Repository navigation
[bazel] Migrate hsmtool dependency to opentitan-signing-infra - #343
Merged
Merged
Conversation
Replace the legacy @lowrisc_opentitan_head http_archive, hsmtool_head_index Cargo universe, and lowrisc_serde_annotate archive workarounds with the standalone @opentitan_signing_infra Bzlmod module (2026-09-03-release-1): - Add bazel_dep + archive_override for opentitan_signing_infra (tag 2026-09-03-release-1) in MODULE.bazel, register nightly/2025-09-18 host Rust toolchain (edition 2021) compatible with both @opentitan_signing_infra//hsmtool and @lowrisc_opentitan//sw/host/opentitanlib, and regenerate MODULE.bazel.lock. - Update hsmtool target references in rules/hsm.bzl and release/BUILD.bazel to @opentitan_signing_infra//hsmtool. - Switch otlib_wrapper to rust_static_library so rustc bundles its allocator shim when linking into C++ ATE test binaries under rules_rust 0.59.2. - Remove obsolete OpenSSL hsmtool flags in nix/bazel.nix, update hsmtool target/install paths, and update the vendor FOD sha256Hash. Fixes lowRISC#342 Signed-off-by: Willy Zhang <willyzhang@google.com>
willyzha
force-pushed
the
update-hsmtool-signing-infra
branch
from
October 22, 2026 03:06
89471cd to
7ee2f63
Compare
sasdf
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the legacy
@lowrisc_opentitan_headhttp_archive,hsmtool_head_indexcrate universe, andlowrisc_serde_annotatearchive workarounds with the standalonelowRISC/opentitan-signing-infraBzlmod module (2026-09-03-release-1).Changes
MODULE.bazel/MODULE.bazel.lock:bazel_dep+archive_overrideforopentitan_signing_infrapinned to release tag2026-09-03-release-1.lowrisc_opentitan_head,hsmtool_head_index, andlowrisc_serde_annotate.nightly/2025-09-18host Rust toolchain (rust_host, defaultedition = "2021") compatible with both@opentitan_signing_infra//hsmtooland@lowrisc_opentitan//sw/host/opentitanlib.bazel_skylib(1.8.2) andrules_cc(0.2.19) versions and regenerateMODULE.bazel.lock.rules/hsm.bzl&release/BUILD.bazel:_hsmtooland release bundle targets to@opentitan_signing_infra//hsmtool.src/ate/test_programs/otlib_wrapper/BUILD.bazel:otlib_wrapperfromrust_library(rlib) torust_static_library(staticlib) sorustcbundles its own allocator shim when linking into C++ ATE test binaries (cp,ft) underrules_rust0.59.2.nix/bazel.nix:OPENSSL_STATICand@lowrisc_opentitan_headpkg-config flags, updatehsmtoolbuild/install paths to@opentitan_signing_infra//hsmtool, and updatesha256Hash.Verification
bazelisk test //quality/...bazelisk build //...,--//src/pa/services:use_vendor_shim //src/pa/services:pa,//release:release_bundle --define pq=true, and--stamp //release:release --define "env=prod"bazelisk test --test_tag_filters=-lint,-fpga //...andbazelisk test //src/ate/test_programs:ate_dll_smoke_test./tests/run_pa_loadtest.sh --pqand./tests/run_pa_loadtest.shnix build path:.#bazel-deps-cache path:.#allandnix flake checkFixes #342