bryan-minimal · Oct 22, 2026 · Oct 16, 2026 · Oct 22, 2026 · Oct 22, 2026
@@ -0,0 +1,95 @@
+let { Attrs, BuildSpec, Local, Needs, OutputBin, OutputData, Source, Test, .. } = import "minimal.ncl" in
+let base = import "../base/build.ncl" in
+let bash = import "../bash/build.ncl" in
+let coreutils = import "../coreutils/build.ncl" in
+let jdk = import "../jdk/build.ncl" in
+
+let version = "0.142.0" in
+{
+  name = "jbang",
+  # JBang runs single-file Java programs (`jbang hello.java`), resolving any
+  # `//DEPS` from Maven Central. The platform-independent bundle is a bash
+  # launcher plus one jar.
+  #
+  # Prebuilt, not built from source: jbang builds with Gradle and resolves its
+  # dependencies from Maven Central, so a hermetic source build is not possible
+  # today. Same shape as maven / gradle / jdtls.
+  build_deps = [
+    { file = "build.sh" } | Local,
+    {
+      url = "https://github.com/jbangdev/jbang/releases/download/v%{version}/jbang-%{version}.tar",
+      sha256 = "43aaeb9bc30d9331ed57952a872b80dab3dafe8e927f0f7a90a3c8e67d08eaac",
+    } | Source,
+    base,
+  ],
+  runtime_deps = [
+    bash, # bin/jbang is a bash script (#!/usr/bin/env bash, BASH_SOURCE, [[ ]])
+    coreutils, # env, uname, dirname, readlink in the launcher
+    jdk, # the wrapper pins JAVA_HOME here so jbang never downloads a JDK
+  ],
+  # Not for jbang's own build (that is offline): this is the abstract network
+  # dep a package that builds WITH jbang inherits. jbang's job is resolving
+  # `//DEPS` from Maven Central (and, for `//JAVA <n>` other than the packaged
+  # jdk, downloading a JDK), like curl/go/pnpm/uv. A script with no `//DEPS`
+  # runs fully offline; see the run_script test.
+  needs =
+    {
+      dns = {},
+      internet = {},
+    } | Needs,
+
+  cmd = "./build.sh",
+  build_args = {
+    include version,
+  },
+
+  outputs = {
+    jbang = { glob = "usr/bin/jbang" } | OutputBin,
+    launcher = { glob = "usr/share/jbang/bin/jbang" } | OutputBin,
+    jbang_home = { glob = "usr/share/jbang/**", allow_executable = true } | OutputData,
+  },
+
+  attrs =
+    {
+      upstream_version = version,
+      license_spdx = "MIT",
+      binary_from = "https://github.com/jbangdev/jbang/releases",
+      # jbang keeps its script cache, compiled jars and any downloaded JDKs in
+      # JBANG_DIR (default ~/.jbang, which a session may not be able to write).
+      env_state_wiring = {
+        env_var = "JBANG_DIR",
+        prefix = "jbang",
+      },
+      source_provenance = {
+        category = 'GithubRepo,
+        owner = "jbangdev",
+        repo = "jbang",
+      },
+    } | Attrs,
+
+  tests = {
+    jbang_version =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+          ["/bin/bash", "-c", "jbang --version 2>&1 | grep -qF '%{version}'"],
+        ],
+      } | Test,
+
+    # Compile and run a self-contained script with --offline, so any attempt to
+    # reach the network (dependency resolution, JDK download) fails the test
+    # instead of passing silently. JBANG_DIR keeps jbang's cache in the test's
+    # cwd rather than ~/.jbang.
+    run_script =
+      {
+        class = 'Standalone,
+        test_deps = [base],
+        cmds = [
+          ["/bin/bash", "-c", "printf 'class hello {\\n  public static void main(String[] args) {\\n    System.out.println(\"hello \" + String.join(\",\", args));\\n  }\\n}\\n' > hello.java"],
+          ["/bin/bash", "-c", "JBANG_DIR=\"$PWD/jbang-home\" jbang --offline hello.java a b > out.txt"],
+          ["/bin/bash", "-c", "grep -qx 'hello a,b' out.txt"],
+        ],
+      } | Test,
+  },
+} | BuildSpec
@@ -0,0 +1,28 @@
+#!/bin/sh
+set -ex
+
+# The platform-independent bundle: bin/jbang (bash launcher), bin/jbang.jar,
+# plus .cmd/.ps1 launchers for Windows.
+tar -xof "jbang-${MINIMAL_ARG_VERSION}.tar"
+SRC="jbang-${MINIMAL_ARG_VERSION}"
+
+INSTALL="$OUTPUT_DIR/usr/share/jbang"
+mkdir -p "$OUTPUT_DIR/usr/bin" "$INSTALL/bin"
+install -m 0755 "$SRC/bin/jbang" "$INSTALL/bin/jbang"
+install -m 0644 "$SRC/bin/jbang.jar" "$INSTALL/bin/jbang.jar"
+install -m 0644 "$SRC/version.txt" "$INSTALL/version.txt"
+
+# Wrapper. The upstream launcher looks for a JDK in $JAVA_HOME, then javac
+# on PATH, and only if both fail does it DOWNLOAD one from foojay.io into
+# ~/.jbang. Point JAVA_HOME at the packaged jdk (unless the caller set one)
+# so the download path is never taken.
+cat > "$OUTPUT_DIR/usr/bin/jbang" << 'EOF'
+#!/bin/sh
+export JAVA_HOME="${JAVA_HOME:-/usr/lib/jvm}"
+exec /usr/share/jbang/bin/jbang "$@"
+EOF
+chmod 0755 "$OUTPUT_DIR/usr/bin/jbang"
+
+# Fail closed if the bundle layout changes.
+test -s "$INSTALL/bin/jbang.jar"
+grep -qx "${MINIMAL_ARG_VERSION}" "$INSTALL/version.txt"