diff --git a/bazel/.bazelrc b/bazel/.bazelrc index f47974bf1a..c522c6523e 100644 --- a/bazel/.bazelrc +++ b/bazel/.bazelrc @@ -12,7 +12,7 @@ common --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1 common --@rules_python//python/config_settings:bootstrap_impl=script common --registry=https://bcr.bazel.build/ -common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb +common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c common --experimental_repository_cache_hardlinks common --repo_env=ANDROID_HOME= diff --git a/bazel/MODULE.bazel b/bazel/MODULE.bazel index 4a1960dabc..e4012832f6 100644 --- a/bazel/MODULE.bazel +++ b/bazel/MODULE.bazel @@ -15,6 +15,7 @@ bazel_dep(name = "rules_foreign_cc", version = "0.15.1") bazel_dep(name = "rules_pkg", version = "1.1.0") bazel_dep(name = "rules_python", version = "2.2.0") bazel_dep(name = "rules_shell", version = "0.8.0") +bazel_dep(name = "sq", version = "1.4.0.envoy") bazel_dep(name = "protobuf", version = "35.1.bcr.envoy", repo_name = "com_google_protobuf") bazel_dep(name = "toolchains_llvm", version = "1.9.0.envoy", dev_dependency = True) @@ -110,17 +111,6 @@ use_repo(wee8_prebuilt_ext, "wee8_prebuilt_x86_64", "wee8_prebuilt_x86_64_libstd # libcxx_libs_ext.setup() # use_repo(libcxx_libs_ext, "libcxx_libs_aarch64", "libcxx_libs_x86_64") -# Setup the OpenPGP signer (`sq`) toolchain - example for downstream consumers -# Uncomment to use in your MODULE.bazel, supplying sha256s you have verified: -# pgp_ext = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension") -# pgp_ext.setup( -# sha256s = { -# "linux_x86_64": "", -# }, -# ) -# use_repo(pgp_ext, "sq_linux_x86_64") -# register_toolchains("@sq_linux_x86_64//:toolchain") - # Setup grcov for code coverage - example for downstream consumers # Uncomment to use in your MODULE.bazel: # grcov_ext = use_extension("@envoy_toolshed//coverage/grcov:extensions.bzl", "grcov_extension") @@ -189,10 +179,12 @@ use_repo(llvm, "llvm_toolchain") register_toolchains("@llvm_toolchain//:all", dev_dependency = True) -# Stub OpenPGP signer used by //pgp/test analysis tests. Real signing requires -# a `sq` toolchain, see //pgp:extensions.bzl. +# Stub OpenPGP signer used by //pgp/test analysis tests. It is registered first +# in dev mode so those tests resolve the stub instead of the default `sq` signer. register_toolchains("//pgp/test:stub_toolchain", dev_dependency = True) +register_toolchains("//pgp:sq_toolchain") + libcxx_ext = use_extension("//compile:extensions.bzl", "libcxx_extension", dev_dependency = True) use_repo(libcxx_ext, "llvm_libcxx_aarch64", "llvm_libcxx_x86_64") diff --git a/bazel/MODULE.bazel.lock b/bazel/MODULE.bazel.lock index 34dbe44f8c..f16ba6074a 100644 --- a/bazel/MODULE.bazel.lock +++ b/bazel/MODULE.bazel.lock @@ -102,7 +102,6 @@ "https://bcr.bazel.build/modules/googletest/1.17.0.bcr.2/MODULE.bazel": "827f54f492a3ce549c940106d73de332c2b30cebd0c20c0bc5d786aba7f116cb", "https://bcr.bazel.build/modules/googletest/1.17.0.bcr.2/source.json": "3664514073a819992320ffbce5825e4238459df344d8b01748af2208f8d2e1eb", "https://bcr.bazel.build/modules/googletest/1.17.0/MODULE.bazel": "dbec758171594a705933a29fcf69293d2468c49ec1f2ebca65c36f504d72df46", - "https://bcr.bazel.build/modules/helly25_bzl/0.4.3/MODULE.bazel": "9c20052fd3f1fb767c48b78c1bbc46f501a4ca69d14558429d1234e68e449f68", "https://bcr.bazel.build/modules/highway/1.2.0/MODULE.bazel": "605dc84b4931a409f16d920409dc38718798754c1afa4c80115a32118d67acb3", "https://bcr.bazel.build/modules/highway/1.2.0/source.json": "01a2c7e56a1850a28c0026c0adc32e52db44c6a1df142b3f88b2a3747a5bff7d", "https://bcr.bazel.build/modules/icu/78.2.envoy/MODULE.bazel": "not found", @@ -279,6 +278,7 @@ "https://bcr.bazel.build/modules/rules_swift/1.16.0/MODULE.bazel": "4a09f199545a60d09895e8281362b1ff3bb08bbde69c6fc87aff5b92fcc916ca", "https://bcr.bazel.build/modules/rules_swift/2.1.1/MODULE.bazel": "494900a80f944fc7aa61500c2073d9729dff0b764f0e89b824eb746959bc1046", "https://bcr.bazel.build/modules/simdutf/8.1.0.envoy/MODULE.bazel": "not found", + "https://bcr.bazel.build/modules/sq/1.4.0.envoy/MODULE.bazel": "not found", "https://bcr.bazel.build/modules/stardoc/0.5.1/MODULE.bazel": "1a05d92974d0c122f5ccf09291442580317cdd859f07a8655f1db9a60374f9f8", "https://bcr.bazel.build/modules/stardoc/0.5.3/MODULE.bazel": "c7f6948dae6999bf0db32c1858ae345f112cacf98f174c7a8bb707e41b974f1c", "https://bcr.bazel.build/modules/stardoc/0.5.6/MODULE.bazel": "c43dabc564990eeab55e25ed61c07a1aadafe9ece96a4efabb3f8bf9063b71ef", @@ -294,7 +294,6 @@ "https://bcr.bazel.build/modules/tar.bzl/0.6.0/source.json": "4a620381df075a16cb3a7ed57bd1d05f7480222394c64a20fa51bdb636fda658", "https://bcr.bazel.build/modules/toml.bzl/0.4.1/MODULE.bazel": "6bc0b938f03ade8d58c2fca0ad5c3fa12b4764e1e1927ad50b0c860286db2167", "https://bcr.bazel.build/modules/toml.bzl/0.4.1/source.json": "86a90afd8b43c9b69ad31f5c03998c3adcf4b08175e621addb93e3a38eec538b", - "https://bcr.bazel.build/modules/toolchains_llvm/1.8.0.envoy/MODULE.bazel": "not found", "https://bcr.bazel.build/modules/toolchains_llvm/1.9.0.envoy/MODULE.bazel": "not found", "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43", "https://bcr.bazel.build/modules/upb/0.0.0-20230516-61a97ef/MODULE.bazel": "c0df5e35ad55e264160417fd0875932ee3c9dda63d9fccace35ac62f45e1b6f9", @@ -306,22 +305,23 @@ "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/MODULE.bazel": "eec517b5bbe5492629466e11dae908d043364302283de25581e3eb944326c4ca", "https://bcr.bazel.build/modules/zlib/1.3.1.bcr.5/source.json": "22bc55c47af97246cfc093d0acf683a7869377de362b5d1c552c2c2e16b7a806", "https://bcr.bazel.build/modules/zlib/1.3.1/MODULE.bazel": "751c9940dcfe869f5f7274e1295422a34623555916eb98c174c1e945594bf198", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/bazel_registry.json": "51bd3a0b193753e419c5d3db38e92fbcb9f7f97fd992ef2e24a0addd7274b37a", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/dragonbox/0.0.0-241028-6c7c925.envoy/MODULE.bazel": "56dd26c839325bc2c40cc1879c00cab3397cd83fe3cf6ab8ccaf7fd6ad1b890d", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/dragonbox/0.0.0-241028-6c7c925.envoy/source.json": "642addb5bea17b6570a138ccfb4f50f34c810c9e3416748a09e1ac723b01021f", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/fp16/0.0.0-260704-3d2de18.envoy/MODULE.bazel": "27e5020ea158fdc725eafed3443b6fa9a1555d52505dafcdc3e6ea74d9e112c1", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/fp16/0.0.0-260704-3d2de18.envoy/source.json": "ccc308b4d5afbba59ce93809243da68a5402414bb7f707d2b691df68ab896250", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/icu/78.2.envoy/MODULE.bazel": "bed492d3dffffca822867b4b034191069ea917cd5c1b98ad3c5e609227d0f387", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/icu/78.2.envoy/source.json": "d3c0d7c00cdb28b6294356ec253a0ee994e2d65f912b92075ea5ddd049df283b", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/protobuf/35.1.bcr.envoy/MODULE.bazel": "a42d2e15b0ffb57474df57e2cc274aa9ad2e52e6e9e7bc19e9c529b0d4093d5f", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/protobuf/35.1.bcr.envoy/source.json": "5ee2c32f315c4be232f955a963f37e631f70a4d32cd3dd536b46c48920a98944", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/simdutf/8.1.0.envoy/MODULE.bazel": "d7288f3bd5168bc92aff3591e5f7a3a58277bddcc7fc70fa125f39ac9445f4b7", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/simdutf/8.1.0.envoy/source.json": "b95d6bfb222cf92c83d3352ec0c550394d801e2b2700b160b692cbe4b40b8342", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/toolchains_llvm/1.8.0.envoy/MODULE.bazel": "93909b69ee77410306b1b591653f7f89ecda4c7d88d42c468dd1e5e7afc6fe65", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/toolchains_llvm/1.9.0.envoy/MODULE.bazel": "f3a85560662c37a739cbe00f20a527baf0caa9508c0541840877481479c0c825", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/toolchains_llvm/1.9.0.envoy/source.json": "67e2d7bbdb368463c599a87fcc2c1884ca6ac0a339d5ac999ca8b5c34ec0911d", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/v8/14.6.202.10.envoy/MODULE.bazel": "57fa395049458e9768b26e4789236ee620bd177414bf979cf583887f06c71749", - "https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb/modules/v8/14.6.202.10.envoy/source.json": "068a8822f21c1c488982f6b3fd5c52858e8db025ebc3458170d3ed940b425a57" + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/bazel_registry.json": "51bd3a0b193753e419c5d3db38e92fbcb9f7f97fd992ef2e24a0addd7274b37a", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/dragonbox/0.0.0-241028-6c7c925.envoy/MODULE.bazel": "56dd26c839325bc2c40cc1879c00cab3397cd83fe3cf6ab8ccaf7fd6ad1b890d", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/dragonbox/0.0.0-241028-6c7c925.envoy/source.json": "642addb5bea17b6570a138ccfb4f50f34c810c9e3416748a09e1ac723b01021f", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/fp16/0.0.0-260704-3d2de18.envoy/MODULE.bazel": "27e5020ea158fdc725eafed3443b6fa9a1555d52505dafcdc3e6ea74d9e112c1", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/fp16/0.0.0-260704-3d2de18.envoy/source.json": "ccc308b4d5afbba59ce93809243da68a5402414bb7f707d2b691df68ab896250", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/icu/78.2.envoy/MODULE.bazel": "9cf6e785309c88e0f21b38e43f2703971793bb526a87169ec8fc5eb7dbb66c45", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/icu/78.2.envoy/source.json": "d3c0d7c00cdb28b6294356ec253a0ee994e2d65f912b92075ea5ddd049df283b", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/protobuf/35.1.bcr.envoy/MODULE.bazel": "a42d2e15b0ffb57474df57e2cc274aa9ad2e52e6e9e7bc19e9c529b0d4093d5f", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/protobuf/35.1.bcr.envoy/source.json": "5ee2c32f315c4be232f955a963f37e631f70a4d32cd3dd536b46c48920a98944", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/simdutf/8.1.0.envoy/MODULE.bazel": "d7288f3bd5168bc92aff3591e5f7a3a58277bddcc7fc70fa125f39ac9445f4b7", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/simdutf/8.1.0.envoy/source.json": "b95d6bfb222cf92c83d3352ec0c550394d801e2b2700b160b692cbe4b40b8342", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/sq/1.4.0.envoy/MODULE.bazel": "588b6231d91201bcaf57b2452726a895008cb4232976922f529dc1b6cf7c6b94", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/sq/1.4.0.envoy/source.json": "4b56ca06f175a62dbc0ba6cdac5b556f3698576bf7bcadbf824b13220ed12487", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/toolchains_llvm/1.9.0.envoy/MODULE.bazel": "f3a85560662c37a739cbe00f20a527baf0caa9508c0541840877481479c0c825", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/toolchains_llvm/1.9.0.envoy/source.json": "67e2d7bbdb368463c599a87fcc2c1884ca6ac0a339d5ac999ca8b5c34ec0911d", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/v8/14.6.202.10.envoy/MODULE.bazel": "57fa395049458e9768b26e4789236ee620bd177414bf979cf583887f06c71749", + "https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c/modules/v8/14.6.202.10.envoy/source.json": "068a8822f21c1c488982f6b3fd5c52858e8db025ebc3458170d3ed940b425a57" }, "selectedYankedVersions": {}, "moduleExtensions": { diff --git a/bazel/pgp/BUILD b/bazel/pgp/BUILD index 24c1e761a4..5250507f39 100644 --- a/bazel/pgp/BUILD +++ b/bazel/pgp/BUILD @@ -1,20 +1,18 @@ load("@bazel_skylib//:bzl_library.bzl", "bzl_library") load("@bazel_skylib//rules:common_settings.bzl", "string_flag") +load("//pgp:defs.bzl", "pgp_toolchain", "sq_signer") exports_files([ "defs.bzl", "toolchain.bzl", - "extensions.bzl", ]) -# Ensures //pgp:extensions.bzl (not otherwise loaded - no `sq` platform is -# enabled by default) and the rest of the public/private starlark surface -# stay loadable and are covered by `bazel build //pgp/...`. +# Ensures the public/private Starlark surface stays loadable and is covered by +# `bazel build //pgp/...`. bzl_library( name = "pgp_bzl", srcs = [ "defs.bzl", - "extensions.bzl", "toolchain.bzl", "//pgp/private:sign.bzl", "//pgp/private:sq.bzl", @@ -28,14 +26,31 @@ bzl_library( # Toolchain type for OpenPGP signer implementations. # -# The default implementation wraps Sequoia PGP's `sq` (see extensions.bzl), -# but any binary implementing the signer CLI contract documented in -# toolchain.bzl can be registered instead. +# The default implementation wraps `@sq//:sq`, built from source via the Envoy +# Bazel registry, but any binary implementing the signer CLI contract documented +# in toolchain.bzl can be registered instead. toolchain_type( name = "toolchain_type", visibility = ["//visibility:public"], ) +sq_signer( + name = "sq_signer", + sq = "@sq//:sq", +) + +pgp_toolchain( + name = "sq_signer_toolchain", + signer = ":sq_signer", +) + +toolchain( + name = "sq_toolchain", + toolchain = ":sq_signer_toolchain", + toolchain_type = "//pgp:toolchain_type", + visibility = ["//visibility:public"], +) + # Absolute host path of the passphrase-encrypted secret key. # # The key is a host path, not an artifact in the build graph: Bazel only ever diff --git a/bazel/pgp/README.md b/bazel/pgp/README.md index 02e119bb33..0ba0c3ac4d 100644 --- a/bazel/pgp/README.md +++ b/bazel/pgp/README.md @@ -113,28 +113,14 @@ The default implementation is a thin wrapper around Sequoia PGP's home directory or keyring state, used as the OpenPGP backend for `rpm` on Fedora/RHEL and as `sqv` in apt >= 3.0. -Upstream does not publish sha256-verifiable release binaries that could be -pinned here, so **no `sq` platform is fetched by default**. Enable the -platform(s) you need by supplying sha256s you have verified yourself: +The default signer uses `@sq//:sq` from the Envoy Bazel registry: ```starlark -pgp_ext = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension") -pgp_ext.setup( - sha256s = { - "linux_x86_64": "", - }, -) -use_repo(pgp_ext, "sq_linux_x86_64") - -register_toolchains("@sq_linux_x86_64//:toolchain") +bazel_dep(name = "sq", version = "1.4.0.envoy") ``` -`urls` can be used to point at your own audited mirror of the binary. - -The intended toolshed approach for this is to build and publish a pinned, -static `sq` in the `bins-v*` release, the same way `sysroot`/`llvm_minimal` -are, so `pgp_ext.setup()` can work with no consumer-supplied sha256 - that is -a follow-up, not part of this rule set. +The `sq` module is built from source, and `envoy_toolshed` registers +`//pgp:sq_toolchain`, so consumers get signing support without extra setup. Swapping in a different signer (for example a purpose-built Rust signer) is a matter of registering another toolchain - the rules do not change: diff --git a/bazel/pgp/extensions.bzl b/bazel/pgp/extensions.bzl deleted file mode 100644 index 1c99bd286a..0000000000 --- a/bazel/pgp/extensions.bzl +++ /dev/null @@ -1,165 +0,0 @@ -"""Module extension fetching the default OpenPGP signer binary (`sq`). - -Sequoia PGP's `sq` is a single, statically linkable Rust OpenPGP -implementation with no agent, home directory or keyring state to fight - the -same OpenPGP implementation used as the backend for `rpm` on Fedora/RHEL and -as `sqv` in apt >= 3.0. - -Upstream does not publish sha256-verifiable release binaries that could be -pinned here, so **no platform is fetched by default** - each platform must be -enabled by passing a sha256 you have verified yourself: - -```starlark -sq = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension") -sq.setup( - version = "1.4.0", - sha256s = { - "linux_x86_64": "", - }, -) -use_repo(sq, "sq_linux_x86_64") -register_toolchains("@sq_linux_x86_64//:toolchain") -``` - -`urls` can be used to point at your own (audited, mirrored) copy of the -binary. -""" - -# TODO(pgp): pin verified sha256s here once upstream publishes signed, -# reproducible release binaries. The URLs below are the upstream release -# artifact locations - they are unverified, so the corresponding platforms -# are disabled until a sha256 is supplied by the consumer. -SQ_VERSION = "1.4.0" - -SQ_PLATFORMS = { - "darwin_aarch64": struct( - # TODO(pgp): unverified, sha256 required to enable. - url = "https://gitlab.com/sequoia-pgp/sequoia-sq/-/releases/v{version}/downloads/sq-{version}-aarch64-apple-darwin", - exec_compatible_with = [ - "@platforms//os:macos", - "@platforms//cpu:aarch64", - ], - ), - "linux_aarch64": struct( - # TODO(pgp): unverified, sha256 required to enable. - url = "https://gitlab.com/sequoia-pgp/sequoia-sq/-/releases/v{version}/downloads/sq-{version}-aarch64-unknown-linux-musl", - exec_compatible_with = [ - "@platforms//os:linux", - "@platforms//cpu:aarch64", - ], - ), - "linux_x86_64": struct( - # TODO(pgp): unverified, sha256 required to enable. - url = "https://gitlab.com/sequoia-pgp/sequoia-sq/-/releases/v{version}/downloads/sq-{version}-x86_64-unknown-linux-musl", - exec_compatible_with = [ - "@platforms//os:linux", - "@platforms//cpu:x86_64", - ], - ), -} - -_BUILD_FILE = """ -load("@envoy_toolshed//pgp:defs.bzl", "pgp_toolchain", "sq_signer") - -package(default_visibility = ["//visibility:public"]) - -exports_files(["sq"]) - -sq_signer( - name = "signer", - sq = "sq", -) - -pgp_toolchain( - name = "signer_toolchain", - signer = ":signer", -) - -toolchain( - name = "toolchain", - exec_compatible_with = {exec_compatible_with}, - toolchain = ":signer_toolchain", - toolchain_type = "@envoy_toolshed//pgp:toolchain_type", -) -""" - -def _sq_repository_impl(ctx): - ctx.download( - url = ctx.attr.urls, - sha256 = ctx.attr.sha256, - output = "sq", - executable = True, - ) - ctx.file( - "BUILD", - _BUILD_FILE.format(exec_compatible_with = str(ctx.attr.exec_compatible_with)), - executable = False, - ) - -sq_repository = repository_rule( - implementation = _sq_repository_impl, - doc = "Downloads a `sq` binary and exposes it as an OpenPGP signer toolchain.", - attrs = { - "exec_compatible_with": attr.string_list( - doc = "Execution platform constraints for the toolchain.", - mandatory = True, - ), - "sha256": attr.string( - doc = "Verified sha256 of the `sq` binary.", - mandatory = True, - ), - "urls": attr.string_list( - doc = "URLs to download the `sq` binary from.", - mandatory = True, - ), - }, -) - -def _sq_repo(platform, version, url, sha256): - sq_repository( - name = "sq_%s" % platform, - urls = [url.format(version = version)], - sha256 = sha256, - exec_compatible_with = SQ_PLATFORMS[platform].exec_compatible_with, - ) - -def _pgp_extension_impl(module_ctx): - for mod in module_ctx.modules: - for tag in mod.tags.setup: - version = tag.version or SQ_VERSION - for platform, sha256 in tag.sha256s.items(): - if platform not in SQ_PLATFORMS: - fail("Unknown `sq` platform: %s (expected one of %s)" % ( - platform, - sorted(SQ_PLATFORMS), - )) - if not sha256: - fail("No sha256 given for `sq` platform: %s" % platform) - _sq_repo( - platform, - version, - tag.urls.get(platform) or SQ_PLATFORMS[platform].url, - sha256, - ) - -_setup = tag_class( - attrs = { - "sha256s": attr.string_dict( - doc = "Verified sha256 of the `sq` binary, keyed by platform.", - ), - "urls": attr.string_dict( - doc = "Override download URL, keyed by platform.", - ), - "version": attr.string( - doc = "`sq` version to fetch.", - default = SQ_VERSION, - ), - }, -) - -pgp_extension = module_extension( - implementation = _pgp_extension_impl, - tag_classes = { - "setup": _setup, - }, -) diff --git a/bazel/pgp/private/sq.bzl b/bazel/pgp/private/sq.bzl index ba30f7ef64..080b8d6dc1 100644 --- a/bazel/pgp/private/sq.bzl +++ b/bazel/pgp/private/sq.bzl @@ -1,32 +1,40 @@ -"""Rule wrapping a `sq` binary as a toolshed OpenPGP signer. +"""Rule wrapping a `sq` executable as a toolshed OpenPGP signer. -The path of the `sq` binary is baked into the wrapper at analysis time so +The path of the `sq` executable is baked into the wrapper at analysis time so that the signer does not need to resolve runfiles - signing actions run with an empty environment. """ def _sq_signer_impl(ctx): + sq_default = ctx.attr.sq[DefaultInfo] + sq_files_to_run = sq_default.files_to_run + sq_executable = sq_files_to_run.executable + if not sq_executable: + fail("`sq` (%s) does not provide an executable" % ctx.attr.sq.label) + out = ctx.actions.declare_file("%s.sh" % ctx.label.name) ctx.actions.expand_template( template = ctx.file._template, output = out, - substitutions = {"@SQ@": ctx.file.sq.path}, + substitutions = {"@SQ@": sq_executable.path}, is_executable = True, ) + runfiles = ctx.runfiles(files = [sq_executable]).merge(sq_default.default_runfiles) return [DefaultInfo( executable = out, files = depset([out]), - runfiles = ctx.runfiles(files = [ctx.file.sq]), + runfiles = runfiles, )] sq_signer = rule( implementation = _sq_signer_impl, - doc = "Wraps a `sq` binary as an implementation of the signer CLI contract.", + doc = "Wraps a `sq` executable as an implementation of the signer CLI contract.", attrs = { "sq": attr.label( - doc = "The `sq` binary.", + doc = "The `sq` executable.", mandatory = True, - allow_single_file = True, + executable = True, + cfg = "exec", ), "_template": attr.label( default = "//pgp/private:signer.sh", diff --git a/bazel/pgp/test/BUILD b/bazel/pgp/test/BUILD index 1acdf92ed9..0cba27bfe6 100644 --- a/bazel/pgp/test/BUILD +++ b/bazel/pgp/test/BUILD @@ -5,8 +5,8 @@ load("//pgp/audit:defs.bzl", "pgp_audit_test") load("//pgp:defs.bzl", "pgp_sign_changes_file", "pgp_sign_checksums", "pgp_sign_cleartext", "pgp_sign_detached", "pgp_toolchain") load(":sign_test.bzl", "KEY_FRAGMENT_DIGEST", "args_test", "args_with_fragment_test", "bad_key_fragment_test", "env_test", "execution_requirements_test", "inputs_test", "no_key_test", "no_passphrase_test", "passphrase_fragment_test", "relative_key_test", "relative_passphrase_test") -# Stub signer/toolchain for the analysis tests. Real signing requires a -# registered `sq` toolchain, see //pgp:extensions.bzl. +# Stub signer/toolchain for the analysis tests. Real signing uses the default +# registered `//pgp:sq_toolchain`. sh_binary( name = "stub_signer", srcs = ["stub_signer.sh"], diff --git a/bazel/pgp/test/signer_test.sh b/bazel/pgp/test/signer_test.sh index 722c14aaff..384a6c6191 100755 --- a/bazel/pgp/test/signer_test.sh +++ b/bazel/pgp/test/signer_test.sh @@ -6,8 +6,7 @@ # is ever committed), signs in each mode, verifies the signatures, and asserts # that the signer refuses to use an unencrypted key. # -# Skipped if no `sq` is available - the default toolchain binary is not -# fetched by default (see //pgp:extensions.bzl). +# Skipped if no `sq` is available on PATH or via SQ. set -euo pipefail diff --git a/bazel/pgp/toolchain.bzl b/bazel/pgp/toolchain.bzl index 5979627c68..219362bda0 100644 --- a/bazel/pgp/toolchain.bzl +++ b/bazel/pgp/toolchain.bzl @@ -15,7 +15,8 @@ signer --mode {detached|cleartext|inline} \\ ``` Any implementation of that contract can be dropped in without changing the -rules - the default implementation wraps Sequoia PGP's `sq`. +rules. The default implementation wraps `@sq//:sq`, built from source via the +Envoy Bazel registry. """ PgpSignerInfo = provider(