From 01182ce05f5932aff128c6bd04d7c7723774a4fa Mon Sep 17 00:00:00 2001 From: thesayyn Date: Fri, 10 Nov 2023 16:35:46 -0800 Subject: [PATCH] feat: port locale rule --- WORKSPACE.bazel | 18 ++++++-- distroless/BUILD.bazel | 5 ++- distroless/defs.bzl | 2 + distroless/private/BUILD.bazel | 7 +++ distroless/private/locale.bzl | 79 ++++++++++++++++++++++++++++++++++ distroless/private/tar.bzl | 24 +++++++---- docs/rules.md | 49 +++++++++++++++++++++ examples/cacerts/BUILD.bazel | 8 ++-- examples/locale/BUILD.bazel | 69 +++++++++++++++++++++++++++++ 9 files changed, 245 insertions(+), 16 deletions(-) create mode 100644 distroless/private/locale.bzl create mode 100644 examples/locale/BUILD.bazel diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel index d400e1c..fbc53d0 100644 --- a/WORKSPACE.bazel +++ b/WORKSPACE.bazel @@ -3,10 +3,22 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") http_archive( - name = "ca-certificates", + name = "bullseye-ca-certificates", build_file_content = 'exports_files(["data.tar.xz"])', - canonical_id = "test", sha256 = "b2d488ad4d8d8adb3ba319fc9cb2cf9909fc42cb82ad239a26c570a2e749c389", - type = ".deb", urls = ["https://snapshot.debian.org/archive/debian/20231106T210201Z/pool/main/c/ca-certificates/ca-certificates_20210119_all.deb"], ) + +http_archive( + name = "bullseye-libc-bin", + build_file_content = 'exports_files(["data.tar.xz"])', + sha256 = "8b048ab5c7e9f5b7444655541230e689631fd9855c384e8c4a802586d9bbc65a", + urls = ["https://snapshot.debian.org/archive/debian-security/20231106T230332Z/pool/updates/main/g/glibc/libc-bin_2.31-13+deb11u7_amd64.deb"], +) + +http_archive( + name = "bookworm-libc-bin", + build_file_content = 'exports_files(["data.tar.xz"])', + sha256 = "38c44247c5b3e864d6db2877edd9c9a0555fc4e23ae271b73d7f527802616df5", + urls = ["https://snapshot.debian.org/archive/debian-security/20231106T230332Z/pool/updates/main/g/glibc/libc-bin_2.36-9+deb12u3_armhf.deb"], +) diff --git a/distroless/BUILD.bazel b/distroless/BUILD.bazel index a8a445f..9105891 100644 --- a/distroless/BUILD.bazel +++ b/distroless/BUILD.bazel @@ -17,7 +17,10 @@ bzl_library( name = "defs", srcs = ["defs.bzl"], visibility = ["//visibility:public"], - deps = ["//distroless/private:cacerts"], + deps = [ + "//distroless/private:cacerts", + "//distroless/private:locale", + ], ) bzl_library( diff --git a/distroless/defs.bzl b/distroless/defs.bzl index 7e63f05..2fa63bb 100644 --- a/distroless/defs.bzl +++ b/distroless/defs.bzl @@ -1,5 +1,7 @@ "Public API re-exports" load("//distroless/private:cacerts.bzl", _cacerts = "cacerts") +load("//distroless/private:locale.bzl", _locale = "locale") cacerts = _cacerts +locale = _locale diff --git a/distroless/private/BUILD.bazel b/distroless/private/BUILD.bazel index 19c5083..bcf1328 100644 --- a/distroless/private/BUILD.bazel +++ b/distroless/private/BUILD.bazel @@ -9,6 +9,13 @@ bzl_library( deps = [":tar"], ) +bzl_library( + name = "locale", + srcs = ["locale.bzl"], + visibility = ["//distroless:__subpackages__"], + deps = [":tar"], +) + bzl_library( name = "tar", srcs = ["tar.bzl"], diff --git a/distroless/private/locale.bzl b/distroless/private/locale.bzl new file mode 100644 index 0000000..153c5fc --- /dev/null +++ b/distroless/private/locale.bzl @@ -0,0 +1,79 @@ +"locale" + +load(":tar.bzl", "tar_lib") + +_DOC = """Create a ca-certificates.crt bundle from Common CA certificates. + +When provided with the `ca-certificates` Debian package it will create a bundle +of all common CA certificates at `/usr/share/ca-certificates` and bundle them into +a `ca-certificates.crt` file at `/etc/ssl/certs/ca-certificates.crt` + +An example of this would be + +```starlark +# MODULE.bazel +http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") + +http_archive( + name = "ca-certificates", + type = ".deb", + canonical_id = "test", + sha256 = "b2d488ad4d8d8adb3ba319fc9cb2cf9909fc42cb82ad239a26c570a2e749c389", + urls = ["https://snapshot.debian.org/archive/debian/20231106T210201Z/pool/main/c/ca-certificates/ca-certificates_20210119_all.deb"], + build_file_content = "exports_files(["data.tar.xz"])" +) + +# BUILD.bazel +load("@rules_distroless//distroless:defs.bzl", "locale") + +locale( + name = "example", + package = "@ca-certificates//:data.tar.xz", +) +``` +""" + +def _locale_impl(ctx): + bsdtar = ctx.toolchains[tar_lib.TOOLCHAIN_TYPE] + + output = ctx.actions.declare_file(ctx.attr.name + ".tar.gz") + + args = ctx.actions.args() + args.add("--create") + args.add("--gzip") + args.add("--file", output) + args.add("--include", "^./usr/$") + args.add("--include", "^./usr/lib/$") + args.add("--include", "^./usr/lib/locale/$") + args.add("--include", "./usr/lib/locale/%s" % ctx.attr.charset) + args.add("--include", "^./usr/share/$") + args.add("--include", "^./usr/share/doc/$") + args.add("--include", "^./usr/share/doc/libc-bin/$") + args.add("--include", "^./usr/share/doc/libc-bin/copyright$") + args.add(ctx.file.package, format = "@%s") + + ctx.actions.run( + executable = bsdtar.tarinfo.binary, + inputs = [ctx.file.package], + outputs = [output], + tools = bsdtar.default.files, + arguments = [args], + ) + return [ + DefaultInfo(files = depset([output])), + ] + +locale = rule( + doc = _DOC, + attrs = { + "package": attr.label( + allow_single_file = [".tar.xz", ".tar.gz", ".tar"], + mandatory = True, + ), + "charset": attr.string( + default = "C.utf8", + ), + }, + implementation = _locale_impl, + toolchains = [tar_lib.TOOLCHAIN_TYPE], +) diff --git a/distroless/private/tar.bzl b/distroless/private/tar.bzl index e95bf8e..9160976 100644 --- a/distroless/private/tar.bzl +++ b/distroless/private/tar.bzl @@ -15,7 +15,7 @@ def _mtree_line(file, type, content = None, uid = "0", gid = "0", time = "167256 spec.append("content=" + content) return " ".join(spec) -def _add_file_with_parents(path, file): +def _add_parents(path): lines = [] segments = path.split("/") for i in range(1, len(segments)): @@ -23,24 +23,24 @@ def _add_file_with_parents(path, file): if parent == "": continue lines.append(_mtree_line(parent.lstrip("/"), "dir")) + return lines +def _add_file_with_parents(path, file): + lines = _add_parents(path) lines.append(_mtree_line(path.lstrip("/"), "file", content = file.path)) return lines -def _build_tar(ctx, mtree, output, inputs, compression = "gzip", mnemonic = "Tar"): +def _build_tar(ctx, mtree, output, inputs = [], compression = "gzip", mnemonic = "Tar"): bsdtar = ctx.toolchains[BSDTAR_TOOLCHAIN] - mtree_out = ctx.actions.declare_file(ctx.label.name + ".spec") - ctx.actions.write(mtree_out, content = mtree) - inputs = inputs[:] - inputs.append(mtree_out) + inputs.append(mtree) args = ctx.actions.args() args.add("--create") args.add(compression, format = "--%s") args.add("--file", output) - args.add(mtree_out, format = "@%s") + args.add(mtree, format = "@%s") ctx.actions.run( executable = bsdtar.tarinfo.binary, @@ -51,6 +51,11 @@ def _build_tar(ctx, mtree, output, inputs, compression = "gzip", mnemonic = "Tar mnemonic = mnemonic, ) +def _build_mtree(ctx, content): + mtree_out = ctx.actions.declare_file(ctx.label.name + ".spec") + ctx.actions.write(mtree_out, content = content) + return mtree_out + def _create_mtree(ctx): content = ctx.actions.args() content.set_param_file_format("multiline") @@ -58,12 +63,15 @@ def _create_mtree(ctx): return struct( line = lambda **kwargs: content.add(_mtree_line(**kwargs)), add_file_with_parents = lambda *args, **kwargs: content.add_all(_add_file_with_parents(*args), uniquify = kwargs.pop("uniqify", True)), - build = lambda **kwargs: _build_tar(ctx, content, **kwargs), + add_parents = lambda *args, **kwargs: content.add_all(_add_parents(*args), uniquify = kwargs.pop("uniqify", True)), + build = lambda **kwargs: _build_tar(ctx, _build_mtree(ctx, content), **kwargs), + build_mtree = lambda **kwargs: _build_mtree(ctx, content), ) tar_lib = struct( create_mtree = _create_mtree, line = _mtree_line, + add_directory_with_parents = _add_file_with_parents, add_file_with_parents = _add_file_with_parents, TOOLCHAIN_TYPE = BSDTAR_TOOLCHAIN, ) diff --git a/docs/rules.md b/docs/rules.md index 259a3ed..da50da5 100644 --- a/docs/rules.md +++ b/docs/rules.md @@ -50,3 +50,52 @@ cacerts( | package | - | Label | required | | + + +## locale + +
+locale(name, charset, package)
+
+ +Create a ca-certificates.crt bundle from Common CA certificates. + +When provided with the `ca-certificates` Debian package it will create a bundle +of all common CA certificates at `/usr/share/ca-certificates` and bundle them into +a `ca-certificates.crt` file at `/etc/ssl/certs/ca-certificates.crt` + +An example of this would be + +```starlark +# MODULE.bazel +http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") + +http_archive( + name = "ca-certificates", + type = ".deb", + canonical_id = "test", + sha256 = "b2d488ad4d8d8adb3ba319fc9cb2cf9909fc42cb82ad239a26c570a2e749c389", + urls = ["https://snapshot.debian.org/archive/debian/20231106T210201Z/pool/main/c/ca-certificates/ca-certificates_20210119_all.deb"], + build_file_content = "exports_files(["data.tar.xz"])" +) + +# BUILD.bazel +load("@rules_distroless//distroless:defs.bzl", "locale") + +locale( + name = "example", + package = "@ca-certificates//:data.tar.xz", +) +``` + + +**ATTRIBUTES** + + +| Name | Description | Type | Mandatory | Default | +| :------------- | :------------- | :------------- | :------------- | :------------- | +| name | A unique name for this target. | Name | required | | +| charset | - | String | optional | "C.utf8" | +| package | - | Label | required | | + + diff --git a/examples/cacerts/BUILD.bazel b/examples/cacerts/BUILD.bazel index 34712c6..b955762 100644 --- a/examples/cacerts/BUILD.bazel +++ b/examples/cacerts/BUILD.bazel @@ -2,13 +2,13 @@ load("//distroless:defs.bzl", "cacerts") load("//distroless/tests:asserts.bzl", "assert_tar_listing") cacerts( - name = "example", - package = "@ca-certificates//:data.tar.xz", + name = "cacerts", + package = "@bullseye-ca-certificates//:data.tar.xz", ) assert_tar_listing( - name = "test_examples", - actual = "example", + name = "test_cacerts", + actual = "cacerts", expected = """\ drwxr-xr-x 0 0 0 0 Jan 1 2023 etc/ drwxr-xr-x 0 0 0 0 Jan 1 2023 etc/ssl/ diff --git a/examples/locale/BUILD.bazel b/examples/locale/BUILD.bazel new file mode 100644 index 0000000..fb2d40c --- /dev/null +++ b/examples/locale/BUILD.bazel @@ -0,0 +1,69 @@ +load("//distroless:defs.bzl", "locale") +load("//distroless/tests:asserts.bzl", "assert_tar_listing") + +locale( + name = "bullseye", + charset = "C.UTF-8", + package = "@bullseye-libc-bin//:data.tar.xz", +) + +assert_tar_listing( + name = "test_bullseye", + actual = "bullseye", + expected = """\ +drwxr-xr-x 0 root root 0 Oct 2 13:22 ./usr/ +drwxr-xr-x 0 root root 0 Oct 2 13:22 ./usr/lib/ +drwxr-xr-x 0 root root 0 Oct 2 13:22 ./usr/lib/locale/ +drwxr-xr-x 0 root root 0 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/ +-rw-r--r-- 0 root root 131 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_ADDRESS +-rw-r--r-- 0 root root 1519554 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_COLLATE +-rw-r--r-- 0 root root 346132 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_CTYPE +-rw-r--r-- 0 root root 252 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_IDENTIFICATION +-rw-r--r-- 0 root root 23 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_MEASUREMENT +drwxr-xr-x 0 root root 0 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_MESSAGES/ +-rw-r--r-- 0 root root 48 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_MESSAGES/SYS_LC_MESSAGES +-rw-r--r-- 0 root root 270 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_MONETARY +-rw-r--r-- 0 root root 62 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_NAME +-rw-r--r-- 0 root root 50 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_NUMERIC +-rw-r--r-- 0 root root 34 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_PAPER +-rw-r--r-- 0 root root 47 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_TELEPHONE +-rw-r--r-- 0 root root 3360 Oct 2 13:22 ./usr/lib/locale/C.UTF-8/LC_TIME +drwxr-xr-x 0 root root 0 Oct 2 13:22 ./usr/share/ +drwxr-xr-x 0 root root 0 Oct 2 13:22 ./usr/share/doc/ +drwxr-xr-x 0 root root 0 Oct 2 13:22 ./usr/share/doc/libc-bin/ +-rw-r--r-- 0 root root 25467 Sep 22 2022 ./usr/share/doc/libc-bin/copyright +""", +) + +locale( + name = "bookworm", + package = "@bookworm-libc-bin//:data.tar.xz", +) + +assert_tar_listing( + name = "test_bookworm", + actual = "bookworm", + expected = """\ +drwxr-xr-x 0 root root 0 Sep 30 01:31 ./usr/ +drwxr-xr-x 0 root root 0 Sep 30 01:31 ./usr/lib/ +drwxr-xr-x 0 root root 0 Sep 30 01:31 ./usr/lib/locale/ +drwxr-xr-x 0 root root 0 Sep 30 01:31 ./usr/lib/locale/C.utf8/ +-rw-r--r-- 0 root root 127 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_ADDRESS +-rw-r--r-- 0 root root 1406 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_COLLATE +-rw-r--r-- 0 root root 353616 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_CTYPE +-rw-r--r-- 0 root root 258 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_IDENTIFICATION +-rw-r--r-- 0 root root 23 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_MEASUREMENT +drwxr-xr-x 0 root root 0 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_MESSAGES/ +-rw-r--r-- 0 root root 48 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES +-rw-r--r-- 0 root root 270 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_MONETARY +-rw-r--r-- 0 root root 62 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_NAME +-rw-r--r-- 0 root root 50 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_NUMERIC +-rw-r--r-- 0 root root 34 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_PAPER +-rw-r--r-- 0 root root 47 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_TELEPHONE +-rw-r--r-- 0 root root 3360 Sep 30 01:31 ./usr/lib/locale/C.utf8/LC_TIME +drwxr-xr-x 0 root root 0 Sep 30 01:31 ./usr/share/ +drwxr-xr-x 0 root root 0 Sep 30 01:31 ./usr/share/doc/ +drwxr-xr-x 0 root root 0 Sep 30 01:31 ./usr/share/doc/libc-bin/ +-rw-r--r-- 0 root root 25467 Sep 22 2022 ./usr/share/doc/libc-bin/copyright +""", +)