From 3f0a1743920845a1428afb68d1d5e4330bd14d96 Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Sun, 27 Sep 2026 23:40:16 +0200
Subject: [PATCH] nats declares the upstream image it is built from

The recipe started FROM the upstream server's digest directly, and the build machine
refuses that: every base is declared under build.on and copied into the mesh's own
store before a build, so a build never reaches out to a registry the mesh does not
run (novox/hq ADR 0097). Found the first time the module was built on a real mesh.

Same digest, now declared as NATS_BASE and arriving as a build argument; the
Dockerfile says where it comes from and why the digest is the index's.
---
 modules/nats/Dockerfile  | 7 +++++--
 modules/nats/module.json | 6 ++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/modules/nats/Dockerfile b/modules/nats/Dockerfile
index b362d7c..79ad25a 100644
--- a/modules/nats/Dockerfile
+++ b/modules/nats/Dockerfile
@@ -9,8 +9,11 @@
 #
 # Unlike every other module's Dockerfile, this builds no TypeScript and uses no mesh base image:
 # the module's code is the server, which upstream already built. There is no BUILD_BASE here on
-# purpose — nothing is compiled.
-FROM nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927
+# purpose — nothing is compiled. The upstream image is declared in the manifest under build.on and
+# arrives as NATS_BASE, like every other base the mesh copies into its own store before a build
+# (novox/hq ADR 0097); the digest above is the index one for the reason given.
+ARG NATS_BASE
+FROM ${NATS_BASE}
 
 COPY entrypoint.sh /usr/local/bin/mesh-nats-entrypoint
 RUN chmod 0755 /usr/local/bin/mesh-nats-entrypoint
diff --git a/modules/nats/module.json b/modules/nats/module.json
index 5a0f695..ff80c00 100644
--- a/modules/nats/module.json
+++ b/modules/nats/module.json
@@ -73,6 +73,12 @@
     }
   ],
   "build": {
+    "on": [
+      {
+        "arg": "NATS_BASE",
+        "image": "nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927"
+      }
+    ],
     "artifacts": [
       {
         "name": "server",
-- 
2.54.0