Skip to content

[bazel] Migrate hsmtool dependency to opentitan-signing-infra #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
willyzha merged 1 commit into from
Oct 23, 2026
Merged

[bazel] Migrate hsmtool dependency to opentitan-signing-infra #343

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
93 changes: 33 additions & 60 deletions MODULE.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ single_version_override(
module_name = "abseil-cpp",
version = "20240722.0.bcr.1",
)
bazel_dep(name = "bazel_skylib", version = "1.8.1")
bazel_dep(name = "bazel_skylib", version = "1.8.2")
bazel_dep(name = "googletest", version = "1.15.2", repo_name = "com_google_googletest")
single_version_override(
module_name = "googletest",
Expand All @@ -31,7 +31,7 @@ bazel_dep(name = "upb", version = "0.0.0-20230907-e7430e6")

bazel_dep(name = "rules_apple", version = "3.16.1")
bazel_dep(name = "rules_swift", version = "2.1.1", repo_name = "build_bazel_rules_swift")
bazel_dep(name = "rules_cc", version = "0.1.2")
bazel_dep(name = "rules_cc", version = "0.2.19")
bazel_dep(name = "rules_pkg", version = "1.0.1")
bazel_dep(name = "rules_proto", version = "7.0.2")
bazel_dep(name = "aspect_rules_lint", version = "1.0.8")
Expand Down Expand Up @@ -88,16 +88,13 @@ archive_override(
urls = ["https://github.com/lowRISC/opentitan/archive/refs/tags/Earlgrey-A2-Orchestrator-RC4.tar.gz"],
)

# OpenTitan at HEAD for hsmtool
http_archive(
name = "lowrisc_opentitan_head",
integrity = "sha256-FDGAr+6VAVnlMet3TA9f0gX3Ho/0zkogaIpXD/GMFgg=",
patch_cmds = [
"find . -type f \\( -name BUILD -o -name \"*.bazel\" -o -name \"*.bzl\" \\) -exec sed -i 's|@crate_index|@hsmtool_head_index|g' {} +",
"sed -i '1s/^/#![feature(let_chains)]\\n/' sw/host/hsmtool/src/lib.rs",
],
strip_prefix = "opentitan-9d860390d78396493feaf5649d4237c11cb26310",
urls = ["https://github.com/lowRISC/opentitan/archive/9d860390d78396493feaf5649d4237c11cb26310.tar.gz"],
# OpenTitan Signing Infrastructure (hsmtool)
bazel_dep(name = "opentitan_signing_infra", version = "0.0.0")
archive_override(
module_name = "opentitan_signing_infra",
integrity = "sha256-v7WqgkRbp0J9xz9PRTF+935XE2aQBKO37eajLUtIOQ8=",
strip_prefix = "opentitan-signing-infra-2026-09-03-release-1",
urls = ["https://github.com/lowRISC/opentitan-signing-infra/archive/refs/tags/2026-09-03-release-1.tar.gz"],
)

# -------------------------------------------------------------------------
Expand Down Expand Up @@ -244,49 +241,37 @@ single_version_override(
version = "0.59.2",
)

rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
rust.repository_set(
name = "rust_host",
edition = "2021",
exec_triple = "x86_64-unknown-linux-gnu",
sha256s = {
"2025-09-18/rustc-nightly-x86_64-unknown-linux-gnu.tar.xz": "3697c632f64ad996dfc4b8c826b6332ea51504319fef544f1d763b7644ff4cee",
"2025-09-18/clippy-nightly-x86_64-unknown-linux-gnu.tar.xz": "aff1e22238eadb53c72912631e06e61e038bd498d228a329e734939500ff067a",
"2025-09-18/cargo-nightly-x86_64-unknown-linux-gnu.tar.xz": "eeb668d8fd913cbc21b6d3691af7c5488b12d3e0a57535638aca3ffa25d1f1cd",
"2025-09-18/llvm-tools-nightly-x86_64-unknown-linux-gnu.tar.xz": "cd30d2990a70cf76ca8cfa368c09aa8c5cda615deef3862197a9a847534fc23b",
"2025-09-18/rust-std-nightly-x86_64-unknown-linux-gnu.tar.xz": "f5c86f20f71f0ae3a42f2bfc41791e7615aa2e239276b57506a0db0ce471c253",
},
target_compatible_with = [
"@platforms//cpu:x86_64",
"@platforms//os:linux",
],
target_triple = "x86_64-unknown-linux-gnu",
versions = ["nightly/2025-09-18"],
)
use_repo(rust, "rust_toolchains")

register_toolchains("@rust_toolchains//:all")

crate = use_extension("@rules_rust//crate_universe:extension.bzl", "crate")
crate.from_cargo(
name = "provisioning_index",
cargo_lockfile = "@lowrisc_opentitan//third_party/rust:Cargo.lock",
manifests = ["@lowrisc_opentitan//third_party/rust:Cargo.toml"],
supported_platform_triples = ["x86_64-unknown-linux-gnu"],
)
crate.from_cargo(
name = "hsmtool_head_index",
cargo_lockfile = "@lowrisc_opentitan_head//third_party/rust:Cargo.lock",
manifests = ["@lowrisc_opentitan_head//third_party/rust:Cargo.toml"],
supported_platform_triples = ["x86_64-unknown-linux-gnu"],
)
crate.annotation(
crate = "cryptoki",
repositories = ["hsmtool_head_index"],
)
crate.annotation(
additive_build_file_content = """
filegroup(
name = "cryptoki-sys-binding-srcs",
srcs = [
"src/bindings/x86_64-unknown-linux-gnu.rs",
],
visibility = ["//visibility:public"],
)
""",
crate = "cryptoki-sys",
extra_aliased_targets = {
"cryptoki-sys-binding-srcs": "cryptoki-sys-binding-srcs",
},
repositories = ["hsmtool_head_index"],
)
crate.annotation(
build_script_env = {
"PKG_CONFIG_PATH": "$(OPENSSL_PKG_CONFIG_PATH)",
"OPENSSL_STATIC": "1",
},
build_script_toolchains = ["@lowrisc_opentitan_head//third_party/rust:openssl_pkg_config_path"],
crate = "openssl-sys",
repositories = ["hsmtool_head_index"],
)
use_repo(crate, "crate_index", "hsmtool_head_index", "provisioning_index")
use_repo(crate, "crate_index", "provisioning_index")

register_toolchains("@lowrisc_opentitan//third_party/rust:bindgen_toolchain")

Expand Down Expand Up @@ -439,15 +424,3 @@ use_repo(
"sphincsplus_sha256_kat",
"sphincsplus_shake256_kat",
)

# -------------------------------------------------------------------------
# Rust Extensions
# -------------------------------------------------------------------------

http_archive(
name = "lowrisc_serde_annotate",
integrity = "sha256-pT+WAj/aVJADXzwHjNmKXIDh+7yWiy8ti8dENmDb7z4=",
patch_cmds = ["find . -type f \\( -name BUILD -o -name \"*.bazel\" -o -name \"*.bzl\" \\) -exec sed -i 's|@crate_index|@hsmtool_head_index|g' {} +"],
strip_prefix = "serde-annotate-0.0.13",
url = "https://github.com/lowRISC/serde-annotate/archive/refs/tags/v0.0.13.tar.gz",
)
8,770 changes: 3,501 additions & 5,269 deletions MODULE.bazel.lock
View file
Open in desktop

Large diffs are not rendered by default.

12 changes: 5 additions & 7 deletions nix/bazel.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ let
# 1. Temporarily replace sha256Hash with pkgs.lib.fakeHash (or "").
# 2. Run: nix build path:.#all
# 3. Copy the computed SHA-256 mismatch hash back here.
sha256Hash = "sha256-0k8kErJBVYKmQXGPEdFUFJQVnKCUIx92KPXdkBqBf+Q=";
sha256Hash = "sha256-02zsMIPA3R1Pwkd4wzHu5c5m2/z72AWsyHHc8Bswhe0=";

# Full source tree for Stage 3 builds (services and testBinaries).
rawSource = pkgs.lib.cleanSourceWith {
Expand Down Expand Up @@ -75,7 +75,6 @@ let
cd $out
rm -f .bazelversion MODULE.bazel.lock
sed -i 's|register_toolchains("@llvm_toolchain_host//:all")|# register_toolchains("@llvm_toolchain_host//:all")|g' MODULE.bazel
sed -i 's|"OPENSSL_STATIC": "1"|"OPENSSL_STATIC": "0"|g' MODULE.bazel
cat << 'EOF' > util/get_workspace_status.sh
#!/bin/sh
echo "BUILD_SCM_REVISION 0.1.0"
Expand Down Expand Up @@ -297,7 +296,6 @@ for root, dirs, files in os.walk("src"):
commonCommandArgs = [
"--define=env=dev"
"--define=pq=true"
"--@lowrisc_opentitan_head//third_party/rust:openssl_pkg_config_path=${pkgs.openssl.dev}/lib/pkgconfig:${pkgs.systemd.dev}/lib/pkgconfig"
"--action_env=PATH=${actionPath}:/bin:/usr/bin"
"--host_action_env=PATH=${actionPath}:/bin:/usr/bin"
"--action_env=PKG_CONFIG=${pkgs.pkg-config.pkg-config}/bin/pkg-config"
Expand Down Expand Up @@ -359,7 +357,7 @@ for root, dirs, files in os.walk("src"):
"//src/pa:loadtest"
"//src/ate/test_programs:tls_test"
"//src/spm/services/testutils:tbsgen"
"@lowrisc_opentitan_head//sw/host/hsmtool"
"@opentitan_signing_infra//hsmtool"
"//config:release"
];
nativeBuildInputs = commonNativeBuildInputs ++ [ stripVendorRefsHook ];
Expand Down Expand Up @@ -464,7 +462,7 @@ print(f"Materialized {len(elfs)} ELF binaries for autoPatchelf")
# Stage 2.5: Pre-warmed Bazel disk cache & external binary derivation.
# Built from cleanedVendorSource (which excludes code in src/), so this derivation
# NEVER rebuilds when Go/Rust/C++ files in src/ are edited.
# Pre-compiles @lowrisc_opentitan_head//sw/host/hsmtool (300+ Rust crates),
# Pre-compiles @opentitan_signing_infra//hsmtool (Rust crates),
# SQLite, gRPC, Protobuf, C++ Abseil, and all .proto generated targets.
bazelDepsCache = buildBazel8Derivation {
name = "opentitan-provisioning-bazel-deps-cache";
Expand All @@ -484,7 +482,7 @@ print(f"Materialized {len(elfs)} ELF binaries for autoPatchelf")
"--disk_cache=/build/disk_cache"
];
targets = [
"@lowrisc_opentitan_head//sw/host/hsmtool"
"@opentitan_signing_infra//hsmtool"
"@org_modernc_sqlite//:sqlite"
"@org_golang_google_grpc//:grpc"
"@com_google_protobuf//:protoc"
Expand All @@ -501,7 +499,7 @@ print(f"Materialized {len(elfs)} ELF binaries for autoPatchelf")
'';
installPhase = ''
mkdir -p $out/bin
cp bazel-bin/external/*lowrisc_opentitan_head*/sw/host/hsmtool/hsmtool $out/bin/hsmtool
cp bazel-bin/external/*opentitan_signing_infra*/hsmtool/hsmtool $out/bin/hsmtool
chmod -R u+w /build/disk_cache
tar -cf $out/disk_cache.tar -C /build/disk_cache .
'';
Expand Down
2 changes: 1 addition & 1 deletion release/BUILD.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ pkg_tar(
name = "hsmutils",
srcs = [
"//third_party/openssl:openssl_bin",
"@lowrisc_opentitan_head//sw/host/hsmtool",
"@opentitan_signing_infra//hsmtool",
],
extension = "tar.xz",
)
Expand Down
4 changes: 2 additions & 2 deletions rules/hsm.bzl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -720,7 +720,7 @@ hsm_config_script = rule(
allow_single_file = True,
),
"_hsmtool": attr.label(
default = "@lowrisc_opentitan_head//sw/host/hsmtool",
default = "@opentitan_signing_infra//hsmtool",
allow_single_file = True,
cfg = "exec",
executable = True,
Expand Down Expand Up @@ -836,7 +836,7 @@ hsm_certgen_script = rule(
allow_single_file = True,
),
"_hsmtool": attr.label(
default = "@lowrisc_opentitan_head//sw/host/hsmtool",
default = "@opentitan_signing_infra//hsmtool",
allow_single_file = True,
cfg = "exec",
executable = True,
Expand Down
4 changes: 2 additions & 2 deletions src/ate/test_programs/otlib_wrapper/BUILD.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@
# Licensed under the Apache License, Version 2.0, see LICENSE for details.
# SPDX-License-Identifier: Apache-2.0

load("@rules_rust//rust:defs.bzl", "rust_library")
load("@rules_rust//rust:defs.bzl", "rust_static_library")

package(default_visibility = ["//visibility:public"])

rust_library(
rust_static_library(
name = "otlib_wrapper",
srcs = [
"src/lib.rs",
Expand Down
Loading