@platforma-sdk/package-builder-lib 1.4.0 → 1.4.2

package/dist/defaults.d.ts

@@ -22,6 +22,5 @@ export declare const DEV_DOCKER_REGISTRY = "public.ecr.aws/miresearch/pl-contain
 export declare const DEV_DOCKER_PUSH_TARGET = "ecr://public.ecr.aws/miresearch/pl-containers";
 export declare const AWS_DEV_PROFILE = "research-poweruser";
 export declare const DOCKER_BUILD_PLATFORM = "linux/amd64";
-//#endregion
 export { defaults_d_exports };
 //# sourceMappingURL=defaults.d.ts.map

package/dist/defaults.js

@@ -1,5 +1,5 @@
 import { __exportAll } from "./_virtual/_rolldown/runtime.js";
-//#region src/defaults.ts
+// src/defaults.ts
 var defaults_exports = /* @__PURE__ */ __exportAll({
 	AWS_DEV_PROFILE: () => AWS_DEV_PROFILE,
 	BIN_REGISTRY_DOWNLOAD_URL: () => BIN_REGISTRY_DOWNLOAD_URL,
@@ -42,7 +42,6 @@ const DEV_DOCKER_REGISTRY = "public.ecr.aws/miresearch/pl-containers";
 const DEV_DOCKER_PUSH_TARGET = `ecr://${DEV_DOCKER_REGISTRY}`;
 const AWS_DEV_PROFILE = "research-poweruser";
 const DOCKER_BUILD_PLATFORM = "linux/amd64";
-//#endregion
 export { AWS_DEV_PROFILE, BIN_REGISTRY_DOWNLOAD_URL, BIN_REGISTRY_NAME, CONDA_DATA_LOCATION, CONDA_DOCKER_BASE_IMAGE, CONDA_FROZEN_ENV_SPEC_FILE, CONDA_MICROMAMBA_VERSION, CONDA_SOURCE_ENV_SPEC_FILE, DEV_BINARY_UPLOAD_TARGET, DEV_BIN_REGISTRY_NAME, DEV_DOCKER_PUSH_TARGET, DEV_DOCKER_REGISTRY, DOCKER_BUILD_PLATFORM, DOCKER_DOCKERFILE, DOCKER_PLACEHOLDER_PKG, DOCKER_REGISTRY, NO_SOFTWARE_PLACEHOLDER, PYTHON_DOCKER_BASE_IMAGE, PYTHON_REQUIREMENTS_FILE, defaults_exports };
 
 //# sourceMappingURL=defaults.js.map

package/dist/index.cjs

@@ -5,11 +5,10 @@ const require_util = require("./core/util.cjs");
 const require_docker_coverage = require("./core/docker-coverage.cjs");
 const require_core = require("./core/core.cjs");
 const require_push_guard = require("./core/push-guard.cjs");
-//#region src/index.ts
+// src/index.ts
 function createBuilder(logger, opts) {
 	return new require_core.Core(logger, opts);
 }
-//#endregion
 exports.assertDockerCoverage = require_docker_coverage.assertDockerCoverage;
 exports.assertDockerPushIntent = require_push_guard.assertDockerPushIntent;
 exports.createBuilder = createBuilder;

package/dist/index.d.ts

@@ -5,7 +5,6 @@ import { defaults_d_exports } from "./defaults.js";
 import { PushIntent, assertDockerPushIntent } from "./core/push-guard.js";
 import { DockerCoverage, assertDockerCoverage, descriptorHasNoDockerVariant, softwareEntrypointsWithoutDocker } from "./core/docker-coverage.js";
 import winston from "winston";
-//#region src/index.d.ts
 /** The logger the engine and its callers pass around. */
 export type Logger = winston.Logger;
 /**
@@ -18,6 +17,5 @@ export type Builder = Pick<Core, "buildMode" | "targetPlatform" | "allPlatforms"
 export declare function createBuilder(logger: winston.Logger, opts?: {
   packageRoot?: string;
 }): Builder;
-//#endregion
 export { type DockerCoverage, type PushIntent, assertDockerCoverage, assertDockerPushIntent, defaults_d_exports as defaults, descriptorHasNoDockerVariant, envs_d_exports as envs, softwareEntrypointsWithoutDocker, util_d_exports as util };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;;;YAeY,SAAS,QAAQ;;;;;;;YAQjB,UAAU,KACpB;wBAiBc,cAAc,QAAQ,QAAQ,QAAQ;EAAS;IAAyB"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;;YAeY,SAAS,QAAQ;;;;;;;YAQjB,UAAU,KACpB;wBAiBc,cAAc,QAAQ,QAAQ,QAAQ;EAAS;IAAyB"}

package/dist/index.js

@@ -4,11 +4,10 @@ import { util_exports } from "./core/util.js";
 import { assertDockerCoverage, descriptorHasNoDockerVariant, softwareEntrypointsWithoutDocker } from "./core/docker-coverage.js";
 import { Core } from "./core/core.js";
 import { assertDockerPushIntent } from "./core/push-guard.js";
-//#region src/index.ts
+// src/index.ts
 function createBuilder(logger, opts) {
 	return new Core(logger, opts);
 }
-//#endregion
 export { assertDockerCoverage, assertDockerPushIntent, createBuilder, defaults_exports as defaults, descriptorHasNoDockerVariant, envs_exports as envs, softwareEntrypointsWithoutDocker, util_exports as util };
 
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platforma-sdk/package-builder-lib",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "MiLaboratories Platforma Package builder engine (library)",
   "keywords": [],
   "license": "UNLICENSED",
@@ -21,26 +21,31 @@
     }
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "3.859.0",
-    "@aws-sdk/lib-storage": "3.859.0",
+    "@aws-sdk/client-s3": "3.1157.0",
+    "@aws-sdk/lib-storage": "3.1157.0",
+    "@milaboratories/resolve-helper": "1.1.3",
     "archiver": "^7.0.1",
-    "undici": "~7.16.0",
+    "undici": "~7.30.1",
     "winston": "^3.17.0",
-    "yaml": "^2.8.0",
-    "zod": "~3.25.76",
-    "@milaboratories/resolve-helper": "1.1.3"
+    "yaml": "^2.9.1",
+    "zod": "~3.25.76"
   },
   "devDependencies": {
-    "@platforma-open/milaboratories.runenv-python-3": "1.11.4",
+    "@milaboratories/build-configs": "2.0.2",
+    "@milaboratories/ts-builder": "1.7.3",
+    "@milaboratories/ts-configs": "1.4.0",
+    "@platforma-open/milaboratories.runenv-python-3": "1.16.1",
     "@types/archiver": "^6.0.3",
-    "@types/node": "~24.5.2",
-    "@vitest/coverage-istanbul": "^4.1.3",
+    "@types/node": "~24.19.2",
+    "@vitest/coverage-istanbul": "^4.1.12",
     "typescript": "7.0.2",
-    "vite": "^8.0.6",
-    "vitest": "^4.1.3",
-    "@milaboratories/ts-configs": "1.4.0",
-    "@milaboratories/build-configs": "2.0.1",
-    "@milaboratories/ts-builder": "1.7.2"
+    "vite": "^8.3.5",
+    "vitest": "^4.1.12"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/milaboratory/platforma.git",
+    "directory": "lib/node/package-builder-lib"
   },
   "scripts": {
     "build": "ts-builder build --target node",

package/src/core/__tests__/docker-build.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect, afterEach, vi } from "vitest";
+
+const { spawnMock } = vi.hoisted(() => ({ spawnMock: vi.fn() }));
+vi.mock("node:child_process", () => ({ spawnSync: spawnMock }));
+
+const docker = await import("../docker");
+
+afterEach(() => {
+  vi.clearAllMocks();
+  vi.unstubAllEnvs();
+});
+
+function runBuild() {
+  spawnMock.mockReturnValue({ status: 0 });
+  docker.build("/ctx", "/ctx/Dockerfile", "local:tag", "pkg/main", "1.0.0");
+  expect(spawnMock).toHaveBeenCalledTimes(1);
+  const [cmd, args, opts] = spawnMock.mock.calls[0] as [
+    string,
+    string[],
+    { env: NodeJS.ProcessEnv },
+  ];
+  return { cmd, args, env: opts.env };
+}
+
+describe("docker.build", () => {
+  it("passes no buildx-only attestation flags, so podman accepts the command", () => {
+    const { cmd, args } = runBuild();
+    expect(cmd).toBe("docker");
+    expect(args[0]).toBe("build");
+    expect(args.some((a) => a.startsWith("--provenance") || a.startsWith("--sbom"))).toBe(false);
+  });
+
+  it("disables buildx default attestations through the environment", () => {
+    const { env } = runBuild();
+    expect(env.BUILDX_NO_DEFAULT_ATTESTATIONS).toBe("1");
+  });
+
+  it("overrides a user value that would enable default attestations", () => {
+    vi.stubEnv("BUILDX_NO_DEFAULT_ATTESTATIONS", "0");
+    const { env } = runBuild();
+    expect(env.BUILDX_NO_DEFAULT_ATTESTATIONS).toBe("1");
+  });
+
+  it("pins the build platform", () => {
+    const { args } = runBuild();
+    expect(args.slice(args.indexOf("--platform"), args.indexOf("--platform") + 2)).toEqual([
+      "--platform",
+      "linux/amd64",
+    ]);
+  });
+});

package/src/core/conda/builder.ts

@@ -326,7 +326,7 @@ async function downloadFile(
 
   let redirCount = 0;
   let attempt = 0;
-  for (; attempt <= maxAttempts; ) {
+  for (; attempt <= maxAttempts;) {
     attempt++;
 
     logger.debug(`Trying to download: ${url}`);

package/src/core/docker.ts

@@ -114,13 +114,6 @@ export function build(
       // regardless of host arch (cross-compile via qemu on non-x64 hosts).
       "--platform",
       defaults.DOCKER_BUILD_PLATFORM,
-      // Disable buildkit's SLSA provenance + SBOM attestations. They embed
-      // build-time timestamps into the manifest list, which produces a fresh
-      // image digest on every build of identical source. That breaks the
-      // content-addressable tag scheme (every dev rebuild re-pushes a new
-      // tag) and defeats publishDockerImage's `remoteImageExists` smart-skip.
-      "--provenance=false",
-      "--sbom=false",
       "-t",
       tag,
       context,
@@ -138,6 +131,8 @@ export function build(
       env: {
         ...process.env, // PATH variable from parent process affects execution
         HOME: process.env.HOME || os.homedir(), // Ensure HOME is set
+        // Disables buildx default provenance so the image ID stays stable; podman ignores it.
+        BUILDX_NO_DEFAULT_ATTESTATIONS: "1",
       },
     },
   );