Use sq Bazel module for PGP signing

bazel/.bazelrc

@@ -12,7 +12,7 @@ common --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 common --@rules_python//python/config_settings:bootstrap_impl=script
 
 common --registry=https://bcr.bazel.build/
-common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/76440e57c1495e6e6b26e30069d42050a8ca5acb
+common --registry=https://raw.githubusercontent.com/envoyproxy/bazel-registry/9dbaa5076459279d6c86b400a7ab5a9b898cf08c
 common --experimental_repository_cache_hardlinks
 
 common --repo_env=ANDROID_HOME=

bazel/MODULE.bazel

@@ -15,6 +15,7 @@ bazel_dep(name = "rules_foreign_cc", version = "0.15.1")
 bazel_dep(name = "rules_pkg", version = "1.1.0")
 bazel_dep(name = "rules_python", version = "2.2.0")
 bazel_dep(name = "rules_shell", version = "0.8.0")
+bazel_dep(name = "sq", version = "1.4.0.envoy")
 bazel_dep(name = "protobuf", version = "35.1.bcr.envoy", repo_name = "com_google_protobuf")
 bazel_dep(name = "toolchains_llvm", version = "1.9.0.envoy", dev_dependency = True)
 
@@ -110,17 +111,6 @@ use_repo(wee8_prebuilt_ext, "wee8_prebuilt_x86_64", "wee8_prebuilt_x86_64_libstd
 # libcxx_libs_ext.setup()
 # use_repo(libcxx_libs_ext, "libcxx_libs_aarch64", "libcxx_libs_x86_64")
 
-# Setup the OpenPGP signer (`sq`) toolchain - example for downstream consumers
-# Uncomment to use in your MODULE.bazel, supplying sha256s you have verified:
-# pgp_ext = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension")
-# pgp_ext.setup(
-#     sha256s = {
-#         "linux_x86_64": "<verified sha256 of the sq binary>",
-#     },
-# )
-# use_repo(pgp_ext, "sq_linux_x86_64")
-# register_toolchains("@sq_linux_x86_64//:toolchain")
-
 # Setup grcov for code coverage - example for downstream consumers
 # Uncomment to use in your MODULE.bazel:
 # grcov_ext = use_extension("@envoy_toolshed//coverage/grcov:extensions.bzl", "grcov_extension")
@@ -189,10 +179,12 @@ use_repo(llvm, "llvm_toolchain")
 
 register_toolchains("@llvm_toolchain//:all", dev_dependency = True)
 
-# Stub OpenPGP signer used by //pgp/test analysis tests. Real signing requires
-# a `sq` toolchain, see //pgp:extensions.bzl.
+# Stub OpenPGP signer used by //pgp/test analysis tests. It is registered first
+# in dev mode so those tests resolve the stub instead of the default `sq` signer.
 register_toolchains("//pgp/test:stub_toolchain", dev_dependency = True)
 
+register_toolchains("//pgp:sq_toolchain")
+
 libcxx_ext = use_extension("//compile:extensions.bzl", "libcxx_extension", dev_dependency = True)
 use_repo(libcxx_ext, "llvm_libcxx_aarch64", "llvm_libcxx_x86_64")
 

bazel/pgp/BUILD

@@ -1,20 +1,18 @@
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
+load("//pgp:defs.bzl", "pgp_toolchain", "sq_signer")
 
 exports_files([
     "defs.bzl",
     "toolchain.bzl",
-    "extensions.bzl",
 ])
 
-# Ensures //pgp:extensions.bzl (not otherwise loaded - no `sq` platform is
-# enabled by default) and the rest of the public/private starlark surface
-# stay loadable and are covered by `bazel build //pgp/...`.
+# Ensures the public/private Starlark surface stays loadable and is covered by
+# `bazel build //pgp/...`.
 bzl_library(
     name = "pgp_bzl",
     srcs = [
         "defs.bzl",
-        "extensions.bzl",
         "toolchain.bzl",
         "//pgp/private:sign.bzl",
         "//pgp/private:sq.bzl",
@@ -28,14 +26,31 @@ bzl_library(
 
 # Toolchain type for OpenPGP signer implementations.
 #
-# The default implementation wraps Sequoia PGP's `sq` (see extensions.bzl),
-# but any binary implementing the signer CLI contract documented in
-# toolchain.bzl can be registered instead.
+# The default implementation wraps `@sq//:sq`, built from source via the Envoy
+# Bazel registry, but any binary implementing the signer CLI contract documented
+# in toolchain.bzl can be registered instead.
 toolchain_type(
     name = "toolchain_type",
     visibility = ["//visibility:public"],
 )
 
+sq_signer(
+    name = "sq_signer",
+    sq = "@sq//:sq",
+)
+
+pgp_toolchain(
+    name = "sq_signer_toolchain",
+    signer = ":sq_signer",
+)
+
+toolchain(
+    name = "sq_toolchain",
+    toolchain = ":sq_signer_toolchain",
+    toolchain_type = "//pgp:toolchain_type",
+    visibility = ["//visibility:public"],
+)
+
 # Absolute host path of the passphrase-encrypted secret key.
 #
 # The key is a host path, not an artifact in the build graph: Bazel only ever

bazel/pgp/README.md

@@ -113,28 +113,14 @@ The default implementation is a thin wrapper around Sequoia PGP's
 home directory or keyring state, used as the OpenPGP backend for `rpm` on
 Fedora/RHEL and as `sqv` in apt >= 3.0.
 
-Upstream does not publish sha256-verifiable release binaries that could be
-pinned here, so **no `sq` platform is fetched by default**. Enable the
-platform(s) you need by supplying sha256s you have verified yourself:
+The default signer uses `@sq//:sq` from the Envoy Bazel registry:
 
 ```starlark
-pgp_ext = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension")
-pgp_ext.setup(
-    sha256s = {
-        "linux_x86_64": "<verified sha256 of the sq binary>",
-    },
-)
-use_repo(pgp_ext, "sq_linux_x86_64")
-
-register_toolchains("@sq_linux_x86_64//:toolchain")
+bazel_dep(name = "sq", version = "1.4.0.envoy")
 ```
 
-`urls` can be used to point at your own audited mirror of the binary.
-
-The intended toolshed approach for this is to build and publish a pinned,
-static `sq` in the `bins-v*` release, the same way `sysroot`/`llvm_minimal`
-are, so `pgp_ext.setup()` can work with no consumer-supplied sha256 - that is
-a follow-up, not part of this rule set.
+The `sq` module is built from source, and `envoy_toolshed` registers
+`//pgp:sq_toolchain`, so consumers get signing support without extra setup.
 
 Swapping in a different signer (for example a purpose-built Rust signer) is a
 matter of registering another toolchain - the rules do not change: