Remove dependency on tink-cc KMS extensions from tink-py

This is no longer needed because KMS extensions are now natively implemented in Python. PiperOrigin-RevId: 524119016 Change-Id: If126b2aae4791382968052c8bf963764f85746b3
tink-crypto · Apr 13, 2023 · b36a72c · b36a72c
1 parent c495950
commit b36a72c
Show file tree

Hide file tree

Showing 17 changed files with 37 additions and 65 deletions.
diff --git a/WORKSPACE b/WORKSPACE
@@ -9,18 +9,6 @@ http_archive(
     strip_prefix = "tink-cc-main",
 )
 
-http_archive(
-    name = "tink_cc_awskms",
-    urls = ["https://github.com/tink-crypto/tink-cc-awskms/archive/main.zip"],
-    strip_prefix = "tink-cc-awskms-main",
-)
-
-http_archive(
-    name = "tink_cc_gcpkms",
-    urls = ["https://github.com/tink-crypto/tink-cc-gcpkms/archive/main.zip"],
-    strip_prefix = "tink-cc-gcpkms-main",
-)
-
 # Need to load rules_python earlier as proto uses an older version which is
 # incompatible with our Python implementation will load
 load("@tink_py//:tink_py_deps.bzl", "tink_py_deps")
@@ -38,15 +26,3 @@ tink_cc_deps()
 load("@tink_cc//:tink_cc_deps_init.bzl", "tink_cc_deps_init")
 
 tink_cc_deps_init()
-
-load("@tink_cc_awskms//:tink_cc_awskms_deps.bzl", "tink_cc_awskms_deps")
-
-tink_cc_awskms_deps()
-
-load("@tink_cc_gcpkms//:tink_cc_gcpkms_deps.bzl", "tink_cc_gcpkms_deps")
-
-tink_cc_gcpkms_deps()
-
-load("@tink_cc_gcpkms//:tink_cc_gcpkms_deps_init.bzl", "tink_cc_gcpkms_deps_init")
-
-tink_cc_gcpkms_deps_init()
diff --git a/kokoro/gcp_ubuntu/bazel/run_tests.sh b/kokoro/gcp_ubuntu/bazel/run_tests.sh
@@ -31,8 +31,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 ./kokoro/testutils/copy_credentials.sh "testdata" "all"
 

diff --git a/kokoro/gcp_ubuntu/examples/bazel/run_tests.sh b/kokoro/gcp_ubuntu/examples/bazel/run_tests.sh
@@ -37,8 +37,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 cp "examples/WORKSPACE" "examples/WORKSPACE.bak"
 

diff --git a/kokoro/gcp_ubuntu/examples/bazel_kms/run_tests.sh b/kokoro/gcp_ubuntu/examples/bazel_kms/run_tests.sh
@@ -37,8 +37,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 ./kokoro/testutils/copy_credentials.sh "examples/testdata" "gcp"
 

diff --git a/kokoro/gcp_ubuntu/examples/pip/run_tests.sh b/kokoro/gcp_ubuntu/examples/pip/run_tests.sh
@@ -37,8 +37,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 source ./kokoro/testutils/install_tink_via_pip.sh "${TINK_BASE_DIR}/tink_py"
 # Install requirements for examples.

diff --git a/kokoro/gcp_ubuntu/examples/pip_kms/run_tests.sh b/kokoro/gcp_ubuntu/examples/pip_kms/run_tests.sh
@@ -37,8 +37,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 source ./kokoro/testutils/install_tink_via_pip.sh "${TINK_BASE_DIR}/tink_py"
 # Install requirements for examples.

diff --git a/kokoro/gcp_ubuntu/pip/run_tests.sh b/kokoro/gcp_ubuntu/pip/run_tests.sh
@@ -32,8 +32,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 ./kokoro/testutils/copy_credentials.sh "testdata" "all"
 source ./kokoro/testutils/install_tink_via_pip.sh "$(pwd)"

diff --git a/kokoro/gcp_ubuntu/release/run_tests.sh b/kokoro/gcp_ubuntu/release/run_tests.sh
@@ -32,8 +32,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 ./kokoro/testutils/copy_credentials.sh "testdata" "all"
 

diff --git a/kokoro/macos_external/bazel/run_tests.sh b/kokoro/macos_external/bazel/run_tests.sh
@@ -31,8 +31,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 ./kokoro/testutils/copy_credentials.sh "testdata" "all"
 

diff --git a/kokoro/macos_external/examples/bazel/run_tests.sh b/kokoro/macos_external/examples/bazel/run_tests.sh
@@ -37,8 +37,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 cp "examples/WORKSPACE" "examples/WORKSPACE.bak"
 

diff --git a/kokoro/macos_external/examples/bazel_kms/run_tests.sh b/kokoro/macos_external/examples/bazel_kms/run_tests.sh
@@ -37,8 +37,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 ./kokoro/testutils/copy_credentials.sh "examples/testdata" "gcp"
 

diff --git a/kokoro/macos_external/examples/pip/run_tests.sh b/kokoro/macos_external/examples/pip/run_tests.sh
@@ -37,8 +37,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 # Sourcing required to update callers environment.
 source ./kokoro/testutils/install_tink_via_pip.sh "${TINK_BASE_DIR}/tink_py"

diff --git a/kokoro/macos_external/examples/pip_kms/run_tests.sh b/kokoro/macos_external/examples/pip_kms/run_tests.sh
@@ -37,8 +37,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 # Sourcing required to update callers environment.
 source ./kokoro/testutils/install_tink_via_pip.sh "${TINK_BASE_DIR}/tink_py"

diff --git a/kokoro/macos_external/pip/run_tests.sh b/kokoro/macos_external/pip/run_tests.sh
@@ -38,8 +38,7 @@ fi
 # downloaded.
 readonly GITHUB_ORG="https://github.com/tink-crypto"
 ./kokoro/testutils/fetch_git_repo_if_not_present.sh "${TINK_BASE_DIR}" \
-  "${GITHUB_ORG}/tink-cc" "${GITHUB_ORG}/tink-cc-awskms" \
-  "${GITHUB_ORG}/tink-cc-gcpkms"
+  "${GITHUB_ORG}/tink-cc"
 
 ./kokoro/testutils/copy_credentials.sh "testdata" "all"
 # Sourcing required to update callers environment.

diff --git a/tink_py_deps.bzl b/tink_py_deps.bzl
@@ -1,12 +1,16 @@
-"""
-Dependencies of Python Tink
-"""
+"""tink-py dependencies."""
 
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive", "http_file")
 
 def tink_py_deps():
-    """ Loads dependencies of Python Tink.
-    """
+    """Loads dependencies of tink-py."""
+    if not native.existing_rule("google_root_pem"):
+        http_file(
+            name = "google_root_pem",
+            executable = 0,
+            urls = ["https://pki.goog/roots.pem"],
+            sha256 = "9c9b9685ad319b9747c3fe69b46a61c11a0efabdfa09ca6a8b0c3da421036d27",
+        )
 
     if not native.existing_rule("rules_python"):
         # Release from 2022-07-15

diff --git a/tink_py_deps_init.bzl b/tink_py_deps_init.bzl
@@ -1,12 +1,17 @@
-"""
-Initialization of dependencies of Python Tink
-"""
+"""Initialization of tink-py dependencies."""
 
 load("@rules_python//python:pip.bzl", "pip_install")
+load("@pybind11_bazel//:python_configure.bzl", "python_configure")
 
 def tink_py_deps_init(workspace_name):
     pip_install(
         name = "tink_py_pip_deps",
         quiet = False,
         requirements = "@" + workspace_name + "//:requirements.txt",
     )
+
+    # Use `which python3` by default [1] unless PYTHON_BIN_PATH is specified [2].
+    #
+    # [1] https://github.com/pybind/pybind11_bazel/blob/fc56ce8a8b51e3dd941139d329b63ccfea1d304b/python_configure.bzl#L434
+    # [2] https://github.com/pybind/pybind11_bazel/blob/fc56ce8a8b51e3dd941139d329b63ccfea1d304b/python_configure.bzl#L162
+    python_configure(name = "local_config_python", python_version = "3")
diff --git a/tools/distribution/build_linux_binary_wheels.sh b/tools/distribution/build_linux_binary_wheels.sh
@@ -55,18 +55,18 @@ unzip -o "${PROTOC_ZIP}" -d /usr/local bin/protoc
 # Setup required for Tink.
 export TINK_PYTHON_SETUPTOOLS_OVERRIDE_BASE_PATH="${TINK_PYTHON_ROOT_PATH}/.."
 
-# Workaround for grpc which expects a python2 installation, which is not present
-# in the manylinux2014 container. Cannot be an empty string, otherwise Bazel
-# will fail.
-export PYTHON2_BIN_PATH="non_existent_file"
-export PYTHON2_LIB_PATH="non_existent_file"
-
 # Required to fix https://github.com/pypa/manylinux/issues/357.
 export LD_LIBRARY_PATH="/usr/local/lib"
 
 for v in "${!PYTHON_VERSIONS[@]}"; do
   (
     # Executing in a subshell to make the PATH modification temporary.
+    # This makes shure that `which python3 ==
+    # /opt/python/${PYTHON_VERSIONS[$v]}/bin/python3`, which is a symlink of
+    # `/opt/python/${PYTHON_VERSIONS[$v]}/bin/python${v}`. This should allow
+    # pybind11_bazel to pick up the correct Python binary [1].
+    #
+    # [1] https://github.com/pybind/pybind11_bazel/blob/fc56ce8a8b51e3dd941139d329b63ccfea1d304b/python_configure.bzl#L434
     export PATH="${PATH}:/opt/python/${PYTHON_VERSIONS[$v]}/bin"
     pip wheel .
   )