golang.org/x/mod](https://github.com/golang/mod) | `0.28.0` | `0.29.0` |
| [golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.31.0` | `0.32.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.36.0` | `0.37.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.35.0` | `0.36.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.29.0` | `0.30.0` |

Updates `github.com/docker/cli` from 28.5.0+incompatible to 28.5.1+incompatible
- [Commits](https://github.com/docker/cli/compare/v28.5.0...v28.5.1)

Updates `github.com/docker/docker` from 28.5.0+incompatible to 28.5.1+incompatible
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v28.5.0...v28.5.1)

Updates `golang.org/x/crypto` from 0.42.0 to 0.43.0
- [Commits](https://github.com/golang/crypto/compare/v0.42.0...v0.43.0)

Updates `golang.org/x/mod` from 0.28.0 to 0.29.0
- [Commits](https://github.com/golang/mod/compare/v0.28.0...v0.29.0)

Updates `golang.org/x/oauth2` from 0.31.0 to 0.32.0
- [Commits](https://github.com/golang/oauth2/compare/v0.31.0...v0.32.0)

Updates `golang.org/x/sys` from 0.36.0 to 0.37.0
- [Commits](https://github.com/golang/sys/compare/v0.36.0...v0.37.0)

Updates `golang.org/x/term` from 0.35.0 to 0.36.0
- [Commits](https://github.com/golang/term/compare/v0.35.0...v0.36.0)

Updates `golang.org/x/text` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](https://github.com/golang/text/compare/v0.29.0...v0.30.0)

---
updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 28.5.1+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/docker/docker
  dependency-version: 28.5.1+incompatible
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/mod
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/oauth2
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sys
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* fix(security): resolve CVE-GHSA-cgrx-mc8f-2prm by upgrading selinux to v1.13.0

Migrated from unmaintained GoogleContainerTools/kaniko to the actively maintained Chainguard fork (v1.25.4), updated lifecycle to v0.20.19, and upgraded opencontainers/selinux from v1.12.0 to v1.13.0 to fix GHSA-cgrx-mc8f-2prm. This also upgraded golang.org/x/crypto from v0.43.0 to v0.45.0, resolving additional CVEs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Use Docker API version negotiation instead of hardcoded version

Fixes #2464

This change replaces all hardcoded Docker API version 1.38 references
with WithAPIVersionNegotiation(), allowing pack to automatically adapt
to the Docker daemon's supported API version.

Changes:
- Updated main client initialization to use API version negotiation
- Updated SSH Docker client to use API version negotiation
- Updated all test files to use API version negotiation
- Upgraded fake-lifecycle test dependencies from Docker client v1.4.2 (2019) to v28.5.1
- Fixed fake-lifecycle imports and API calls for compatibility with modern Docker client

Benefits:
- Works with modern Docker daemons requiring API 1.44+ (Docker 27+)
- Backward compatible with older Docker versions
- Future-proof - no need to update hardcoded versions
- Solves Windows runner issue without requiring Docker 27 upgrade

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Update Example_build test to use newer builder with modern lifecycle

The cnbs/sample-builder:noble builder includes a recent lifecycle version
that supports Docker API 1.44+, fixing the test failure on systems with
modern Docker daemons (Docker 27+).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Downgrade fake-lifecycle dependencies for Go 1.23 compatibility

Updated fake-lifecycle test module to support Go 1.23.4 (Windows runner):
- Downgraded lifecycle from v0.20.11 to v0.19.3
- Downgraded go-containerregistry from v0.20.6 to v0.19.2
- Set Go requirement to 1.23 (compatible with Go 1.23.4)
- Updated Dockerfile to use golang:1.23 base image

The older versions still support Docker API 1.44+ and work correctly
with modern Docker daemons requiring minimum API version 1.44.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* updating fake-lifecycle go version

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Use Docker API version negotiation instead of hardcoded version (#2474)

* Use Docker API version negotiation instead of hardcoded version

Fixes #2464

This change replaces all hardcoded Docker API version 1.38 references
with WithAPIVersionNegotiation(), allowing pack to automatically adapt
to the Docker daemon's supported API version.

Changes:
- Updated main client initialization to use API version negotiation
- Updated SSH Docker client to use API version negotiation
- Updated all test files to use API version negotiation
- Upgraded fake-lifecycle test dependencies from Docker client v1.4.2 (2019) to v28.5.1
- Fixed fake-lifecycle imports and API calls for compatibility with modern Docker client

Benefits:
- Works with modern Docker daemons requiring API 1.44+ (Docker 27+)
- Backward compatible with older Docker versions
- Future-proof - no need to update hardcoded versions
- Solves Windows runner issue without requiring Docker 27 upgrade

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Update Example_build test to use newer builder with modern lifecycle

The cnbs/sample-builder:noble builder includes a recent lifecycle version
that supports Docker API 1.44+, fixing the test failure on systems with
modern Docker daemons (Docker 27+).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Downgrade fake-lifecycle dependencies for Go 1.23 compatibility

Updated fake-lifecycle test module to support Go 1.23.4 (Windows runner):
- Downgraded lifecycle from v0.20.11 to v0.19.3
- Downgraded go-containerregistry from v0.20.6 to v0.19.2
- Set Go requirement to 1.23 (compatible with Go 1.23.4)
- Updated Dockerfile to use golang:1.23 base image

The older versions still support Docker API 1.44+ and work correctly
with modern Docker daemons requiring minimum API version 1.44.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

---------

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

* fix code format

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-11-22 17:01:24 -05:00
Juan Bustamante f5f0a62548
Use Docker API version negotiation instead of hardcoded version (#2474)
* Use Docker API version negotiation instead of hardcoded version

Fixes #2464

This change replaces all hardcoded Docker API version 1.38 references
with WithAPIVersionNegotiation(), allowing pack to automatically adapt
to the Docker daemon's supported API version.

Changes:
- Updated main client initialization to use API version negotiation
- Updated SSH Docker client to use API version negotiation
- Updated all test files to use API version negotiation
- Upgraded fake-lifecycle test dependencies from Docker client v1.4.2 (2019) to v28.5.1
- Fixed fake-lifecycle imports and API calls for compatibility with modern Docker client

Benefits:
- Works with modern Docker daemons requiring API 1.44+ (Docker 27+)
- Backward compatible with older Docker versions
- Future-proof - no need to update hardcoded versions
- Solves Windows runner issue without requiring Docker 27 upgrade

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Update Example_build test to use newer builder with modern lifecycle

The cnbs/sample-builder:noble builder includes a recent lifecycle version
that supports Docker API 1.44+, fixing the test failure on systems with
modern Docker daemons (Docker 27+).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

* Downgrade fake-lifecycle dependencies for Go 1.23 compatibility

Updated fake-lifecycle test module to support Go 1.23.4 (Windows runner):
- Downgraded lifecycle from v0.20.11 to v0.19.3
- Downgraded go-containerregistry from v0.20.6 to v0.19.2
- Set Go requirement to 1.23 (compatible with Go 1.23.4)
- Updated Dockerfile to use golang:1.23 base image

The older versions still support Docker API 1.44+ and work correctly
with modern Docker daemons requiring minimum API version 1.44.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>

---------

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-11-22 15:28:14 -05:00
David Gannon fb0563f4cd
Added the first tag argument (#2394)
* Added the first `--tag` argument to builder and buildpack package create command

Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>

---------

Signed-off-by: David Gannon <19214156+dgannon991@users.noreply.github.com>
2025-07-07 11:43:32 -05:00
Juan Bustamante ab77bee404
Fix #2405: Add template parameter to GitHub issue URL (#2407)
When using 'pack buildpack register', the GitHub URL was missing
the 'template=add-buildpack.md' parameter, causing GitHub to redirect
to a template selection page and drop all pre-filled parameters.

This fix adds the template parameter to ensure the correct issue
template is used and all parameters are preserved.

🤖 Generated with [Claude Code](https://claude.ai/code)

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-02 12:37:55 -05:00
Jerico Pena 6ee43b1713
Bump imgutil to latest and docker from v27.5.1 to v28.3.0 (#2406)
* Bump imgutil to latest and docker from v27.5.1 to v28.3.0
* Remove deprecated DSA key form sshdialer

Signed-off-by: Jerico Pena <jericop@gmail.com>
2025-06-27 09:57:41 -05:00
Prashant Rewar ba54b86ec0
Support Insecure Registries (#2077)
* Support Insecure Registries

Signed-off-by: Prashant Rewar <108176843+prashantrewar@users.noreply.github.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Signed-off-by: Juan Bustamante <juan.bustamante@broadcom.com>
Co-authored-by: Juan Bustamante <juan.bustamante@broadcom.com>
Co-authored-by: Juan Bustamante <bustamantejj@gmail.com>
2025-06-06 08:59:28 -05:00
Juan Bustamante 5cbbf3396f
`pack builder create` supports system buildpacks (#2349)
This PR implements [RFC 101 - System Buildpacks](https://github.com/buildpacks/rfcs/blob/main/text/0101-system-buildpacks.md ) support in pack. 

Systems buildpacks are special buildpacks that are automatically included before (pre) and after (post) the regular buildpacks during the build process, providing platform-level functionality like shell profile scripts, service binding, and other platform-specific capabilities.

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
2025-06-05 20:41:24 -05:00
Anatoli Babenia d5a88c789d
Make `go build` work without Makefile (#2390)
This merges `version.go` into `pkg/client/client.go`, which is the
only file that uses the it. Then it moves `cmd/pack/main.go` into
root. Now `go build` produces executable `pack` instead of bogus
`pack` with just `version.go`.

No need to specify `./cmd/pack` while compiling anymore.
The version is injected into client directly without extra files.

Signed-off-by: Anatoli Babenia <anatoli@rainforce.org>
Co-authored-by: Juan Bustamante <bustamantejj@gmail.com>
2025-06-03 07:47:11 -05:00
Juan Bustamante 9bf04afbc4
Adding unit tests for issue 2384 (#2391)
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
2025-05-31 19:04:09 -05:00
Sam baa3edaef1
Do not select tagert from os if arch is specified (#2385)
The current daemonTarget function in pack has a flawed target selection logic that prevents proper multi-architecture builds when not publishing

Signed-off-by: Sam M <git@s-mc.io>
2025-05-31 18:45:04 -05:00
Juan Bustamante 8c7e57ae18
Fix default userns=host behavior to be opt-in (#2386)
* Fix default userns=host behavior to be opt-in

  The flag `--userns-host` is now required to enable the user namespace
  isolation for build containers. By default, this is disabled, which
  resolves the incompatibility with Docker plugins that don't support
  "userns as host" functionality.

  This reverts the default behavior from pack 0.35.0 where user namespace
  isolation was enabled by default, while still allowing users who want
  this feature to opt in.

---------

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
2025-05-31 11:46:45 -05:00
Rashad Sirajudeen e4460f0259
Support docker uri for lifecycle (#2112)
The lifecycle image can be specified as a Docker URI  in the `builder.toml` when creating a builder

---------

Signed-off-by: Rashad Sirajudeen <rashad.20@cse.mrt.ac.lk>
Signed-off-by: Rashad Sirajudeen <rashadsirajudeen@gmail.com>
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Juan Bustamante <bustamantejj@gmail.com>
2025-05-27 01:30:03 +00:00
adelaney21 e5f75e1a25 Address linter errors
The updated linter has stricter checks for go 1.24.

Signed-off-by: adelaney21 <adelaney21@bloomberg.net>
2025-04-08 08:14:16 +01:00
Robert Gogolok 19ca0f6297 Support FreeBSD build phase
Signed-off-by: Robert Gogolok <robert.gogolok@stackit.cloud>
2025-03-15 12:00:15 +01:00
Juan Bustamante 6041a952d0
Merge branch 'main' into extension-multi-arch 2025-02-24 07:36:58 -05:00
Robert Gogolok 6658bb06b3 Remove obsolete // +build lines
https://tip.golang.org/doc/go1.18#go-build-lines

Signed-off-by: Robert Gogolok <robert.gogolok@stackit.cloud>
2025-02-21 00:11:25 +01:00
Juan Bustamante de21ac70b7
Merge branch 'main' into extension-multi-arch 2025-02-19 07:40:21 -05:00
Joey Brown 86658040cc remove unnecessary variable in unit test
Signed-off-by: Joey Brown <brown.joseph@salesforce.com>
2025-02-06 09:39:16 -06:00
Joey Brown bcc0c3b625 remove unnecessary version assignment in unit test
Signed-off-by: Joey Brown <brown.joseph@salesforce.com>
2025-02-06 09:35:02 -06:00
Joey Brown 7591928511 remove negation that was causing tests to fail
Signed-off-by: Joey Brown <brown.joseph@salesforce.com>
2025-02-05 16:07:20 -06:00
Joey Brown fee6dcb387 fix unit test
Signed-off-by: Joey Brown <brown.joseph@salesforce.com>
2025-01-31 17:00:21 -06:00
Joey Brown 7bf3e01154 add version check
Signed-off-by: Joey Brown <brown.joseph@salesforce.com>
2025-01-31 16:32:54 -06:00
Joey Brown aa29846754 pick up where pglushko left off
Signed-off-by: Joey Brown <brown.joseph@salesforce.com>
2025-01-31 11:37:58 -06:00
Costas Papastathis 8ca5ea9321 feat: Adding targets and path flags when packaging an extension
Signed-off-by: Costas Papastathis <papastathiscr@gmail.com>
2025-01-16 16:39:02 +01:00
Juan Bustamante 0c432c956f implementing logic for adding tag suffix
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
2025-01-15 21:02:13 -05:00
Juan Bustamante c49ea0a8e1 fixing formatting issue
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
2025-01-14 20:37:46 -05:00
Juan Bustamante b99975225f WIP - adding a new flag --append-image-name-suffix to append [os]-[arch]-[variant] to the image name when pushing a multi-arch buildpack or builder
Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
2025-01-14 20:37:46 -05:00
Natalie Arellano 1f7e0c8bcb Emit a performance warning if containerd is enabled and we're exporting to the daemon
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-11-14 11:07:26 -05:00
Natalie Arellano 9f8c95bc44 FIXME: update lifecycle (to non-released version) so that we can bump docker
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-10-28 15:30:42 -04:00
Natalie Arellano b59c10dd67 Fix lint
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-10-28 14:50:17 -04:00
Natalie Arellano 620ee480f4 Fix deletion of ephemeral builder
`createEphemeralBuilder` mutates the provided `rawBuilderImage`, so we must save the image name
before this method is called.

Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-09-05 13:16:43 -04:00
Anthony Dahanne 825617be7d Fix buildpacks#2237: consider /workspace as a sensitive dir
Signed-off-by: Anthony Dahanne <anthony.dahanne@gmail.com>
2024-07-29 00:03:26 -04:00
Aidan Delaney b195e95e2f Add --trust-extra-buildpacks option
Use the term "extra buildpacks" instead of "additional
buildpacks"

Signed-off-by: Aidan Delaney <adelaney21@bloomberg.net>
2024-07-22 05:58:24 +01:00
Aidan Delaney 30704ba80b Trust buildpacks in addition to those on the builder
Trust buildpacks provided when `--buildpack` is provided on the
command line.

Signed-off-by: Aidan Delaney <adelaney21@bloomberg.net>
2024-07-19 07:10:06 +01:00
Natalie Arellano c1a1382c23
Merge pull request #50 from buildpacks/ephemeral-network
Launch build containers in a separate ephemeral Docker bridge network
2024-07-11 15:03:05 -04:00
Natalie Arellano 72ffc75dba
Merge pull request #31 from buildpacks/fix/warn-container-daemon
Warn if NOT --pull-policy=always in container
2024-07-11 09:48:17 -04:00
Natalie Arellano 456342bed0 Merge branch 'security-review' into fix/warn-container-daemon
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-07-10 10:57:13 -04:00
Natalie Arellano 5dbbb52ad9 Merge branch 'security-review' into fix/untrusted-flow
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-07-10 10:56:56 -04:00
Natalie Arellano 2404f2e92d
Merge branch 'main' into fix_trusting_of_trusted_builders 2024-07-09 10:28:51 -04:00
Colin Casey 1e79cc8123 With the changes introduced in #2043 for separating suggested builders and trusted builders, there were several places that still had logic referencing suggested builders in the trusted context. This PR updates those code paths to only consider trusted builders and extracts out a shared function `IsKnownTrustedBuilder` that can be used for "is this a trusted builder" checks.
Fixes #2198

Signed-off-by: Colin Casey <casey.colin@gmail.com>
2024-07-04 16:06:55 -03:00
Natalie Arellano 423f596671 Don't cleanup the ephemeral builder if it is the original builder
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-07-02 17:22:23 -04:00
Natalie Arellano 55f7f36825 Don't create an ephemeral builder if it isn't truly needed
Fixes https://github.com/buildpacks/pack/issues/2195

Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-07-02 13:34:50 -04:00
Natalie Arellano 10aa579c15 Launch build containers in a separate ephemeral Docker bridge network
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-07-01 12:19:03 -04:00
Natalie Arellano 113ba0c94b Fix https://github.com/buildpacks/pack/issues/2164
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-05-23 11:34:55 -04:00
Natalie Arellano 89cb617380 Dedup test setup
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-05-23 09:43:56 -04:00
Natalie Arellano 08995083ff Remove unneeded things
Signed-off-by: Natalie Arellano <narellano@vmware.com>
2024-05-23 09:37:06 -04:00