Add bazel rule for converting OCI images to OCI runtime bundles

WORKSPACE

@@ -194,3 +194,60 @@ git_repository(
     commit = "f43f9d61c201b314c62a3ebcf2d4a37f1a3b06f7",
     remote = "https://github.com/erenon/bazel_clang_tidy.git",
 )
+
+# Bazel rules for building OCI images and runtime bundles.
+http_archive(
+    name = "rules_oci",
+    sha256 = "686f871f9697e08877b85ea6c16c8d48f911bf466c3aeaf108ca0ab2603c7306",
+    strip_prefix = "rules_oci-1.5.1",
+    url = "https://github.com/bazel-contrib/rules_oci/releases/download/v1.5.1/rules_oci-v1.5.1.tar.gz",
+)
+
+load("@rules_oci//oci:dependencies.bzl", "rules_oci_dependencies")
+
+rules_oci_dependencies()
+
+load("@rules_oci//oci:repositories.bzl", "LATEST_CRANE_VERSION", "LATEST_ZOT_VERSION", "oci_register_toolchains")
+
+oci_register_toolchains(
+    name = "oci",
+    crane_version = LATEST_CRANE_VERSION,
+    zot_version = LATEST_ZOT_VERSION,
+)
+
+load("@rules_oci//oci:pull.bzl", "oci_pull")
+
+oci_pull(
+    name = "distroless_cc_debian12",
+    digest = "sha256:6714977f9f02632c31377650c15d89a7efaebf43bab0f37c712c30fc01edb973",
+    image = "gcr.io/distroless/cc-debian12",
+    platforms = ["linux/amd64"],
+)
+
+load("@//bazel:repositories.bzl", "oak_toolchain_repositories")
+
+oak_toolchain_repositories()
+
+# Register a hermetic C++ toolchain to ensure that binaries use a glibc version supported by
+# distroless images. The glibc version provided by nix may be too new.
+# This (currently) needs to be loaded after rules_oci because it defaults to using an older version
+# of aspect-build/bazel-lib.
+http_archive(
+    name = "aspect_gcc_toolchain",
+    sha256 = "3341394b1376fb96a87ac3ca01c582f7f18e7dc5e16e8cf40880a31dd7ac0e1e",
+    strip_prefix = "gcc-toolchain-0.4.2",
+    urls = [
+        "https://github.com/aspect-build/gcc-toolchain/archive/refs/tags/0.4.2.tar.gz",
+    ],
+)
+
+load("@aspect_gcc_toolchain//toolchain:repositories.bzl", "gcc_toolchain_dependencies")
+
+gcc_toolchain_dependencies()
+
+load("@aspect_gcc_toolchain//toolchain:defs.bzl", "ARCHS", "gcc_register_toolchain")
+
+gcc_register_toolchain(
+    name = "gcc_toolchain_x86_64",
+    target_arch = ARCHS.x86_64,
+)

bazel/BUILD

@@ -0,0 +1,17 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+package(licenses = ["notice"])

bazel/defs.bzl

@@ -0,0 +1,20 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""Forwarder for bazel rules and macros."""
+
+load("//bazel/private:oci_runtime_bundle.bzl", _oci_runtime_bundle = "oci_runtime_bundle")
+
+oci_runtime_bundle = _oci_runtime_bundle

bazel/private/BUILD

@@ -0,0 +1,19 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+package(licenses = ["notice"])
+
+exports_files(glob(["*.tpl"]))

bazel/private/oci_runtime_bundle.bzl

@@ -0,0 +1,79 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""Implementation details for the oci_runtime_bundle macro."""
+
+def _oci_runtime_bundle_impl(ctx):
+    image = ctx.file.image
+    bundle = ctx.outputs.bundle
+    umoci = ctx.toolchains["//bazel/tools/umoci:toolchain_type"].umociinfo.bin
+    yq = ctx.toolchains["@aspect_bazel_lib//lib:yq_toolchain_type"].yqinfo.bin
+
+    # Since bazel doesn't support actions that create directory artifacts
+    # containing symlinks, we use a shell script so that a single action can
+    # unpack the container image and then re-pack it into a tar file.
+    executable = ctx.actions.declare_file("{}.tar.sh".format(ctx.label.name))
+    ctx.actions.expand_template(
+        template = ctx.file._tpl,
+        output = executable,
+        is_executable = True,
+        substitutions = {
+            "{{umoci}}": umoci.path,
+            "{{yq}}": yq.path,
+        },
+    )
+
+    ctx.actions.run(
+        executable = executable,
+        inputs = [image],
+        outputs = [bundle],
+        tools = [umoci, yq],
+        arguments = [image.path, bundle.path],
+        mnemonic = "OciRuntimeBundle",
+        progress_message = "Converting %{input} to an OCI runtime bundle",
+    )
+
+_oci_runtime_bundle = rule(
+    implementation = _oci_runtime_bundle_impl,
+    attrs = {
+        "image": attr.label(allow_single_file = True),
+        "bundle": attr.output(),
+        "_tpl": attr.label(
+            allow_single_file = True,
+            default = ":oci_runtime_bundle.sh.tpl",
+        ),
+    },
+    toolchains = [
+        "//bazel/tools/umoci:toolchain_type",
+        "@aspect_bazel_lib//lib:yq_toolchain_type",
+        "@bazel_tools//tools/sh:toolchain_type",
+    ],
+)
+
+def oci_runtime_bundle(name, image, **kwargs):
+    """Converts an oci_image to a OCI runtime bundle tar.
+
+    Args:
+        name: the target name to produce. Building this target will generate a
+          "{name}.tar" output file.
+        image: the oci_image target to convert.
+        **kwargs: additional arguments passed to the rule (e.g., visibility).
+    """
+    _oci_runtime_bundle(
+        name = name,
+        bundle = "{}.tar".format(name),
+        image = image,
+        **kwargs
+    )

bazel/private/oci_runtime_bundle.sh.tpl

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -eu
+
+readonly UMOCI="{{umoci}}"
+readonly YQ="{{yq}}"
+
+# Add tags to the image index generated by oci_image so that it's compatible
+# with umoci.
+readonly IMAGE_DIR=$(mktemp -d)
+cp -RL "$1/." "${IMAGE_DIR}"
+"${YQ}" -i -o=json '.manifests[0].annotations["org.opencontainers.image.ref.name"] = "latest"' "${IMAGE_DIR}/index.json"
+
+# Use umoci to unpack the image into a runtime bundle.
+readonly BUNDLE_DIR=$(mktemp -d)
+"${UMOCI}" unpack --rootless --image "${IMAGE_DIR}" "${BUNDLE_DIR}"
+
+# Sort mount options, which umoci emits in a non-deterministic order.
+"${YQ}" -i -o=json 'with(.mounts ; .[] | select(.options != null) | .options |= sort)' "${BUNDLE_DIR}/config.json"
+
+# Pack the runtime bundle into a (reproducible) tar, excluding unnecessary files
+# added by umoci.
+tar --create --sort=name --mtime="2000-01-01" --owner=0 --group=0 --numeric-owner \
+    --file="$2" --directory="${BUNDLE_DIR}" --exclude=./umoci.json --exclude='./sha256_*.mtree' .

bazel/repositories.bzl

@@ -0,0 +1,23 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""Functions to load Oak dependencies."""
+
+load("//bazel/tools/umoci:umoci_toolchain.bzl", "register_umoci_toolchain")
+
+# buildifier: disable=unnamed-macro
+def oak_toolchain_repositories(oak_workspace_name = None):
+    """Downloads dependencies and registers toolchains used by Oak rules."""
+    register_umoci_toolchain(name = "umoci_toolchain", oak_workspace_name = oak_workspace_name)

bazel/tools/umoci/BUILD

@@ -0,0 +1,22 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+package(licenses = ["notice"])
+
+toolchain_type(
+    name = "toolchain_type",
+    visibility = ["//visibility:public"],
+)

bazel/tools/umoci/BUILD.tpl

@@ -0,0 +1,34 @@
+#
+# Copyright 2024 The Project Oak Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+load("@{{oak_workspace_name}}//bazel/tools/umoci:umoci_toolchain.bzl", "umoci_toolchain")
+
+package(licenses = ["notice"])
+
+umoci_toolchain(
+    name = "umoci",
+    bin = "umoci.amd64",
+)
+
+toolchain(
+    name = "umoci_toolchain",
+    exec_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    toolchain = ":umoci",
+    toolchain_type = "@{{oak_workspace_name}}//bazel/tools/umoci:toolchain_type",
+)