fix: Openssl missing and dry run in CI

.github/workflows/build/action.yaml

@@ -53,3 +53,20 @@ runs:
       with:
         branch: ${{ github.head_ref }}
         ssh: true
+
+    - name: Dry run tarballs
+      shell: bash
+      run: |
+        #!/bin/bash
+
+        set -euo pipefail
+        bazel query ... | grep -E "tarball$" | while IFS= read -r target; do
+            echo "Testing $target"
+            bazel run $target
+
+            image=$(echo $target | awk -F: '{ print $1 }' | awk -F/ '{ print $NF }')
+            image="localhost/$image"
+            echo "Testing dry run on image: $image"
+            docker run --rm $image --help
+        done
+

3rdparty/bazel-rules-openssl/repos.bzl

@@ -0,0 +1,34 @@
+"""Adds repositories/archives."""
+
+########################################################################
+# DO NOT EDIT THIS FILE unless you are inside the
+# https://github.com/3rdparty/bazel-rules-openssl repository. If you
+# encounter it anywhere else it is because it has been copied there in
+# order to simplify adding transitive dependencies. If you want a
+# different version of bazel-rules-openssl follow the Bazel build
+# instructions at https://github.com/3rdparty/bazel-rules-openssl.
+########################################################################
+
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+
+def repos(external = True, repo_mapping = {}):
+    maybe(
+        http_archive,
+        name = "rules_foreign_cc",
+        url = "https://github.com/bazelbuild/rules_foreign_cc/archive/0.5.1.tar.gz",
+        sha256 = "33a5690733c5cc2ede39cb62ebf89e751f2448e27f20c8b2fbbc7d136b166804",
+        strip_prefix = "rules_foreign_cc-0.5.1",
+        repo_mapping = repo_mapping,
+    )
+
+    if external:
+        maybe(
+            git_repository,
+            name = "com_github_3rdparty_bazel_rules_openssl",
+            remote = "https://github.com/3rdparty/bazel-rules-openssl",
+            commit = "fd41d1a19c75dd82979c76fc0b2aadd6c4393e89",
+            shallow_since = "1632212203 +0000",
+            repo_mapping = repo_mapping,
+        )

Cargo.Bazel.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "244cb963c9d906d64fd728bd61c79e93eace27a39e17189082687eab85c35b92",
+  "checksum": "31058f9f66529f2b114e4c4508e3cc6dbf7243335ca17851bca859ae720bcccd",
   "crates": {
     "actix-codec 0.5.2": {
       "name": "actix-codec",
@@ -21785,6 +21785,10 @@
               "id": "chrono 0.4.37",
               "target": "chrono"
             },
+            {
+              "id": "clap 4.5.4",
+              "target": "clap"
+            },
             {
               "id": "csv 1.3.0",
               "target": "csv"
@@ -30380,6 +30384,10 @@
               "id": "anyhow 1.0.81",
               "target": "anyhow"
             },
+            {
+              "id": "clap 4.5.4",
+              "target": "clap"
+            },
             {
               "id": "ic-types 0.9.0",
               "target": "ic_types"
@@ -31571,6 +31579,12 @@
           ],
           "selects": {}
         },
+        "extra_deps": {
+          "common": [
+            "@openssl//:openssl"
+          ],
+          "selects": {}
+        },
         "edition": "2018",
         "proc_macro_deps": {
           "common": [
@@ -31672,6 +31686,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "extra_deps": {
+          "common": [
+            "@openssl//:openssl"
+          ],
+          "selects": {}
+        },
         "edition": "2015",
         "version": "0.1.5"
       },
@@ -31724,6 +31744,12 @@
           ],
           "selects": {}
         },
+        "extra_deps": {
+          "common": [
+            "@openssl//:openssl"
+          ],
+          "selects": {}
+        },
         "edition": "2018",
         "version": "0.9.101"
       },
@@ -40292,6 +40318,10 @@
               "id": "candid 0.10.6",
               "target": "candid"
             },
+            {
+              "id": "clap 4.5.4",
+              "target": "clap"
+            },
             {
               "id": "dotenv 0.15.0",
               "target": "dotenv"

WORKSPACE.bazel

@@ -165,6 +165,12 @@ oci_register_toolchains(
 
 load("@rules_oci//oci:pull.bzl", "oci_pull")
 
+load("//3rdparty/bazel-rules-openssl:repos.bzl", openssl_repos="repos")
+openssl_repos()
+
+load("@com_github_3rdparty_bazel_rules_openssl//bazel:deps.bzl", openssl_deps="deps")
+openssl_deps()
+
 oci_pull(
     # Debian 12 image has a newer glibc than Debian 11 in regular distrolles containers.
     # https://console.cloud.google.com/gcr/images/distroless/global/cc-debian12
@@ -195,11 +201,15 @@ oci_pull(
 )
 
 oci_pull(
-    # tag = "2.43.0-debian-11-r6",
+    # tag = "2.44.0-debian-12-r2",
     name = "bitnami_git_docker_img",
-    digest = "sha256:405124df0b75c75afc972cd73425838aacbd06a5dc4b7e0a2af4d9d3117163e8",
+    digest = "sha256:bbd4ffc32f62b2b7bb2b85f289803d564a0381a2c75fd61f19f8bfc0815791e4",
     image = "index.docker.io/bitnami/git",
     reproducible = True,
+    platforms = [
+        "linux/amd64",
+        "linux/arm64",
+    ],
 )
 
 oci_pull(

bazel/external_crates.bzl

@@ -28,6 +28,15 @@ def external_crates_repository():
                     "IC_ICRC1_ARCHIVE_WASM_PATH": "$(execpath @ic-icrc1-archive//file)",
                 },
             )],
+            "openssl": [crate.annotation(
+                deps = ["@openssl//:openssl"]
+            )],
+            "openssl-probe": [crate.annotation(
+                deps = ["@openssl//:openssl"]
+            )],
+            "openssl-sys": [crate.annotation(
+                deps = ["@openssl//:openssl"]
+            )],
         },
         cargo_config = "//:.cargo/config.toml",
         cargo_lockfile = "//:Cargo.lock",

rs/ic-management-backend/Cargo.toml

@@ -58,6 +58,7 @@ strum = { workspace = true }
 strum_macros = { workspace = true }
 tokio = { workspace = true }
 url = { workspace = true }
+clap = { workspace = true }
 
 [dev-dependencies]
 assert_matches = { workspace = true }

rs/ic-management-backend/src/main.rs

@@ -11,10 +11,16 @@ mod registry;
 mod release;
 mod subnets;
 
+use clap::Parser;
 use dotenv::dotenv;
 
+#[derive(Parser)]
+struct Args {}
+
 #[actix_web::main]
 async fn main() -> std::io::Result<()> {
+    let _args = Args::parse();
+
     dotenv().ok();
     std::env::set_var("RUST_LOG", "info");
     env_logger::init();

rs/np-notifications/Cargo.toml

@@ -25,6 +25,7 @@ tracing = { version = "0.1.37", features = ["log"] }
 tracing-log = { version = "0.2.0", features = ["log-tracer"] }
 tracing-subscriber = "0.3.17"
 url = { workspace = true }
+clap = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }

rs/np-notifications/src/main.rs

@@ -45,6 +45,7 @@ use crate::registry::{start_registry_updater_loop, RegistryLoopConfig};
 use crate::router::Router;
 use crate::service_health::ServiceHealth;
 use crate::sink::{LogSink, Sink};
+use clap::Parser;
 
 mod health_check;
 mod nodes_status;
@@ -54,8 +55,13 @@ mod router;
 mod service_health;
 mod sink;
 
+#[derive(Parser)]
+struct Args {}
+
 #[actix_web::main]
 async fn main() {
+    let _args = Args::parse();
+
     let subscriber = FmtSubscriber::builder().with_max_level(Level::INFO).compact().finish();
     LogTracer::builder().init().expect("can create a log tracer");
     tracing::subscriber::set_global_default(subscriber).expect("setting default subscriber failed");

rs/oci_images.bzl

@@ -2,7 +2,7 @@
 rules for creating oci images from rust binaries
 """
 
-load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push", "oci_tarball")
 load("@rules_pkg//:pkg.bzl", "pkg_tar")
 
 def rust_binary_oci_image_rules(name, src, base_image = "@distroless_cc_debian12", other_layers = []):
@@ -30,6 +30,13 @@ def rust_binary_oci_image_rules(name, src, base_image = "@distroless_cc_debian12
         tars = [tar_rule_name] + other_layers,
     )
 
+    tarball_name = "{}-tarball".format(binary.name)
+    oci_tarball(
+        name = tarball_name,
+        image = image_rule_name,
+        repo_tags = ["localhost/{}:latest".format(binary.name)]
+    )
+
     oci_push(
         name = "push_image",
         image = image_rule_name,

rs/slack-notifications/Cargo.toml

@@ -29,3 +29,4 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 serde_yaml = { workspace = true }
 tokio = { workspace = true }
+clap = { workspace = true }

rs/slack-notifications/src/main.rs

@@ -11,13 +11,17 @@ use std::io::Write;
 use std::time::SystemTime;
 use tokio::time::{sleep, Duration};
 mod slack;
+use clap::Parser;
 
 #[macro_use]
 extern crate lazy_static;
 
 #[derive(Deserialize)]
 struct Config {}
 
+#[derive(Parser)]
+struct Args {}
+
 // Time to wait for a new proposal after the last one was created before sending
 // out the Slack notification.
 const COOLING_PERIOD_SECS: u64 = 60;
@@ -26,6 +30,7 @@ const SLACK_URL_ENV: &str = "SLACK_URL";
 
 #[tokio::main]
 async fn main() {
+    let _args = Args::parse();
     std::env::set_var("RUST_LOG", "info");
     env_logger::init();
     dotenv::dotenv().ok();