90 lines
3.2 KiB
Python
90 lines
3.2 KiB
Python
|
"""Rules for downloading and embedding mongot_extension_signing_key"""
|
|||
|
|
|
|||
|
|
# This is the mongot-extension's signing public key. It is managed by garasign, and used by the
|
|||
|
|
# SignatureValidator in secure builds (i.e MONGO_CONFIG_EXT_SIG_SECURE) to verify the authenticity
|
|||
|
|
# of extensions before loading them into the server process. Whenever the remote file changes, the
|
|||
|
|
# corresponding sha256 must be changed.
|
|||
|
|
|
|||
|
|
def _impl(ctx):
|
|||
|
|
ctx.download(
|
|||
|
|
url = "https://pgp.mongodb.com/mongot-extension.pub",
|
|||
|
|
sha256 = "2a15e6a2d9f6c0d8141dad515d9360f6cf01e1a11f7e2c3bc0820e18c5e9d0b7",
|
|||
|
|
output = "mongot-extension.pub",
|
|||
|
|
)
|
|||
|
|
ctx.file("BUILD.bazel", 'exports_files(["mongot-extension.pub"])')
|
|||
|
|
|
|||
|
|
mongot_extension_signing_key_repo = repository_rule(implementation = _impl)
|
|||
|
|
|
|||
|
|
def mongot_extension_signing_key():
|
|||
|
|
mongot_extension_signing_key_repo(name = "mongot_extension_signing_key")
|
|||
|
|
|
|||
|
|
def _gpg_export_armored_key_impl(ctx):
|
|||
|
|
key = ctx.file.key
|
|||
|
|
armored_key_output_file = ctx.outputs.armored_key_output_file
|
|||
|
|
pass_file = ctx.file.passphrase
|
|||
|
|
|
|||
|
|
# Collect tool files from the filegroups
|
|||
|
|
bin_files = ctx.attr.gpg_bins.files.to_list()
|
|||
|
|
lib_files = ctx.attr.gpg_libs.files.to_list()
|
|||
|
|
|
|||
|
|
# Find the gpg executable
|
|||
|
|
gpg_bin = None
|
|||
|
|
for f in bin_files:
|
|||
|
|
if f.basename == "gpg":
|
|||
|
|
gpg_bin = f
|
|||
|
|
break
|
|||
|
|
if gpg_bin == None:
|
|||
|
|
fail("gpg binary not found in @gpg//:gpg_bins")
|
|||
|
|
|
|||
|
|
# Compute libs dir next to the bundle’s bin dir:
|
|||
|
|
# …/gpg_bundle-*/bin/gpg -> …/gpg_bundle-*/libs
|
|||
|
|
p = gpg_bin.path
|
|||
|
|
bin_dir = p[:p.rfind("/")]
|
|||
|
|
bundle_dir = bin_dir[:bin_dir.rfind("/")]
|
|||
|
|
libs_dir = bundle_dir + "/libs"
|
|||
|
|
|
|||
|
|
# Arguments your Python helper expects: <gpg> <key> <passphrase_or_empty> <armored_key_output_file>
|
|||
|
|
args = [
|
|||
|
|
gpg_bin.path,
|
|||
|
|
key.path,
|
|||
|
|
pass_file.path if pass_file else "",
|
|||
|
|
armored_key_output_file.path,
|
|||
|
|
]
|
|||
|
|
|
|||
|
|
# Create the action; stage bins/libs as tools for the exec platform
|
|||
|
|
ctx.actions.run(
|
|||
|
|
executable = ctx.executable.script,
|
|||
|
|
arguments = args,
|
|||
|
|
inputs = [key] + ([pass_file] if pass_file else []),
|
|||
|
|
tools = bin_files + lib_files + [ctx.executable.script],
|
|||
|
|
outputs = [armored_key_output_file],
|
|||
|
|
env = {"LD_LIBRARY_PATH": libs_dir},
|
|||
|
|
mnemonic = "GpgExportArmored",
|
|||
|
|
progress_message = "Export armored key to %s" % armored_key_output_file.path,
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
gpg_export_armored_key = rule(
|
|||
|
|
implementation = _gpg_export_armored_key_impl,
|
|||
|
|
attrs = {
|
|||
|
|
"key": attr.label(allow_single_file = True, mandatory = True),
|
|||
|
|
"passphrase": attr.label(allow_single_file = True),
|
|||
|
|
"armored_key_output_file": attr.output(mandatory = True),
|
|||
|
|
"script": attr.label(
|
|||
|
|
default = Label("//bazel/mongot_extension_signing_key:gpg_export_armored_key"),
|
|||
|
|
executable = True,
|
|||
|
|
cfg = "exec",
|
|||
|
|
),
|
|||
|
|
# Treat these as tools (exec config)
|
|||
|
|
"gpg_bins": attr.label(
|
|||
|
|
default = Label("@gpg//:gpg_bins"),
|
|||
|
|
allow_files = True,
|
|||
|
|
cfg = "exec",
|
|||
|
|
),
|
|||
|
|
"gpg_libs": attr.label(
|
|||
|
|
default = Label("@gpg//:gpg_libs"),
|
|||
|
|
allow_files = True,
|
|||
|
|
cfg = "exec",
|
|||
|
|
),
|
|||
|
|
},
|
|||
|
|
)
|