feat(pkgdef): support the initial package set

internal/devbox/packages.go

@@ -349,6 +349,15 @@ func (d *Devbox) ensureStateIsUpToDate(ctx context.Context, mode installMode) er
 		if err := d.installPackages(ctx, mode); err != nil {
 			return err
 		}
+		// Installing resolves package definitions that had no lockfile
+		// entry yet, for example after their version was changed in
+		// devbox.json. Their env, init hooks and created files depend on
+		// the entry, so reload includes to apply them in this run.
+		if lo.ContainsBy(d.InstallablePackages(), (*devpkg.Package).IsPkgDef) {
+			if err := d.cfg.LoadRecursive(d.lockfile); err != nil {
+				return err
+			}
+		}
 	}
 
 	recomputeState := mode == ensure || d.IsEnvEnabled()

internal/devbox/pkgdef.go

@@ -5,6 +5,8 @@ package devbox
 
 import (
 	"context"
+	"maps"
+	"slices"
 	"strings"
 
 	"github.com/samber/lo"
@@ -70,16 +72,27 @@ func (d *Devbox) installPkgDef(ctx context.Context, pkg *devpkg.Package, recordD
 	}
 
 	artifact := pkgdef.Artifact{}
-	if info := locked.Systems[system]; info != nil {
-		artifact = pkgdef.Artifact{URL: info.URL, Sha256: info.Sha256}
+	info := locked.Systems[system]
+	if info == nil && len(locked.Systems) > 0 {
+		// The lockfile lists the systems the vendor publishes this version
+		// for, and this is not one of them.
+		return nil, usererr.New(
+			"Package %s resolved to %s@%s, which %s does not publish for %s (it is available for %s). "+
+				"Pick another version, or run `devbox add %s --exclude-platform %s` to skip it on this machine.",
+			pkg.Raw, def.Name, locked.Version, def.Name, system,
+			strings.Join(slices.Sorted(maps.Keys(locked.Systems)), ", "), pkg.Raw, system,
+		)
+	}
+	if info != nil {
+		artifact = pkgdef.Artifact{URL: info.URL, Sha256: info.Sha256, Sha512: info.Sha512}
 	}
 
 	if !client.IsInstalled(def, locked.Version, system) {
 		ux.Finfof(d.stderr, "Installing %s@%s from %s\n", def.Name, locked.Version, lo.Ternary(artifact.URL != "", artifact.URL, ref.Source))
 		if def.UsesScripts() {
 			ux.Fwarningf(d.stderr, "Package definition %s runs shell commands while installing.\n", ref.Source)
 		}
-		if artifact.Sha256 == "" {
+		if !artifact.HasDigest() {
 			ux.Fwarningf(d.stderr, "Package definition %s has no checksum for %s; the digest of this download will be recorded in devbox.lock.\n", ref.Source, system)
 		}
 	}
@@ -91,7 +104,7 @@ func (d *Devbox) installPkgDef(ctx context.Context, pkg *devpkg.Package, recordD
 
 	// Trust on first use: record the digest we observed so every other
 	// machine verifies against it.
-	if recordDigest && artifact.Sha256 == "" && installed.Sha256 != "" {
+	if recordDigest && !artifact.HasDigest() && installed.Sha256 != "" {
 		if err := d.lockfile.SetArtifactForPackage(pkg.Raw, system, installed.URL, installed.Sha256); err != nil {
 			return nil, err
 		}

internal/lock/package.go

@@ -33,11 +33,12 @@ type Package struct {
 type SystemInfo struct {
 	Outputs []Output `json:"outputs,omitempty"`
 
-	// URL and Sha256 locate and verify the vendor artifact for packages
-	// with Source "pkg-def". Sha256 may be empty until the first install
-	// records it.
+	// URL and Sha256 or Sha512 locate and verify the vendor artifact for
+	// packages with Source "pkg-def". Both digests may be empty until the
+	// first install records a sha256.
 	URL    string `json:"url,omitempty"`
 	Sha256 string `json:"sha256,omitempty"`
+	Sha512 string `json:"sha512,omitempty"`
 
 	// Legacy Format
 	StorePath             string `json:"store_path,omitempty"`
@@ -125,7 +126,8 @@ func (i *SystemInfo) Equals(other *SystemInfo) bool {
 
 	return slices.Equal(i.Outputs, other.Outputs) &&
 		i.URL == other.URL &&
-		i.Sha256 == other.Sha256
+		i.Sha256 == other.Sha256 &&
+		i.Sha512 == other.Sha512
 }
 
 // If we have a StorePath and no Outputs, we need to convert to the new format.

internal/lock/pkgdef.go

@@ -51,13 +51,15 @@ func (f *File) resolvePkgDef(ctx context.Context, raw string, refresh bool) (*Pa
 		DefinitionHash: loaded.Hash,
 		Systems:        make(map[string]*SystemInfo, len(resolved.Artifacts)),
 	}
+	// Systems the vendor publishes no artifact for are absent from
+	// Systems; installing on one of them is an error.
 	for system, artifact := range resolved.Artifacts {
-		info := &SystemInfo{URL: artifact.URL, Sha256: artifact.Sha256}
+		info := &SystemInfo{URL: artifact.URL, Sha256: artifact.Sha256, Sha512: artifact.Sha512}
 		// A definition without a checksum source gets its digest recorded
 		// by the first install (trust on first use). Keep that digest when
 		// re-resolving to the same artifact so `devbox update` doesn't
 		// throw it away.
-		if info.Sha256 == "" && existing != nil && existing.Version == resolved.Version {
+		if !artifact.HasDigest() && existing != nil && existing.Version == resolved.Version {
 			if old := existing.Systems[system]; old != nil && old.URL == artifact.URL {
 				info.Sha256 = old.Sha256
 			}