@vercel/container 8.2.1 → 8.3.0

package/dist/index.js

@@ -105,6 +105,9 @@ function elapsed(since) {
 function shortDigest(digest) {
   return digest.startsWith("sha256:") ? `${digest.slice(0, 19)}\u2026` : digest;
 }
+function delay(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
 async function withSpan(parent, name, attrs, fn) {
   if (!parent) {
     return fn(void 0);
@@ -517,7 +520,7 @@ function formatVcrAuthError(registry, username, detail) {
 // src/engines/types.ts
 var VCR_REGISTRY = process.env.VERCEL_VCR_REGISTRY || "vcr.vercel.com";
 var TARGET_PLATFORM = "linux/amd64";
-var DIGEST_RE = /sha256:[a-f0-9]{64}/;
+var DIGEST_RE = /^sha256:[a-f0-9]{64}$/;
 function buildArgFlags(params) {
   const flags = [];
   for (const [key, value] of Object.entries(params.buildArgs ?? {})) {
@@ -526,6 +529,161 @@ function buildArgFlags(params) {
   return flags;
 }
 
+// src/registry.ts
+async function resolveRegistryTarget(params) {
+  const token = await withSpan(
+    params.span,
+    "container.mint_oidc",
+    {},
+    (s) => resolveOidcTokenForBuild(s)
+  );
+  const claims = decodeOidcClaims(token);
+  debug(`registry token: ${tokenFingerprint(token)}`);
+  debugTokenClaims("OIDC token claims", token);
+  const username = claims.owner_id;
+  if (!username) {
+    throw new Error(
+      "VERCEL_OIDC_TOKEN is missing the `owner_id` (team id) claim required to authenticate to the container registry."
+    );
+  }
+  const fullRepository = [claims.owner, claims.project, params.repository].join(
+    "/"
+  );
+  return {
+    token,
+    claims,
+    username,
+    fullRepository,
+    imageRef: `${VCR_REGISTRY}/${fullRepository}:${params.tag}`
+  };
+}
+var MANIFEST_MEDIA_TYPES = [
+  "application/vnd.oci.image.manifest.v1+json",
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.docker.distribution.manifest.v2+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json"
+].join(", ");
+var MANIFEST_LOOKUP_ATTEMPTS = 3;
+var MANIFEST_LOOKUP_TIMEOUT_MS = 1e4;
+async function resolvePushedImageDigest(params) {
+  const fail = (reason) => new Error(
+    `Image ${params.imageRef} was pushed, but its registry digest could not be resolved: ${reason}`
+  );
+  const ref = parseTaggedImageRef(params.imageRef, params.registry);
+  if (!ref) {
+    throw fail("Expected a tagged image reference in the push registry.");
+  }
+  const url = `https://${params.registry}/v2/${ref.repository}/manifests/${encodeURIComponent(ref.tag)}`;
+  const authorization = `Basic ${Buffer.from(
+    `${params.username}:${params.token}`
+  ).toString("base64")}`;
+  let failure = "Registry request failed.";
+  for (let attempt = 1; attempt <= MANIFEST_LOOKUP_ATTEMPTS; attempt++) {
+    debug(
+      `manifest lookup (${attempt}/${MANIFEST_LOOKUP_ATTEMPTS}): HEAD ${url}`
+    );
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "HEAD",
+        headers: { authorization, accept: MANIFEST_MEDIA_TYPES },
+        redirect: "manual",
+        signal: AbortSignal.timeout(MANIFEST_LOOKUP_TIMEOUT_MS)
+      });
+    } catch (err) {
+      failure = `Registry request failed: ${describeFetchError(err)}`;
+    }
+    if (response?.ok) {
+      const digest = response.headers.get("docker-content-digest");
+      if (!digest || !DIGEST_RE.test(digest)) {
+        throw fail("Registry returned a missing or invalid manifest digest.");
+      }
+      return digest;
+    }
+    if (response) {
+      failure = `Registry returned HTTP ${response.status}.`;
+      const retryable = response.status === 404 || response.status === 429 || response.status >= 500;
+      if (!retryable) {
+        throw fail(failure);
+      }
+    }
+    debug(`manifest lookup failed: ${failure}`);
+    if (attempt < MANIFEST_LOOKUP_ATTEMPTS) {
+      await delay(500 * 2 ** (attempt - 1));
+    }
+  }
+  throw fail(failure);
+}
+function parseTaggedImageRef(imageRef, registry) {
+  const prefix = `${registry}/`;
+  if (!imageRef.startsWith(prefix)) {
+    return void 0;
+  }
+  const imagePath = imageRef.slice(prefix.length);
+  const tagSeparator = imagePath.lastIndexOf(":");
+  if (tagSeparator <= imagePath.lastIndexOf("/") || tagSeparator === imagePath.length - 1) {
+    return void 0;
+  }
+  return {
+    repository: imagePath.slice(0, tagSeparator),
+    tag: imagePath.slice(tagSeparator + 1)
+  };
+}
+function describeFetchError(err) {
+  const error = err;
+  const cause = error.cause?.message;
+  return cause ? `${error.message} (${cause})` : error.message;
+}
+async function ensureRepository(repository, token, claims, span) {
+  if (repository.includes("/")) {
+    debug(`skipping repository auto-create (fully-qualified "${repository}")`);
+    span?.setAttributes({ "repository.create_result": "skipped_qualified" });
+    return;
+  }
+  const teamId = claims.owner_id;
+  const projectId = claims.project_id;
+  if (!teamId || !projectId) {
+    debug(
+      `skipping repository auto-create (missing ${!teamId ? "team id" : "project id"})`
+    );
+    span?.setAttributes({
+      "repository.create_result": "skipped_missing_ids"
+    });
+    return;
+  }
+  span?.setAttributes({ "team.id": teamId, "project.id": projectId });
+  const apiUrl = (readString(process.env.VERCEL_API_URL) ?? "https://api.vercel.com").replace(/\/+$/, "");
+  const url = `${apiUrl}/v1/vcr/repository?teamId=${encodeURIComponent(teamId)}`;
+  const body = JSON.stringify({ name: repository, projectId });
+  step(`Ensuring registry repository "${repository}"`);
+  debug(`repository create: POST ${url}`);
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body
+    });
+    span?.setAttributes({ "repository.create_status": toTag(res.status) });
+    if (res.ok) {
+      span?.setAttributes({ "repository.create_result": "created" });
+      done(`created repository "${repository}"`);
+    } else if (res.status === 409) {
+      span?.setAttributes({ "repository.create_result": "already_exists" });
+      done(`repository "${repository}" already exists`);
+    } else {
+      span?.setAttributes({ "repository.create_result": "unexpected_status" });
+      done("continuing \u2014 push will validate the repository");
+    }
+  } catch (err) {
+    debug(`repository auto-create failed: ${err.message}`);
+    span?.setAttributes({ "repository.create_result": "error" });
+    done("continuing \u2014 push will validate the repository");
+  }
+}
+
 // src/engines/buildah.ts
 async function runBuildah(args, opts = {}) {
   const storageArgs = await buildahStorageArgs();
@@ -693,6 +851,7 @@ ${stderr}`);
       `pushing ${params.imageRef} ` + (zstdEnabled ? "with zstd compression (level=3, force, oci)" : "with default compression (zstd disabled)")
     );
     const pushStart = Date.now();
+    let digest;
     try {
       await runBuildah([
         "push",
@@ -701,12 +860,7 @@ ${stderr}`);
         digestFile,
         params.imageRef
       ]);
-      const digest = (0, import_node_fs3.readFileSync)(digestFile, "utf8").trim();
-      const resolved = digest.match(/sha256:[a-f0-9]{64}/)?.[0] ?? (digest || void 0);
-      debug(
-        `push completed in ${Date.now() - pushStart}ms` + (resolved ? ` (digest ${resolved})` : "")
-      );
-      return resolved;
+      digest = readDigestFile(digestFile);
     } catch (err) {
       const message = err.message;
       if (/denied|forbidden|unauthorized|not found|401|403|404/i.test(message)) {
@@ -726,8 +880,25 @@ ${stderr}`);
     } finally {
       (0, import_node_fs3.rmSync)(digestDir, { recursive: true, force: true });
     }
+    debug(`push completed in ${Date.now() - pushStart}ms`);
+    if (DIGEST_RE.test(digest)) {
+      debug(`pushed digest ${digest}`);
+      return digest;
+    }
+    debug(
+      `--digestfile did not contain a digest (${JSON.stringify(digest)}) \u2014 resolving registry manifest`
+    );
+    return resolvePushedImageDigest(params);
   }
 };
+function readDigestFile(path4) {
+  try {
+    return (0, import_node_fs3.readFileSync)(path4, "utf8").trim();
+  } catch (err) {
+    debug(`could not read --digestfile: ${err.message}`);
+    return "";
+  }
+}
 
 // src/engines/docker.ts
 var import_node_child_process2 = require("child_process");
@@ -989,22 +1160,12 @@ ${version2.trim()}`);
     }
   },
   async push(params) {
+    let output;
     try {
       info(`pushing ${params.imageRef}`);
       const pushStart = Date.now();
-      const { stdout } = await runDocker(["push", params.imageRef]);
+      output = await runDocker(["push", params.imageRef]);
       debug(`push completed in ${Date.now() - pushStart}ms`);
-      let resolvedDigest = stdout.match(/sha256:[a-f0-9]{64}/)?.[0];
-      if (!resolvedDigest) {
-        debug("digest not found in push output \u2014 inspecting RepoDigests");
-        const inspect = await run(
-          "docker",
-          ["inspect", "--format", "{{index .RepoDigests 0}}", params.imageRef],
-          { quiet: true }
-        );
-        resolvedDigest = inspect.stdout.match(/sha256:[a-f0-9]{64}/)?.[0];
-      }
-      return resolvedDigest;
     } catch (err) {
       const message = err.message;
       if (/denied|forbidden|unauthorized|not found|401|403|404/i.test(message)) {
@@ -1022,6 +1183,13 @@ ${version2.trim()}`);
       }
       throw err;
     }
+    const summary = /^[^\s:]+: digest: (sha256:[a-f0-9]{64}) size: \d+\s*$/m;
+    const digest = output.stdout.match(summary)?.[1] ?? output.stderr.match(summary)?.[1];
+    if (digest) {
+      return digest;
+    }
+    debug("digest not found in push summary \u2014 resolving registry manifest");
+    return resolvePushedImageDigest(params);
   }
 };
 
@@ -1042,84 +1210,6 @@ var import_node_fs10 = require("fs");
 var import_node_os7 = require("os");
 var import_node_path10 = require("path");
 
-// src/registry.ts
-async function resolveRegistryTarget(params) {
-  const token = await withSpan(
-    params.span,
-    "container.mint_oidc",
-    {},
-    (s) => resolveOidcTokenForBuild(s)
-  );
-  const claims = decodeOidcClaims(token);
-  debug(`registry token: ${tokenFingerprint(token)}`);
-  debugTokenClaims("OIDC token claims", token);
-  const username = claims.owner_id;
-  if (!username) {
-    throw new Error(
-      "VERCEL_OIDC_TOKEN is missing the `owner_id` (team id) claim required to authenticate to the container registry."
-    );
-  }
-  const fullRepository = [claims.owner, claims.project, params.repository].join(
-    "/"
-  );
-  return {
-    token,
-    claims,
-    username,
-    fullRepository,
-    imageRef: `${VCR_REGISTRY}/${fullRepository}:${params.tag}`
-  };
-}
-async function ensureRepository(repository, token, claims, span) {
-  if (repository.includes("/")) {
-    debug(`skipping repository auto-create (fully-qualified "${repository}")`);
-    span?.setAttributes({ "repository.create_result": "skipped_qualified" });
-    return;
-  }
-  const teamId = claims.owner_id;
-  const projectId = claims.project_id;
-  if (!teamId || !projectId) {
-    debug(
-      `skipping repository auto-create (missing ${!teamId ? "team id" : "project id"})`
-    );
-    span?.setAttributes({
-      "repository.create_result": "skipped_missing_ids"
-    });
-    return;
-  }
-  span?.setAttributes({ "team.id": teamId, "project.id": projectId });
-  const apiUrl = (readString(process.env.VERCEL_API_URL) ?? "https://api.vercel.com").replace(/\/+$/, "");
-  const url = `${apiUrl}/v1/vcr/repository?teamId=${encodeURIComponent(teamId)}`;
-  const body = JSON.stringify({ name: repository, projectId });
-  step(`Ensuring registry repository "${repository}"`);
-  debug(`repository create: POST ${url}`);
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/json"
-      },
-      body
-    });
-    span?.setAttributes({ "repository.create_status": toTag(res.status) });
-    if (res.ok) {
-      span?.setAttributes({ "repository.create_result": "created" });
-      done(`created repository "${repository}"`);
-    } else if (res.status === 409) {
-      span?.setAttributes({ "repository.create_result": "already_exists" });
-      done(`repository "${repository}" already exists`);
-    } else {
-      span?.setAttributes({ "repository.create_result": "unexpected_status" });
-      done("continuing \u2014 push will validate the repository");
-    }
-  } catch (err) {
-    debug(`repository auto-create failed: ${err.message}`);
-    span?.setAttributes({ "repository.create_result": "error" });
-    done("continuing \u2014 push will validate the repository");
-  }
-}
-
 // src/buildpacks/lifecycle/lifecycle.ts
 var import_build_utils3 = require("@vercel/build-utils");
 var import_node_crypto2 = require("crypto");
@@ -1154,6 +1244,28 @@ var LIFECYCLE = {
   url: `${BUILDPACK_DIST_BASE_URL}/lifecycle/${LIFECYCLE_VERSION}/lifecycle-v${LIFECYCLE_VERSION}-linux-x86-64.tgz`,
   sha256: distribution.lifecycle.sha256
 };
+var PRERELEASE_URL_ENV = "VERCEL_BUILDPACK_PRERELEASE_URL";
+var SHA256_RE = /^[0-9a-f]{64}$/;
+var ARTIFACT_PREFIX = "vercel-";
+var ARTIFACT_SUFFIX = ".cnb";
+var ARTIFACT_NAME_RE = /^[A-Za-z0-9_-]+$/;
+var ARTIFACT_VERSION_RE = /^\d+\.\d+\.\d+$/;
+function artifactFileName(name, version2) {
+  return `${ARTIFACT_PREFIX}${name}-${version2}${ARTIFACT_SUFFIX}`;
+}
+function parseArtifactFileName(fileName) {
+  if (!fileName.startsWith(ARTIFACT_PREFIX) || !fileName.endsWith(ARTIFACT_SUFFIX)) {
+    return void 0;
+  }
+  const inner = fileName.slice(ARTIFACT_PREFIX.length, -ARTIFACT_SUFFIX.length);
+  const separator = inner.lastIndexOf("-");
+  const name = separator > 0 ? inner.slice(0, separator) : "";
+  const version2 = separator > 0 ? inner.slice(separator + 1) : "";
+  if (!ARTIFACT_NAME_RE.test(name) || !ARTIFACT_VERSION_RE.test(version2)) {
+    return void 0;
+  }
+  return { name, version: version2 };
+}
 function vercelBuildpack(name) {
   const pinned = distribution.buildpacks[name];
   if (!pinned) {
@@ -1166,10 +1278,69 @@ function vercelBuildpack(name) {
 function vercelBuildpackArtifact(buildpack) {
   const { name, version: version2 } = buildpack;
   return {
-    url: `${BUILDPACK_DIST_BASE_URL}/buildpacks/${name}/${version2}/vercel-${name}-${version2}.cnb`,
+    url: buildpack.url ?? `${BUILDPACK_DIST_BASE_URL}/buildpacks/${name}/${version2}/${artifactFileName(name, version2)}`,
     sha256: buildpack.sha256
   };
 }
+function parseArchiveUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`${PRERELEASE_URL_ENV} must be an https .cnb archive URL.`);
+  }
+  const fileName = url.pathname.split("/").at(-1) ?? "";
+  const artifact = parseArtifactFileName(fileName);
+  if (url.protocol !== "https:" || !artifact) {
+    throw new Error(
+      `${PRERELEASE_URL_ENV} must be a plain https URL ending in vercel-<name>-<version>.cnb.`
+    );
+  }
+  return {
+    url: url.href,
+    fileName,
+    name: artifact.name,
+    version: artifact.version
+  };
+}
+function getPrereleaseUrl(env = process.env) {
+  const value = env[PRERELEASE_URL_ENV]?.trim();
+  return value ? parseArchiveUrl(value).url : void 0;
+}
+async function withPrereleaseBuildpack(buildpack, archiveUrl) {
+  const archive = parseArchiveUrl(archiveUrl);
+  const entry = buildpack.buildpacks.find(
+    (candidate) => candidate.name === archive.name && candidate.id === `vercel/${archive.name}`
+  );
+  if (!entry) {
+    throw new Error(
+      `Pre-release archive ${archive.url} does not match a buildpack in the ${buildpack.runtime} runtime.`
+    );
+  }
+  const checksumUrlObj = new URL(archive.url);
+  checksumUrlObj.pathname += ".sha256";
+  const checksumUrl = checksumUrlObj.href;
+  const response = await fetch(checksumUrl);
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch pre-release checksum ${checksumUrl}: HTTP ${response.status} ${response.statusText}`
+    );
+  }
+  const fields = (await response.text()).trim().split(/\s+/);
+  const [sha256, fileName] = fields;
+  if (fields.length !== 2 || !SHA256_RE.test(sha256) || fileName !== archive.fileName) {
+    throw new Error(
+      `Invalid pre-release checksum ${checksumUrl}: expected a SHA-256 checksum for ${archive.fileName}.`
+    );
+  }
+  info(`Using pre-release ${entry.id}@${archive.version}: ${archive.url}`);
+  return {
+    ...buildpack,
+    buildpacks: buildpack.buildpacks.map(
+      (candidate) => candidate === entry ? { ...entry, version: archive.version, sha256, url: archive.url } : candidate
+    )
+  };
+}
 
 // src/buildpacks/lifecycle/lifecycle.ts
 var BUILD_USER_ID = 1001;
@@ -1340,22 +1511,6 @@ function cnbRegistryAuth(credentials) {
   const basic = Buffer.from(`${username}:${token}`).toString("base64");
   return JSON.stringify({ [registry]: `Basic ${basic}` });
 }
-function assertPublishedArchive(name, archive) {
-  if (/^0{64}$/.test(archive.sha256)) {
-    throw new Error(
-      `The ${name} archive has not been published. Publish it and update its checksum in distribution.json.`
-    );
-  }
-}
-function assertPublishedDistribution(buildpack) {
-  assertPublishedArchive("CNB lifecycle", LIFECYCLE);
-  for (const entry of buildpack.buildpacks) {
-    assertPublishedArchive(
-      `${entry.id}@${entry.version} buildpack`,
-      vercelBuildpackArtifact(entry)
-    );
-  }
-}
 function distributionUrls(buildpack) {
   return {
     lifecycle: LIFECYCLE.url,
@@ -1525,7 +1680,6 @@ var buildAndPushWithLifecycle = async (buildpack, params, span) => {
       "image.ref": params.imageRef
     },
     async (lifecycleSpan) => {
-      assertPublishedDistribution(buildpack);
       const suffix = `${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}`;
       const buildContainer = `vercel-cnb-${buildpack.runtime}-${suffix}`;
       let cnbDir;
@@ -1719,7 +1873,6 @@ var buildAndPushWithLifecycleDocker = async (buildpack, params, span) => {
       "image.ref": params.imageRef
     },
     async (lifecycleSpan) => {
-      assertPublishedDistribution(buildpack);
       let stageDir;
       const containers = [];
       try {
@@ -2048,7 +2201,9 @@ async function buildAndPushBuildpack(params) {
         `The ${params.buildpack.runtime} buildpack was selected, but no supported project marker was found in the service sources. Add ${params.buildpack.projectMarkers.join(" or ")}, or add a Dockerfile.vercel to control the image build.`
       );
     }
-    const image = await params.buildpack.resolveImage(sourceDir);
+    const prereleaseUrl = getPrereleaseUrl();
+    const buildpack = prereleaseUrl ? await withPrereleaseBuildpack(params.buildpack, prereleaseUrl) : params.buildpack;
+    const image = await buildpack.resolveImage(sourceDir);
     const nodeToolchain = engine.name === "buildah" ? await resolveNodeToolchain(sourceDir, params.config, params.meta) : await resolveLocalNodeToolchain(
       sourceDir,
       params.config,
@@ -2058,9 +2213,10 @@ async function buildAndPushBuildpack(params) {
       params.parentSpan,
       "container.buildpack.build_and_push",
       {
-        "buildpack.runtime": params.buildpack.runtime,
+        "buildpack.runtime": buildpack.runtime,
         "buildpack.runtime_version": image.version,
         "buildpack.node_version": nodeToolchain?.version,
+        "buildpack.prerelease_url": prereleaseUrl,
         "container.engine": engine.name,
         "container.repository": params.repository
       },
@@ -2118,7 +2274,7 @@ async function buildAndPushBuildpack(params) {
           );
           const runLifecycle = engine.name === "buildah" ? buildAndPushWithLifecycle : buildAndPushWithLifecycleDocker;
           const result = await runLifecycle(
-            params.buildpack,
+            buildpack,
             {
               workPath: sourceDir,
               image,
@@ -2767,16 +2923,14 @@ async function buildAndPushImage(params) {
           { "image.ref": imageRef },
           () => engine.push(buildParams)
         );
-        done(
-          digest ? `pushed ${shortDigest(digest)} in ${elapsed(pushStart)}` : `pushed in ${elapsed(pushStart)}`
-        );
+        done(`pushed ${shortDigest(digest)} in ${elapsed(pushStart)}`);
         await withSpan(
           buildSpan,
           "container.report_storage",
           { "container.engine": engine.name },
           (s) => engine.reportStorage?.(s) ?? Promise.resolve()
         );
-        const resolvedRef = digest ? `${VCR_REGISTRY}/${fullRepository}@${digest}` : imageRef;
+        const resolvedRef = `${VCR_REGISTRY}/${fullRepository}@${digest}`;
         buildSpan?.setAttributes({
           "image.digest": digest,
           "image.resolved_ref": resolvedRef

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/container",
-  "version": "8.2.1",
+  "version": "8.3.0",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
   "homepage": "https://vercel.com/docs",
@@ -31,7 +31,7 @@
     "build": "node ../../utils/build-builder.mjs",
     "type-check": "tsc --noEmit",
     "test": "vitest run --config ../../vitest.config.mts",
-    "test-unit": "vitest run --config ../../vitest.config.mts test/unit.test.ts test/diagnostics.test.ts test/workspace.test.ts test/lifecycle-docker.test.ts test/ruby-version.test.ts",
+    "test-unit": "vitest run --config ../../vitest.config.mts test/unit.test.ts test/diagnostics.test.ts test/workspace.test.ts test/lifecycle-docker.test.ts test/ruby-version.test.ts test/docker-push.test.ts",
     "test-e2e": "vitest run --config ../../vitest.config.mts test/e2e.test.ts"
   }
 }