wip

BUILD.bazel

@@ -1,5 +1,5 @@
 load("@gazelle//:def.bzl", "gazelle")
-load("@tweag-credential-helper//plugin:defs.bzl", "credential_helper")
+load("@tweag-credential-helper//bzl:defs.bzl", "credential_helper")
 
 credential_helper(
     name = "tweag-credential-helper",
@@ -23,9 +23,13 @@ filegroup(
         "WORKSPACE",
         "go.mod",
         "go.sum",
+        "prebuilt_lockfile.json",
         "tools/credential-helper",
     ],
     visibility = ["//:__subpackages__"],
 )
 
-exports_files(["tools/credential-helper"])
+exports_files([
+    "prebuilt_lockfile.json",
+    "tools/credential-helper",
+])

MODULE.bazel

@@ -4,6 +4,7 @@ module(
     compatibility_level = 0,
 )
 
+bazel_dep(name = "platforms", version = "0.0.10")
 bazel_dep(name = "rules_go", version = "0.50.1")
 bazel_dep(name = "gazelle", version = "0.40.0")
 
@@ -19,6 +20,14 @@ use_repo(
     "org_golang_x_oauth2",
 )
 
+prebuilt = use_extension("//bzl:defs.bzl", "prebuilt_credential_helpers")
+prebuilt.collection(name = "tweag-credential-helper-prebuilt")
+prebuilt.from_file(collection = "tweag-credential-helper-prebuilt", file = "//:prebuilt_lockfile.json")
+use_repo(
+    prebuilt,
+    "tweag-credential-helper-prebuilt",
+)
+
 # ✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂
 # only dev_dependencies below this line
 # ✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂✂
@@ -28,7 +37,6 @@ bazel_dep(
     version = "1.0.1",
     dev_dependency = True,
 )
-
 bazel_dep(
     name = "rules_bazel_integration_test",
     version = "0.27.0",
@@ -49,3 +57,6 @@ use_repo(bazel_binaries, "bazel_binaries", "bazel_binaries_bazelisk", "build_baz
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk", dev_dependency = True)
 go_sdk.download(version = "1.23.3")
+
+module_version = use_extension("//bzl/private/config:defs.bzl", "module_version", dev_dependency = True)
+use_repo(module_version, "tweag-credential-helper-version")

bzl/defs.bzl

@@ -0,0 +1,13 @@
+load(
+    "//bzl/private/plugin:plugin.bzl",
+    _credential_helper = "credential_helper",
+    _installer = "installer",
+)
+load(
+    "//bzl/private/prebuilt:prebuilt.bzl",
+    _prebuilt_credential_helpers = "prebuilt_credential_helpers",
+)
+
+credential_helper = _credential_helper
+installer = _installer
+prebuilt_credential_helpers = _prebuilt_credential_helpers

bzl/private/BUILD.bazel

@@ -0,0 +1,5 @@
+filegroup(
+    name = "all_files",
+    srcs = glob(["*"]),
+    visibility = ["//:__subpackages__"],
+)

bzl/private/config/BUILD.bazel

@@ -0,0 +1,23 @@
+load(":defs.bzl", "os_cpu")
+
+os_cpu(
+    name = "target_os_cpu",
+    cpu = select({
+        "@platforms//cpu:arm64": "arm64",
+        "@platforms//cpu:x86_32": "386",
+        "@platforms//cpu:x86_64": "amd64",
+        "@platforms//cpu:riscv64": "riscv64",
+    }),
+    os = select({
+        "@platforms//os:linux": "linux",
+        "@platforms//os:macos": "darwin",
+        "@platforms//os:windows": "windows",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "all_files",
+    srcs = glob(["*"]),
+    visibility = ["//:__subpackages__"],
+)

bzl/private/config/defs.bzl

@@ -0,0 +1,72 @@
+HelperTargetPlatformInfo = provider(
+    doc = "Information on the target platform of the credential helper",
+    fields = {
+        "os": "The OS (as GOOS)",
+        "cpu": "The cpu / arch (as GOARCH)",
+    },
+)
+
+ModuleVersionInfo = provider(
+    doc = "Metadata on the version of a module",
+    fields = {
+        "version": "The version (as defined in module function of MODULE.bazel)",
+    },
+)
+
+def _os_cpu_impl(ctx):
+    return [HelperTargetPlatformInfo(
+        os = ctx.attr.os,
+        cpu = ctx.attr.cpu,
+    )]
+
+os_cpu = rule(
+    implementation = _os_cpu_impl,
+    attrs = {
+        "os": attr.string(),
+        "cpu": attr.string(),
+    },
+)
+
+def _version_impl(ctx):
+    return [ModuleVersionInfo(version = ctx.attr.version)]
+
+version = rule(
+    implementation = _version_impl,
+    attrs = {"version": attr.string()},
+)
+
+def _version_repo_impl(rctx):
+    rctx.file(
+        "BUILD.bazel",
+        content = """load("@tweag-credential-helper//bzl/private/config:defs.bzl", "version")
+
+version(
+    name = "tweag-credential-helper-version",
+    version = "{}",
+    visibility = ["//visibility:public"],
+)
+""".format(rctx.attr.version),
+    )
+
+version_repo = repository_rule(
+    implementation = _version_repo_impl,
+    attrs = {"version": attr.string()},
+)
+
+def _module_version_impl(ctx):
+    if len(ctx.modules) != 1:
+        fail("this extension should only be used by @tweag-credential-helper")
+    module = ctx.modules[0]
+    version_repo(
+        name = "tweag-credential-helper-version",
+        version = module.version,
+    )
+    return ctx.extension_metadata(
+        root_module_direct_deps = [],
+        root_module_direct_dev_deps = ["tweag-credential-helper-version"],
+        reproducible = True,
+    )
+
+module_version = module_extension(
+    implementation = _module_version_impl,
+)

bzl/private/lockfile/BUILD.bazel

@@ -0,0 +1,20 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "lockfile_lib",
+    srcs = ["lockfile.go"],
+    importpath = "github.com/tweag/credential-helper/bzl/private/lockfile",
+    visibility = ["//visibility:private"],
+)
+
+go_binary(
+    name = "lockfile",
+    embed = [":lockfile_lib"],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "all_files",
+    srcs = glob(["*"]),
+    visibility = ["//:__subpackages__"],
+)

bzl/private/lockfile/lockfile.go

@@ -0,0 +1,102 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+)
+
+type platformBinaries []struct {
+	os   string
+	cpu  string
+	path string
+}
+
+func (pb *platformBinaries) String() string {
+	return fmt.Sprintf("%v", *pb)
+}
+
+func (pb *platformBinaries) Set(value string) error {
+	kv := strings.SplitN(value, "=", 2)
+	if len(kv) != 2 {
+		return fmt.Errorf("invalid value: expected key value pair separated by =")
+	}
+	os_cpu := strings.SplitN(kv[0], "_", 2)
+	if len(os_cpu) != 2 {
+		return fmt.Errorf("invalid value: expected os and cpu separated by _")
+	}
+	*pb = append(*pb, struct {
+		os   string
+		cpu  string
+		path string
+	}{
+		os:   os_cpu[0],
+		cpu:  os_cpu[1],
+		path: kv[1],
+	})
+	return nil
+}
+
+type lockfileItem struct {
+	Version   string `json:"version"`
+	Integrity string `json:"integrity"`
+	OS        string `json:"os"`
+	CPU       string `json:"cpu"`
+}
+
+var (
+	version  string
+	binaries platformBinaries
+)
+
+func main() {
+	flag.StringVar(&version, "version", "0.0.0", "Version of the helper.")
+	flag.Var(&binaries, "helper", "Key-value pairs of platform name to helper binary path.")
+	flag.Parse()
+	if flag.NArg() != 1 {
+		fmt.Fprintln(os.Stderr, "expected lockfile output")
+		os.Exit(1)
+	}
+	var lockfileItems []lockfileItem
+	for _, bin := range binaries {
+		sri, err := fileSRI(bin.path)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "calculating sri of %s: %v\n", bin.path, err)
+			os.Exit(1)
+		}
+		lockfileItems = append(lockfileItems, lockfileItem{
+			Version:   "v" + version,
+			Integrity: sri,
+			OS:        bin.os,
+			CPU:       bin.cpu,
+		})
+	}
+	lockfile, err := json.Marshal(lockfileItems)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "marshaling lockfile: %v\n", err)
+		os.Exit(1)
+	}
+	if err := os.WriteFile(flag.Arg(0), lockfile, os.ModePerm); err != nil {
+		fmt.Fprintf(os.Stderr, "writing lockfile: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func fileSRI(source string) (string, error) {
+	reader, err := os.Open(source)
+	if err != nil {
+		return "", err
+	}
+	defer reader.Close()
+	hash := sha256.New()
+	_, err = io.Copy(hash, reader)
+	if err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("sha256-%s", base64.StdEncoding.EncodeToString([]byte(hash.Sum(nil)))), nil
+}

plugin/cache.go.tpl → bzl/private/plugin/cache.go.tpl

@@ -4,7 +4,7 @@ import real "{{IMPORTPATH}}"
 
 // newCache constructs the customizable Cache.
 // It is generated using the template under
-// @tweag-credential-helper//plugin:cache.go.tpl
+// @tweag-credential-helper//bzl/private/plugin:cache.go.tpl
 // when building with Bazel.
 // Building with Go directly, this would
 // instead always use `cache.MemCache`.

plugin/helperfactory.go.tpl → bzl/private/plugin/helperfactory.go.tpl

@@ -4,7 +4,7 @@ import real "{{IMPORTPATH}}"
 
 // helperFactory is the customizable factory.
 // It is generated using the template under
-// @tweag-credential-helper//plugin:helperfactory.go.tpl
+// @tweag-credential-helper//bzl/private/plugin:helperfactory.go.tpl
 // when building with Bazel.
 // Building with Go directly, this would
 // instead always use `fallback.FallbackHelperFactory`.