pgp: convert signing key to host path build setting

.github/workflows/bazel.yml

@@ -346,6 +346,17 @@ jobs:
           rbe: false
           runner: ubuntu-24.04-arm
           targets: //compile/test:cross_compile_x86_64_no_unwind_test
+        # Live counterpart of //pgp/test:audit_test - re-runs the audit
+        # against a real `bazel aquery` of //pgp/test's example targets
+        # rather than captured JSON (see bazel/pgp/README.md#auditing).
+        - name: pgp-live-audit
+          action: run
+          bazel_args: --config=ci
+          bazel_mode: bzlmod
+          privileged: false
+          rbe: false
+          runner: ubuntu-24.04
+          targets: //pgp/test:live_audit
 
   status:
     runs-on: ubuntu-24.04

bazel/MODULE.bazel

@@ -109,6 +109,17 @@ use_repo(wee8_prebuilt_ext, "wee8_prebuilt_x86_64", "wee8_prebuilt_x86_64_libstd
 # libcxx_libs_ext.setup()
 # use_repo(libcxx_libs_ext, "libcxx_libs_aarch64", "libcxx_libs_x86_64")
 
+# Setup the OpenPGP signer (`sq`) toolchain - example for downstream consumers
+# Uncomment to use in your MODULE.bazel, supplying sha256s you have verified:
+# pgp_ext = use_extension("@envoy_toolshed//pgp:extensions.bzl", "pgp_extension")
+# pgp_ext.setup(
+#     sha256s = {
+#         "linux_x86_64": "<verified sha256 of the sq binary>",
+#     },
+# )
+# use_repo(pgp_ext, "sq_linux_x86_64")
+# register_toolchains("@sq_linux_x86_64//:toolchain")
+
 # Setup grcov for code coverage - example for downstream consumers
 # Uncomment to use in your MODULE.bazel:
 # grcov_ext = use_extension("@envoy_toolshed//coverage/grcov:extensions.bzl", "grcov_extension")
@@ -171,6 +182,10 @@ use_repo(llvm, "llvm_toolchain")
 
 register_toolchains("@llvm_toolchain//:all", dev_dependency = True)
 
+# Stub OpenPGP signer used by //pgp/test analysis tests. Real signing requires
+# a `sq` toolchain, see //pgp:extensions.bzl.
+register_toolchains("//pgp/test:stub_toolchain", dev_dependency = True)
+
 libcxx_ext = use_extension("//compile:extensions.bzl", "libcxx_extension", dev_dependency = True)
 use_repo(libcxx_ext, "llvm_libcxx_aarch64", "llvm_libcxx_x86_64")
 

bazel/WORKSPACE

@@ -40,3 +40,7 @@ website_install_deps()
 
 load("//dependency/test:reachability_test_extension.bzl", "reachability_test_repos")
 reachability_test_repos()
+
+# Stub OpenPGP signer used by //pgp/test analysis tests. Real signing requires
+# a `sq` toolchain, see //pgp:extensions.bzl.
+register_toolchains("//pgp/test:stub_toolchain")

bazel/pgp/BUILD

@@ -0,0 +1,63 @@
+load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
+load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
+
+exports_files([
+    "defs.bzl",
+    "toolchain.bzl",
+    "extensions.bzl",
+])
+
+# Ensures //pgp:extensions.bzl (not otherwise loaded - no `sq` platform is
+# enabled by default) and the rest of the public/private starlark surface
+# stay loadable and are covered by `bazel build //pgp/...`.
+bzl_library(
+    name = "pgp_bzl",
+    srcs = [
+        "defs.bzl",
+        "extensions.bzl",
+        "toolchain.bzl",
+        "//pgp/private:sign.bzl",
+        "//pgp/private:sq.bzl",
+    ],
+    visibility = ["//visibility:private"],
+    deps = [
+        "@bazel_skylib//rules:common_settings",
+    ],
+)
+
+# Toolchain type for OpenPGP signer implementations.
+#
+# The default implementation wraps Sequoia PGP's `sq` (see extensions.bzl),
+# but any binary implementing the signer CLI contract documented in
+# toolchain.bzl can be registered instead.
+toolchain_type(
+    name = "toolchain_type",
+    visibility = ["//visibility:public"],
+)
+
+# Absolute host path of the passphrase-encrypted secret key.
+#
+# The key is a host path, not an artifact in the build graph: Bazel only ever
+# sees the path, never the key file contents. The file is read by the signer at
+# execution time.
+#
+# It must not live under the Bazel output tree or any artifact upload path.
+string_flag(
+    name = "key_path",
+    build_setting_default = "",
+    visibility = ["//visibility:public"],
+)
+
+# Absolute host path of the file containing the passphrase for the signing
+# key.
+#
+# The passphrase is deliberately *not* part of the build graph: only this
+# path is seen by Bazel, and only the path (never the passphrase) appears on
+# the signer command line. The file is read by the signer at execution time.
+#
+# It must not live under the Bazel output tree or any artifact upload path.
+string_flag(
+    name = "passphrase_path",
+    build_setting_default = "",
+    visibility = ["//visibility:public"],
+)