[mikeland73]

Summary

Fourth PR of the package definitions stack. Adds 15 package definitions next to Go, and updates the spec with what they need from the format. The goal is to show that the structure holds for installing and switching versions of the most commonly used packages: node (with npm, pnpm, yarn), python, rust and java, plus the tools in the table below.

Package	Source	Checksum
nodejs (npm included)	nodejs.org	SHASUMS256.txt
pnpm	GitHub tarballs (11+), npm @pnpm/<os>-<arch> (<11)	GitHub asset digest, npm sha512
yarn	npm @yarnpkg/cli-dist (2+), yarn (1.x)	npm sha512
python	python-build-standalone, via uv's index	index
uv	GitHub releases	.sha256
rust	rustup-init, then the toolchain via post_install	.sha256, then rustup
java	Eclipse Temurin from Adoptium	index
gradle	services.gradle.org	index
maven	Maven Central	Apache archive .sha512
deno, bun	GitHub releases	.sha256sum, SHASUMS256.txt
zig	ziglang.org	index
terraform	releases.hashicorp.com	SHA256SUMS
kubectl	dl.k8s.io	.sha256
helm	get.helm.sh	.sha256sum

Writing these against the real vendors exposed the gaps the spec now covers (implemented in the next PR):

• Platforms a version isn't published for (Node.js 14 on Apple silicon, Java 8 on Apple silicon, Temurin 27 on Intel macOS). The lock leaves those systems out instead of failing.
• install.lookup: python-build-standalone puts a build date in every file name, Temurin renames respins, and zig renamed its tarballs. Their indexes have the URL and checksum.
• install.version_overrides: pnpm changed its artifacts in 11, yarn 1 and 2+ are different npm packages, and Deno <2.0.1 has no checksums.
• Version sources: a list of sources (yarn), lazy pagination (Adoptium pages of 50, older GitHub releases), and +build versions (21.0.5+11).
• Checksums: sha512 and SRI digests (npm, Maven), plus GitHub's own asset digests.
• binaries: install now marks them executable (npm tarballs drop the bit) and verifies they exist.

Design choices worth a look:

• Rust uses rustup-init plus a post_install hook rather than the planned manager strategy. Toolchains share RUSTUP_HOME, and RUSTUP_TOOLCHAIN selects the version, so rustup target add still works.
• Python creates and activates $VENV_DIR (default .venv) and recreates it when the version changes, so pip never writes into the shared install. A venv Devbox didn't create is left alone, with a warning.
• Node sends npm install -g to the project's virtenv, for the same reason.
• Go now sets GOTOOLCHAIN=local, as the nixpkgs Go does, so the pinned version runs even when go.mod asks for a newer one.

The definitions use format features implemented in the next PR, so they don't parse on this branch alone.

Test plan

• Tests are in test(pkgs): install and switch versions of every shipped package #3036. All 16 packages install, switch versions and switch back on macOS arm64 (testscripts) and Linux arm64 (Docker, jetpackio/devbox)
• The latest version of every package resolves and locks against its vendor; every platform has a vendor checksum, except where noted above

🤖 Generated with Claude Code