[pull] master from DataDog:master

.builders/images/macos/builder_setup.sh

@@ -12,6 +12,40 @@ install-from-source() {
     bash "install-from-source.sh" --prefix="${DD_PREFIX_PATH}" "$@"
 }
 
+# Rust toolchain, needed to build cryptography from source: it no longer ships macOS x86_64 wheels.
+# Installed under the prefix to keep it in the builder cache, with the shims linked into
+# ${DD_PREFIX_PATH}/bin, which build.py already puts on PATH.
+# RUST_VERSION bumps on its own; the hashes are rustup-init's, so they only change with RUSTUP_VERSION:
+# https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${RUST_TARGET}/rustup-init.sha256
+# renovate: datasource=github-releases depName=rust-lang/rust
+RUST_VERSION="1.91.0"
+# renovate: datasource=github-tags depName=rust-lang/rustup
+RUSTUP_VERSION="1.26.0"
+case "$(uname -m)" in
+    x86_64)
+        RUST_TARGET="x86_64-apple-darwin"
+        RUSTUP_SHA256="f6d1a9fac1a0d0802d87c254f02369a79973bc8c55aa0016d34af4fcdbd67822"
+        ;;
+    arm64)
+        RUST_TARGET="aarch64-apple-darwin"
+        RUSTUP_SHA256="ed299a8fe762dc28161a99a03cf62836977524ad557ad70e13882d2f375d3983"
+        ;;
+    *)
+        echo "Unsupported architecture for the Rust toolchain: $(uname -m)" >&2
+        exit 1
+        ;;
+esac
+export RUSTUP_HOME="${DD_PREFIX_PATH}/rustup" CARGO_HOME="${DD_PREFIX_PATH}/cargo"
+curl --retry 5 --fail "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${RUST_TARGET}/rustup-init" -o /tmp/rustup-init
+echo "${RUSTUP_SHA256}  /tmp/rustup-init" | sha256sum --check
+chmod +x /tmp/rustup-init
+/tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain "${RUST_VERSION}"
+# The shims are copies of the rustup binary we just verified, so they carry the same hash
+echo "${RUSTUP_SHA256}  ${CARGO_HOME}/bin/rustc" | sha256sum --check
+rm /tmp/rustup-init
+mkdir -p "${DD_PREFIX_PATH}/bin"
+ln -sf "${CARGO_HOME}"/bin/* "${DD_PREFIX_PATH}/bin/"
+
 # mqi
 IBM_MQ_VERSION=9.2.4.0-IBM-MQ-DevToolkit
 curl --retry 5 --fail "https://s3.amazonaws.com/dd-agent-omnibus/ibm-mq-backup/${IBM_MQ_VERSION}-MacX64.pkg" -o /tmp/mq_client.pkg
@@ -99,8 +133,8 @@ VERSION="18.3" \
 SHA256="d95663fbbf3a80f81a9d98d895266bdcb74ba274bcc04ef6d76630a72dee016f" \
 RELATIVE_PATH="postgresql-{{version}}" \
   install-from-source --without-readline --with-openssl --without-icu
-# Add paths to pg_config and to the library
-echo PATH="${DD_PREFIX_PATH}/bin:${PATH:-}" >> "$DD_ENV_FILE"
+# pg_config is reached through ${DD_PREFIX_PATH}/bin, which build.py already puts on PATH. Writing PATH
+# to the env file instead would drop the entries build_wheels.py adds later, such as the maturin script.
 
 # zstd for librdkafka compression support
 # Keep version in sync with github.com/DataDog/datadog-agent/deps/repos.MODULE.bazel

.builders/images/macos/extra_build.sh

@@ -34,6 +34,15 @@ sudo cp -Rf "${DD_PREFIX_PATH}/mqm" /opt
 echo "WITH_XML2_CONFIG=${DD_PREFIX_PATH}/bin/xml2-config" >> $DD_ENV_FILE
 echo "WITH_XSLT_CONFIG=${DD_PREFIX_PATH}/bin/xslt-config" >> $DD_ENV_FILE
 
+# Point the openssl crate, used by cryptography, at the OpenSSL we build instead of the system one.
+# This runs on every build, unlike the builder setup, which is skipped when the cache is warm.
+echo "OPENSSL_LIB_DIR=${DD_PREFIX_PATH}/lib" >> $DD_ENV_FILE
+echo "OPENSSL_INCLUDE_DIR=${DD_PREFIX_PATH}/include" >> $DD_ENV_FILE
+
+# The rustup shims resolve the toolchain through these, so they are needed on cache hits too
+echo "RUSTUP_HOME=${DD_PREFIX_PATH}/rustup" >> $DD_ENV_FILE
+echo "CARGO_HOME=${DD_PREFIX_PATH}/cargo" >> $DD_ENV_FILE
+
 # Empty arrays are flagged as unset when using the `-u` flag. This is the safest way to work around that
 # (see https://stackoverflow.com/a/61551944)
 pip_no_binary=${always_build[@]+"${always_build[@]}"}

.ddev/config.toml

@@ -220,6 +220,8 @@ exclude = [
     'ddtrace', # 4.5.1 does not support MacOS 11, which is used by the Agent
     'kubernetes',   # Excluded on size: 36 bundles the aio client and aiohttp, +24M on disk.
                     # Unpin once https://github.com/kubernetes-client/python/issues/2677 is resolved.
+    'redis',        # 8.1.0 adds 788K on disk, over the Agent per-PR gate. Bumped in stages
+                    # instead, see #24817. Unpin once we reach 8.1.0.
 
 ]
 

.deps/builder_inputs.toml

@@ -11,11 +11,11 @@
 # Hash inputs are defined in .builders/inputs_hash.py (SHARED_INPUTS,
 # RESOLUTION_INPUTS).
 [resolution]
-hash = "0774860bf09e8edaa100ffa4de908519479971cf646e4956a2eb8c91f70be5d0"
+hash = "d47b88f78a3eee1159b0801a7aa76344e6bde91749c8e18738002b2a6fdc697a"
 
 [images]
 linux-aarch64 = "48faaad3beb1c8fc378547f2e5719d5b3b6a475903999a4bf2abb6c1a6d4089f"
 linux-x86_64 = "a7a9010670d189d6ce933695256e4fc9a720e4f0d6fc8a3be6269e65a3be0ec5"
-macos-aarch64 = "d4ff2d7e66ac57ce9ece084c2276a6c72a8f38e01649ab6fa871d3abae3e31d6"
-macos-x86_64 = "7476836c26f68c03c81b30823d84f4c2b505adde43d4bf601c4bdbc6cd3cdfbb"
+macos-aarch64 = "58d04ff6c74f75cfa26560596b546b32215ce581861ad8492b54f1dadb89f750"
+macos-x86_64 = "289cc19d76545b596f69d7dbeef679da1cddc2cc25f139d36748a8efd387cc49"
 windows-x86_64 = "da9fa3c61b2d1808cab45eec33d39ba8680f1021066f948e0f760aab218632bc"