feat(pkgs): add the initial set of package definitions

pkgs/bun/bun.pkg.jsonc

@@ -0,0 +1,30 @@
+// Package definition for Bun, installed from its GitHub releases.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "bun",
+  "description": "JavaScript runtime, bundler, test runner and package manager",
+  "homepage": "https://bun.sh",
+  "license": "MIT",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+  "arch_map": { "x86_64": "x64", "aarch64": "aarch64" },
+
+  "versions": { "type": "github_releases", "repo": "oven-sh/bun", "strip_prefix": "bun-v" },
+
+  "install": {
+    "type": "archive",
+    "url": "https://github.com/oven-sh/bun/releases/download/bun-v{{.Version}}/bun-{{.OS}}-{{.Arch}}.zip",
+    "checksum": {
+      "type": "sha256_url",
+      "url": "https://github.com/oven-sh/bun/releases/download/bun-v{{.Version}}/SHASUMS256.txt"
+    },
+    "strip_components": 1
+  },
+
+  // bunx is a link to bun, as Bun's own installer creates it.
+  "hooks": { "post_install": ["ln -sf bun bunx"] },
+
+  "bin": ["."],
+  "binaries": ["bun", "bunx"]
+}

pkgs/deno/deno.pkg.jsonc

@@ -0,0 +1,34 @@
+// Package definition for Deno, installed from its GitHub releases.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "deno",
+  "description": "JavaScript, TypeScript and WebAssembly runtime",
+  "homepage": "https://deno.com",
+  "license": "MIT",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+  // Rust target triples.
+  "os_map": { "darwin": "apple-darwin", "linux": "unknown-linux-gnu" },
+  "arch_map": { "x86_64": "x86_64", "aarch64": "aarch64" },
+
+  "versions": { "type": "github_releases", "repo": "denoland/deno" },
+
+  "install": {
+    "type": "archive",
+    "url": "https://github.com/denoland/deno/releases/download/v{{.Version}}/deno-{{.Arch}}-{{.OS}}.zip",
+    "checksum": { "type": "sha256_url", "url": "{{.URL}}.sha256sum" },
+    "version_overrides": [
+      {
+        // Releases before 2.0.1 published no checksums and their GitHub
+        // assets have no digest; the first install records one.
+        "versions": "<2.0.1",
+        "checksum": { "type": "none" }
+      }
+    ]
+  },
+
+  // The zip holds just the deno executable.
+  "bin": ["."],
+  "binaries": ["deno"]
+}

pkgs/go/go.pkg.jsonc

@@ -33,8 +33,13 @@
   },
 
   "bin": ["bin"],
-  "binaries": ["go", "gofmt"]
+  "binaries": ["go", "gofmt"],
 
-  // GOROOT is intentionally not set: the go binary locates its own root and
-  // upstream discourages setting it.
+  // Run the version in devbox.json even when go.mod asks for a newer
+  // toolchain, instead of downloading that one (the same default as the
+  // nixpkgs go). GOROOT is intentionally not set: the go binary locates its
+  // own root and upstream discourages setting it.
+  "env": {
+    "GOTOOLCHAIN": "local"
+  }
 }

pkgs/gradle/gradle.pkg.jsonc

@@ -0,0 +1,33 @@
+// Package definition for Gradle, installed from services.gradle.org. Gradle
+// runs on the JVM, so the project also needs java.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "gradle",
+  "description": "Build automation tool for the JVM",
+  "homepage": "https://gradle.org",
+  "license": "Apache-2.0",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+
+  // One JSON document lists every version with its download checksum.
+  "versions": {
+    "type": "http_json",
+    "url": "https://services.gradle.org/versions/all",
+    "select": ".[] | select(.snapshot or .nightly or .releaseNightly or .broken or .rcFor != \"\" or .milestoneFor != \"\" | not) | .version"
+  },
+
+  "install": {
+    "type": "archive",
+    "url": "https://services.gradle.org/distributions/gradle-{{.Version}}-bin.zip",
+    "checksum": {
+      "type": "http_json",
+      "url": "https://services.gradle.org/versions/all",
+      "select": ".[] | select(.version == \"{{.Version}}\") | .checksum"
+    },
+    "strip_components": 1
+  },
+
+  "bin": ["bin"],
+  "binaries": ["gradle"]
+}

pkgs/helm/helm.pkg.jsonc

@@ -0,0 +1,24 @@
+// Package definition for Helm, installed from get.helm.sh.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "helm",
+  "description": "The package manager for Kubernetes",
+  "homepage": "https://helm.sh",
+  "license": "Apache-2.0",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+
+  "versions": { "type": "github_releases", "repo": "helm/helm" },
+
+  "install": {
+    "type": "archive",
+    "url": "https://get.helm.sh/helm-v{{.Version}}-{{.OS}}-{{.Arch}}.tar.gz",
+    "checksum": { "type": "sha256_url", "url": "{{.URL}}.sha256sum" },
+    "strip_components": 1
+  },
+
+  // The tarball holds <os>-<arch>/helm.
+  "bin": ["."],
+  "binaries": ["helm"]
+}

pkgs/java/java.pkg.jsonc

@@ -0,0 +1,49 @@
+// Package definition for Java, installed as the Eclipse Temurin JDK from
+// Adoptium. Versions are OpenJDK version strings such as "21.0.5+11", so
+// `java@21` picks the newest Java 21 build.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "java",
+  "description": "Eclipse Temurin, the Adoptium build of the OpenJDK Java Development Kit",
+  "homepage": "https://adoptium.net",
+  "license": "GPL-2.0-with-classpath-exception",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+  "os_map": { "darwin": "mac", "linux": "linux" },
+  "arch_map": { "x86_64": "x64", "aarch64": "aarch64" },
+
+  // The API pages its results 50 at a time, newest first. Long-term
+  // support builds carry a ".0.LTS" suffix, which is dropped.
+  "versions": {
+    "type": "http_json",
+    "url": "https://api.adoptium.net/v3/info/release_versions?release_type=ga&vendor=eclipse&image_type=jdk&sort_order=DESC&page_size=50&page={{.Page}}",
+    "select": ".versions[].semver | rtrimstr(\".0.LTS\") | rtrimstr(\".LTS\")"
+  },
+
+  // Download names can't be derived from the version (respins are renamed,
+  // Java 8 uses "8u432b06"), so the artifact and its checksum come from the
+  // API's list of releases for the version's feature release. Java 8 has no
+  // build for Apple silicon; the API returns 404 and that platform is
+  // skipped.
+  "install": {
+    "type": "archive",
+    "lookup": {
+      "url": "https://api.adoptium.net/v3/assets/feature_releases/{{ index (splitList \".\" .Version) 0 }}/ga?os={{.OS}}&architecture={{.Arch}}&image_type=jdk&jvm_impl=hotspot&heap_size=normal&vendor=eclipse&page_size=50&sort_order=DESC",
+      "select": ".[] | select((.version_data.semver | rtrimstr(\".0.LTS\") | rtrimstr(\".LTS\")) == \"{{.Version}}\") | .binaries[0].package | {url: .link, checksum: .checksum}"
+    },
+    "strip_components": 1,
+    // macOS builds are bundles; the JDK is in <root>/Contents/Home.
+    "overrides": {
+      "aarch64-darwin": { "strip_components": 3 },
+      "x86_64-darwin": { "strip_components": 3 }
+    }
+  },
+
+  "bin": ["bin"],
+  "binaries": ["java", "javac", "jar"],
+
+  "env": {
+    "JAVA_HOME": "{{ .InstallDir }}"
+  }
+}

pkgs/kubectl/kubectl.pkg.jsonc

@@ -0,0 +1,24 @@
+// Package definition for kubectl, installed from the Kubernetes release
+// downloads at dl.k8s.io.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "kubectl",
+  "description": "Kubernetes command-line tool",
+  "homepage": "https://kubernetes.io/docs/reference/kubectl/",
+  "license": "Apache-2.0",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+
+  // Kubernetes releases are GitHub releases; alphas, betas and release
+  // candidates are marked as pre-releases.
+  "versions": { "type": "github_releases", "repo": "kubernetes/kubernetes" },
+
+  "install": {
+    "type": "binary",
+    "url": "https://dl.k8s.io/release/v{{.Version}}/bin/{{.OS}}/{{.Arch}}/kubectl",
+    "checksum": { "type": "sha256_url", "url": "{{.URL}}.sha256" }
+  },
+
+  "binaries": ["kubectl"]
+}

pkgs/maven/maven.pkg.jsonc

@@ -0,0 +1,34 @@
+// Package definition for Apache Maven, installed from Maven Central. Maven
+// runs on the JVM, so the project also needs java.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "maven",
+  "description": "Build automation and dependency management for Java",
+  "homepage": "https://maven.apache.org",
+  "license": "Apache-2.0",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+
+  "versions": {
+    "type": "http_json",
+    "url": "https://search.maven.org/solrsearch/select?q=g:org.apache.maven+AND+a:apache-maven&core=gav&rows=500&wt=json",
+    "select": ".response.docs[].v"
+  },
+
+  // Downloads come from Maven Central's CDN. Central only has digests for
+  // some releases, so the sha512 comes from the Apache release archive,
+  // which publishes one for every release since 3.5.
+  "install": {
+    "type": "archive",
+    "url": "https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/{{.Version}}/apache-maven-{{.Version}}-bin.tar.gz",
+    "checksum": {
+      "type": "sha512_url",
+      "url": "https://archive.apache.org/dist/maven/maven-{{ index (splitList \".\" .Version) 0 }}/{{.Version}}/binaries/apache-maven-{{.Version}}-bin.tar.gz.sha512"
+    },
+    "strip_components": 1
+  },
+
+  "bin": ["bin"],
+  "binaries": ["mvn"]
+}

pkgs/nodejs/nodejs.pkg.jsonc

@@ -0,0 +1,43 @@
+// Package definition for Node.js, installed from the official builds on
+// nodejs.org. npm ships with every release; add pnpm or yarn as their own
+// packages.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "nodejs",
+  "description": "JavaScript runtime built on Chrome's V8 engine, with npm",
+  "homepage": "https://nodejs.org",
+  "license": "MIT",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+  "arch_map": { "x86_64": "x64", "aarch64": "arm64" },
+
+  // index.json lists every release, newest first, as "v22.11.0".
+  "versions": {
+    "type": "http_json",
+    "url": "https://nodejs.org/dist/index.json",
+    "select": ".[].version | ltrimstr(\"v\")"
+  },
+
+  // Releases that predate a platform (no darwin-arm64 before 16) have no
+  // entry in SHASUMS256.txt and are skipped for that platform.
+  "install": {
+    "type": "archive",
+    "url": "https://nodejs.org/dist/v{{.Version}}/node-v{{.Version}}-{{.OS}}-{{.Arch}}.tar.gz",
+    "checksum": {
+      "type": "sha256_url",
+      "url": "https://nodejs.org/dist/v{{.Version}}/SHASUMS256.txt"
+    },
+    "strip_components": 1
+  },
+
+  "bin": ["bin"],
+  "binaries": ["node", "npm", "npx"],
+
+  // `npm install --global` writes into the project instead of the shared
+  // install, which every project using this version sees.
+  "env": {
+    "NPM_CONFIG_PREFIX": "{{ .Virtenv }}/npm-global",
+    "PATH": "{{ .Virtenv }}/npm-global/bin:$PATH"
+  }
+}

pkgs/pnpm/pnpm.pkg.jsonc

@@ -0,0 +1,43 @@
+// Package definition for pnpm, installed as the standalone executable that
+// bundles its own Node.js, so it works with or without nodejs installed.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "pnpm",
+  "description": "Fast, disk space efficient package manager",
+  "homepage": "https://pnpm.io",
+  "license": "MIT",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+  "arch_map": { "x86_64": "x64", "aarch64": "arm64" },
+
+  "versions": { "type": "github_releases", "repo": "pnpm/pnpm" },
+
+  // Since v11 every GitHub release has a tarball per platform holding the
+  // pnpm executable and its dist/ directory. GitHub records a digest for
+  // each asset.
+  "install": {
+    "type": "archive",
+    "url": "https://github.com/pnpm/pnpm/releases/download/v{{.Version}}/pnpm-{{.OS}}-{{.Arch}}.tar.gz",
+    "checksum": { "type": "github_release", "repo": "pnpm/pnpm" },
+    "version_overrides": [
+      {
+        // Before v11 the executable was published to npm as
+        // @pnpm/<macos|linux>-<arch>, and npm has a sha512 for every
+        // version. (The GitHub assets of that era have no digest.)
+        "versions": "<11",
+        "url": "https://registry.npmjs.org/@pnpm/{{ .OS | replace \"darwin\" \"macos\" }}-{{.Arch}}/-/{{ .OS | replace \"darwin\" \"macos\" }}-{{.Arch}}-{{.Version}}.tgz",
+        "checksum": {
+          "type": "http_json",
+          "url": "https://registry.npmjs.org/@pnpm/{{ .OS | replace \"darwin\" \"macos\" }}-{{.Arch}}/{{.Version}}",
+          "select": ".dist.integrity"
+        },
+        "strip_components": 1
+      }
+    ]
+  },
+
+  // Both layouts put the executable at the root of the install.
+  "bin": ["."],
+  "binaries": ["pnpm"]
+}

pkgs/python/python.pkg.jsonc

@@ -0,0 +1,50 @@
+// Package definition for CPython, installed from python-build-standalone,
+// the relocatable builds that uv and mise install. The index of builds
+// (URL and sha256 per version and platform) is the one uv maintains.
+// Format: see specs/package-definitions.md.
+{
+  "schema": 1,
+  "name": "python",
+  "description": "CPython. Devbox creates a virtual environment in $VENV_DIR (default .venv) and activates it, so pip installs stay out of the shared install. Switching versions recreates a virtual environment that Devbox created.",
+  "homepage": "https://www.python.org",
+  "license": "PSF-2.0",
+
+  "platforms": ["aarch64-darwin", "x86_64-darwin", "aarch64-linux", "x86_64-linux"],
+  "arch_map": { "x86_64": "x86_64", "aarch64": "aarch64" },
+
+  // Versions are "3.13.1", or "3.14.0a1" for pre-releases.
+  "versions": {
+    "type": "http_json",
+    "url": "https://raw.githubusercontent.com/astral-sh/uv/main/crates/uv-python-managed/download-metadata.json",
+    "select": ".[] | select(.name == \"cpython\" and .variant == null) | \"\\(.major).\\(.minor).\\(.patch)\\(.prerelease)\""
+  },
+
+  // The default build for a platform: no free-threading or debug variant,
+  // the baseline CPU level, glibc on Linux.
+  "install": {
+    "type": "archive",
+    "lookup": {
+      "url": "https://raw.githubusercontent.com/astral-sh/uv/main/crates/uv-python-managed/download-metadata.json",
+      "select": ".[] | select(.name == \"cpython\" and .variant == null and .arch.variant == null and .os == \"{{.OS}}\" and .arch.family == \"{{.Arch}}\" and (.libc == \"gnu\" or .libc == \"none\") and \"\\(.major).\\(.minor).\\(.patch)\\(.prerelease)\" == \"{{.Version}}\") | {url, checksum: .sha256}"
+    },
+    "strip_components": 1
+  },
+
+  "bin": ["bin"],
+  "binaries": ["python3", "pip3"],
+
+  "env": {
+    "VENV_DIR": "{{ .DevboxProjectDir }}/.venv"
+  },
+  "shell": {
+    "init_hook": [
+      // Create the virtual environment, or recreate it when it was made
+      // by another version installed by Devbox. Leave any other one alone.
+      // Hooks run with `set -e`, hence `|| true` when there is no venv yet.
+      "_devbox_venv_home=\"$(sed -n 's/^home = //p' \"$VENV_DIR/pyvenv.cfg\" 2>/dev/null || true)\"",
+      "case \"$_devbox_venv_home\" in \"{{ .InstallDir }}/bin\") ;; \"{{ .CacheDir }}/python/\"*) \"{{ .InstallDir }}/bin/python3\" -m venv --clear \"$VENV_DIR\" ;; *) [ -e \"$VENV_DIR\" ] || \"{{ .InstallDir }}/bin/python3\" -m venv \"$VENV_DIR\" ;; esac",
+      "if [ \"$(sed -n 's/^home = //p' \"$VENV_DIR/pyvenv.cfg\" 2>/dev/null)\" = \"{{ .InstallDir }}/bin\" ]; then . \"$VENV_DIR/bin/activate\"; else echo \"devbox: not activating $VENV_DIR because it was not created from python {{ .Version }}; remove it to have Devbox recreate it\" >&2; fi",
+      "unset _devbox_venv_home"
+    ]
+  }
+}