feat: Add maven jib build support by BulldromeQ · Pull Request #596 · carvel-dev/kbld

BulldromeQ · 2026-05-27T19:58:34Z

Summary

This pull request introduces support for Maven Jib builds, upstreaming the changes developed in the vishrantgupta/kbld fork.

The changes include:

Adding structure to support Maven Jib build (pkg/kbld/builder/maven/jib.go).
Updating image building configs to allow Jib integrations.
Allowing insecure registries with Jib builder.
Adding a sample app and end-to-end tests for simple-app-build-local-mvn.

Signed-off-by: Qi Hu <qi.hu@broadcom.com>

- Add missing copyright header to jib.go - Update errcheck exclude for PrefixWriter - Handle returned errors in git_test.go Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

- Fix line length limits (under 80 characters) across docker, jib, and built images. - Add package-level comment and document exported fields/functions in jib and config. - Fix redundant import aliases and import shadowing of package name maven. - Remove unused global regexp variable ImageID. Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

- Remove extra empty lines at the start of blocks in jib.go and built.go - Replace unnecessary fmt.Errorf with errors.New in jib.go - Add missing exported comment to NewBuiltImage in built.go Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

- Create a `BuildersOpts` struct to group the builder dependencies. - Update `NewBuiltImage` in built.go to accept `BuildersOpts` instead of 10 individual parameters, resolving the argument-limit (max 8) linter error. - Update `Factory.New` in factory.go to construct and pass `BuildersOpts`. Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

- Wrap the function signature for `Jib.Run` to keep the line length below the 80 characters limit enforced by the revive linter. Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Copilot

Pull request overview

Adds first-class Maven/Jib build support to kbld so images can be built from Maven projects (via Jib) similarly to existing builders (Docker, Bazel, Pack, Ko, etc.).

Changes:

Introduces a Maven/Jib builder and wires it into the image build selection flow.
Extends config to allow sources[].maven.run options.
Adds a Maven “helloworld” sample under e2e assets and a new example manifest for local Maven builds.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
test/e2e/assets/simple-app/helloworld/src/main/java/example/HelloWorld.java	Adds a minimal Java entrypoint for the Maven/Jib sample app.
test/e2e/assets/simple-app/helloworld/pom.xml	Adds a Maven project configured with the Jib Maven plugin.
pkg/kbld/image/git_test.go	Adjusts env var and Close handling to satisfy errcheck expectations.
pkg/kbld/image/factory.go	Wires the Maven/Jib builder into the image factory construction.
pkg/kbld/image/built.go	Adds Maven/Jib as a build source option and routes builds through the new builder.
pkg/kbld/config/config.go	Extends `Source` with a `Maven` field for Jib configuration.
pkg/kbld/config/config_jib.go	Defines config structs for Jib run options.
pkg/kbld/builder/maven/jib.go	Implements the Maven/Jib builder execution and Docker retagging.
pkg/kbld/builder/docker/docker.go	Adds command logging for `docker inspect`.
hack/errcheck_excludes.txt	Updates errcheck excludes for the logger writer type rename.
examples/simple-app-build-local-mvn/build.yml	Adds a new example manifest for building a local Maven/Jib-backed image.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

BulldromeQ · 2026-06-04T18:17:22Z

+	cmdArgs := []string{
+		"compile",
+		"jib:dockerBuild",
+		"-Dimage=" + targetImage,
+		"-Djib.allowInsecureRegistries=true",
+	}


Our downstream launch tool currently relies on this being enabled by default. We can look into making this configurable in a follow-up coordinated change.

BulldromeQ · 2026-06-04T17:57:35Z

+// Run executes the Maven Jib build.
+func (b *Jib) Run(image, directory string,
+	opts config.SourceJibRunOpts) (ctlbdk.TmpRef, error) {
+	prefixedLogger := b.logger.NewPrefixedWriter(image + " | ")


This e2e test will require mvn available in the CI runner, I will need more information, we can skip this I believe.

The file that needs to be changed to install mvn is https://github.com/carvel-dev/kbld/blob/develop/hack/Dockerfile.dev. Give it a look and see if there is an easy way to add the Java and Maven environment.

Done! Added default-jdk-headless and maven to hack/Dockerfile.dev. I also added a full E2E test suite in test/e2e/build_maven_jib_test.go and verified that Jib image building compiles and works successfully inside this environment. To completely resolve the race condition, I also updated the builder to build to a unique random temporary tag first before retagging.

joaopapereira

The code as a whole looks good, but I would like to see some e2e tests. Take a look at https://github.com/carvel-dev/kbld/blob/develop/test/e2e/build_pack_test.go to make sure we have some assurance that this feature does not break in the future.

Made some form suggestions, mainly around imports and naming, with a NIT that I do not have a strong opinion about; I leave that to you.

My main concern is the fact that we build it and then ask the registry what the SHA is; this can cause race conditions or even malicious behavior.

joaopapereira · 2026-06-04T15:46:32Z

+	if err := cmd.Run(); err != nil {
+		_, _ = prefixedLogger.Write([]byte(fmt.Sprintf(
+			"error: %s\n", err)))
+		return ctlbdk.TmpRef{}, err
+	}
+
+	inspectData, err := b.docker.Inspect(targetImage)


This is somewhat a race condition where if 2 builds are happening at the same time for the same image and no tags are provided, we do not know what image SHA we will get back. This might be a bit of a corner case, but I am not 100% sure I like this approach.
In other builders, we read the logs of the building tool and parse it. It may be more brittle if the verbiage changes between versions, but at least we know we tag the correct SHA.
Does maven output from jib provide the SHA in the logs?

The race only hits the latest fallback path — when a tag is set (our consumer always passes a unique one) the inspect can't collide. Ok to leave for now and revisit parsing the SHA from logs as a follow-up?

Today, your consumer does, but if for some reason they stop doing it, we are relying on other people to keep consistency in our tools, which is concerning. In a world where we have multiple teams or eventually multiple agents doing work on a code base at any given time will only increase the possibility of this becoming an issue.
Another option we can use is the same technique we have for docker images building where we generate a temporary tag inside kbld code and then we use that tag, check https://github.com/carvel-dev/kbld/blob/develop/pkg/kbld/builder/docker/docker.go#L63, afterwards we also do the inspect and ensure that the image is tagged with the tag the user asks for.

where if 2 builds are happening at the same time for the same image and no tags are provided

Is this considered a poor build practice, or is this a common industry standard and we should handle that case? @joaopapereira

This is an issue with the current design. We cannot predict what people will do with kbld, also this can also happen if someone is pushing the same tag to the repository.
What I want to make sure is that we cross our T's and dot our I's, the build already fail for a number of different reasons unrelated to kbld so we should make sure that kbld does behave well. Also this is not such a big change in the current code that we can do to ensure no randomess happens when building

I went ahead and implemented the robust solution for this to completely eliminate any possible race condition: we now generate a unique, random temporary tag (via ctlb.TagBuilder{}) to run the maven build against, inspect that specific temporary tag, and then retag it to the desired user tag and stable/digest references.

- Update copyright headers to 2026 in jib.go and config_jib.go - Group imports (stdlib first) and use ctlbmvn alias for the maven builder package in jib.go, built.go, and factory.go - Use value instead of pointer when resolving the image tag in jib.go - Fix simple-app-build-local-mvn example: rename bazel-derived resource names/labels to mvn and drop the unsupported maven.run.name field Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ · 2026-06-04T18:53:51Z

The code as a whole looks good, but I would like to see some e2e tests. Take a look at https://github.com/carvel-dev/kbld/blob/develop/test/e2e/build_pack_test.go to make sure we have some assurance that this feature does not break in the future.

Made some form suggestions, mainly around imports and naming, with a NIT that I do not have a strong opinion about; I leave that to you.

My main concern is the fact that we build it and then ask the registry what the SHA is; this can cause race conditions or even malicious behavior.

Thanks @joaopapereira , could you help me confirm that CI env have maven setup ahead so I could add some tests for these changes.

- Refactor Jib builder to build to a unique, random temporary tag first, then inspect and tag back to the target/stable tags, eliminating any potential tag/SHA race conditions with concurrent builds. - Update hack/Dockerfile.dev to use default-jdk-headless to ensure reliable Java environment installation across different Debian versions. - Document the optional tag property inside simple-app-build-local-mvn example. - Add and integrate the new Maven Jib E2E test suite. Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

- Wrap lines exceeding the 80-character boundary enforced by revive under the 'e2e' build tag config. Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ · 2026-06-08T18:11:53Z

@joaopapereira Update on the recent CI failures in the test-gh job (TestPackBuildAndPushSuccessful getting a 404 for jvmkill): I initially thought this was an external infrastructure flake, but it turns out it was indirectly caused by this PR!

By placing the pom.xml inside test/e2e/assets/simple-app/helloworld, the pack builder in the older E2E tests (which targets the parent simple-app dir) mistakenly detected the project as a Java application. This triggered the legacy Cloud Foundry OpenJDK Buildpack, which then failed because of its broken download link for jvmkill.

I've just pushed a commit that moves the Java app into its own dedicated directory at test/e2e/assets/maven-app. This cleanly separates the Go and Java assets and completely fixes the CI issue.

Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

joaopapereira · 2026-06-09T09:53:42Z

I was looking at cnb in docker hub and the latest sha is sha256:17ea21162ba8c7717d3ead3ee3836a368aced7f02f2e59658e52029bd6d149e7 not sure if that will be enough but they did not update the image for 3 years. can you check with that image

Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ · 2026-06-09T18:13:04Z

@joaopapereira I've updated the pack builder image to the one you suggested (index.docker.io/cloudfoundry/cnb@sha256:17ea21162ba8c7717d3ead3ee3836a368aced7f02f2e59658e52029bd6d149e7) in the e2e tests. Also, I've moved the java app into its own directory (test/e2e/assets/maven-app) so it won't conflict with the go app in simple-app. Let's see if the CI turns green now!

Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ · 2026-06-10T03:24:13Z

@joaopapereira The suggested builder image (17ea21162ba8c7717d3ead3ee3836a368aced7f02f2e59658e52029bd6d149e7) failed during detection with: ERROR: validating stack mixins: buildpack paketo-buildpacks/apache-tomcat@7.13.7 does not support stack io.buildpacks.stacks.bionic.

Because we've already fixed the root cause of the previous 404 error (by moving maven-app completely out of the simple-app folder so the older test no longer misidentifies it as a Java app), the original builder image (83270cf59e8944be0c544e45fd45a5a1f4526d7936d488d2de8937730341618d) should work perfectly again!

I've reverted the image SHA back to the original in the test. The CI should hopefully pass cleanly now.

joaopapereira

LGTM

joaopapereira · 2026-06-10T15:03:12Z

@BulldromeQ, thanks for the long feedback loop here. I am happy that we got to the current point.
We need to update https://github.com/carvel-dev/carvel/tree/develop/site/content/kbld/docs/develop to include the new configuration for Jib before we release a new kbld version. Can you please do that PR?

Vishrant Gupta added 3 commits May 27, 2026 12:58

carvel-dev#527 - Adding structure to support maven jib build

991e424

Signed-off-by: Qi Hu <qi.hu@broadcom.com>

carvel-dev#527 - Adding structure to support maven jib build

357683d

Signed-off-by: Qi Hu <qi.hu@broadcom.com>

carvel-dev#527 - allowing allowInsecureRegistries

4260446

Signed-off-by: Qi Hu <qi.hu@broadcom.com>

carvel-bot added this to Carvel May 27, 2026

BulldromeQ mentioned this pull request May 27, 2026

kbld integration with maven-jib #527

Open

BulldromeQ temporarily deployed to DockerHub E2E May 29, 2026 06:29 — with GitHub Actions Inactive

BulldromeQ force-pushed the jib-support branch from 482301a to e51bb18 Compare June 1, 2026 18:38

BulldromeQ temporarily deployed to DockerHub E2E June 1, 2026 19:52 — with GitHub Actions Inactive

BulldromeQ temporarily deployed to DockerHub E2E June 1, 2026 22:01 — with GitHub Actions Inactive

BulldromeQ temporarily deployed to DockerHub E2E June 2, 2026 15:37 — with GitHub Actions Inactive

BulldromeQ temporarily deployed to DockerHub E2E June 2, 2026 18:29 — with GitHub Actions Inactive

Fix revive line-length-limit lint error on Jib.Run signature

ad913e4

- Wrap the function signature for `Jib.Run` to keep the line length below the 80 characters limit enforced by the revive linter. Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ temporarily deployed to DockerHub E2E June 2, 2026 20:08 — with GitHub Actions Inactive

praveenrewar requested a review from joaopapereira June 4, 2026 04:01

joaopapereira requested a review from Copilot June 4, 2026 15:08

Copilot started reviewing on behalf of joaopapereira June 4, 2026 15:08 View session

Copilot AI reviewed Jun 4, 2026

View reviewed changes

joaopapereira requested changes Jun 4, 2026

View reviewed changes

github-project-automation Bot moved this to In Progress in Carvel Jun 4, 2026

vg011895 approved these changes Jun 4, 2026

View reviewed changes

BulldromeQ temporarily deployed to DockerHub E2E June 4, 2026 21:09 — with GitHub Actions Inactive

BulldromeQ had a problem deploying to DockerHub E2E June 5, 2026 18:39 — with GitHub Actions Failure

Fix line-length lints in build_maven_jib_test.go

138c641

- Wrap lines exceeding the 80-character boundary enforced by revive under the 'e2e' build tag config. Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ had a problem deploying to DockerHub E2E June 5, 2026 18:54 — with GitHub Actions Failure

Chore: trigger clean CI run

f92ebc4

Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ had a problem deploying to DockerHub E2E June 8, 2026 17:33 — with GitHub Actions Failure

joaopapereira requested a review from Copilot June 8, 2026 17:34

Copilot started reviewing on behalf of joaopapereira June 8, 2026 17:35 View session

Copilot AI reviewed Jun 8, 2026

View reviewed changes

test: Fix e2e test linter errors

b2fc9ca

Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ had a problem deploying to DockerHub E2E June 8, 2026 17:48 — with GitHub Actions Failure

fix: Address Copilot review comments

82273e9

Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ had a problem deploying to DockerHub E2E June 8, 2026 21:54 — with GitHub Actions Failure

test: Move maven-app to separate asset folder

40e8db4

Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ had a problem deploying to DockerHub E2E June 9, 2026 09:53 — with GitHub Actions Failure

test: Use updated builder image for pack E2E test

6d3625a

Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ force-pushed the jib-support branch from f6b499c to 6d3625a Compare June 9, 2026 18:12

test: Pin distroless/java17-debian11 base image for maven e2e test

80d5824

Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ force-pushed the jib-support branch from 06664fc to 80d5824 Compare June 9, 2026 18:35

BulldromeQ had a problem deploying to DockerHub E2E June 9, 2026 20:59 — with GitHub Actions Failure

test: Revert to original pack builder image

5c2474d

Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Qi Hu <qi.hu@broadcom.com> Co-authored-by: Cursor <cursoragent@cursor.com>

BulldromeQ force-pushed the jib-support branch from da9ab29 to 5c2474d Compare June 10, 2026 03:24

BulldromeQ deployed to DockerHub E2E June 10, 2026 10:03 — with GitHub Actions Active

joaopapereira approved these changes Jun 10, 2026

View reviewed changes

joaopapereira merged commit ea02eee into carvel-dev:develop Jun 10, 2026
6 checks passed

github-project-automation Bot moved this from In Progress to Closed in Carvel Jun 10, 2026

Conversation

BulldromeQ commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BulldromeQ Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joaopapereira left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BulldromeQ Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BulldromeQ commented Jun 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BulldromeQ commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joaopapereira commented Jun 9, 2026

Uh oh!

BulldromeQ commented Jun 9, 2026

Uh oh!

BulldromeQ commented Jun 10, 2026

Uh oh!

joaopapereira left a comment

Choose a reason for hiding this comment

Uh oh!

joaopapereira commented Jun 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

BulldromeQ commented May 27, 2026 •

edited

Loading

BulldromeQ Jun 5, 2026 •

edited

Loading

BulldromeQ Jun 5, 2026 •

edited

Loading

BulldromeQ commented Jun 8, 2026 •

edited

Loading