Skip to content

Add pnpm recipe - #117

Open
marvin-w wants to merge 1 commit into
cloudfoundry:mainfrom
marvin-w:add-pnpm-recipe
Open

Add pnpm recipe#117
marvin-w wants to merge 1 commit into
cloudfoundry:mainfrom
marvin-w:add-pnpm-recipe

Conversation

@marvin-w

Copy link
Copy Markdown

Builds pnpm from its self-contained linux-x64 release archive and injects a bin/pnpm wrapper so the artifact is consumed exactly like yarn's.

The npm registry tarball is not used. As of pnpm 12 that package is a ~1 MB stub: its preinstall script downloads a platform-native binary, and the bin/pnpm.mjs Corepack shim fetches the same binary on first run. Neither is available to a buildpack staging offline, so repacking it would produce an artifact that only works with network access. The release archive ships the native binary outright.

The archive is flat, so nothing is stripped and a bin/pnpm wrapper is injected to provide the bin/ layout. It resolves $0 through readlink -f because buildpacks symlink bin/ entries into their own bin directory, where the binary is not a sibling. InjectFile gains a mode-aware variant for this; the existing entry point keeps its 0644 default.

@linux-foundation-easycla

linux-foundation-easycla Bot commented Aug 27, 2026

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

  • ✅ login: marvin-w / name: Marvin Wichmann (c7fa93d)

Builds pnpm from its self-contained linux-x64 release archive and injects a
bin/pnpm wrapper so the artifact is consumed exactly like yarn's.

Covers pnpm 11.0.0 and newer: v11.0.0 is the first release to publish
pnpm-linux-x64.tar.gz. Earlier releases attach a bare pnpm-linux-x64 binary
rather than an archive and are out of range. Verified end to end against
11.24.0 and 12.0.0.

The npm registry package is not used, because it stopped being self-contained.
Through pnpm 11 it bundled a complete dist/ tree, but as of pnpm 12 it is a
~1 MB stub: its preinstall script downloads a platform-native binary, and the
bin/pnpm.mjs Corepack shim fetches that same binary on first run. Neither is
available to a buildpack staging offline, so sourcing from npm would keep
working right up until the first pnpm 12 build and then produce an artifact
that only runs with network access. The release archive ships the native binary
outright.

The archive is flat, so nothing is stripped and a bin/pnpm wrapper is injected
to provide the bin/<dep> layout. It resolves $0 through readlink -f because
buildpacks symlink bin/ entries into their own bin directory, where the binary
is not a sibling. InjectFile gains a mode-aware variant for this; the existing
entry point keeps its 0644 default.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant