temp(datasect): fix code after rebase

Author: aimenebelfodil

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/BUILD.bazel

@@ -1,40 +1,52 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@rules_rust//rust:defs.bzl", "rust_shared_library", "rust_test")
 
 # Rust shared-library checks are Linux-only.
 _LINUX = ["@platforms//os:linux"]
 
-# Backend engines to compile in.
 _FEATURES = ["engine-postgres"]
 
-# cdylib loaded by the shared-library check loader.
+# proto deps pull in C++; link libstdc++ explicitly.
+cc_library(
+    name = "cpp_stdlib",
+    linkopts = ["-lstdc++"],
+    target_compatible_with = _LINUX,
+)
+
 rust_shared_library(
     name = "datasecurity",
     srcs = glob(["src/**/*.rs"]),
-    # Cargo renames `dd-sensitive-data-scanner` to `dd_sds`
     aliases = {
+        "//pkg/collector/sharedlibrary/rustchecks/core": "shlib_core",
         "@crates//:dd-sensitive-data-scanner": "dd_sds",
     },
     crate_features = _FEATURES,
     crate_name = "datasecurity",
     edition = "2024",
+    link_deps = [":cpp_stdlib"],
+    # Use the Bazel proto crate instead of the cargo build-script path (src/proto.rs).
+    rustc_flags = ["--cfg=bazel"],
     target_compatible_with = _LINUX,
     visibility = ["//visibility:public"],
     deps = [
         "//pkg/collector/sharedlibrary/rustchecks/core",
+        "//pkg/proto/datadog/sds:sds_rust_proto",
+        "//pkg/proto/datadog/sds:timestamp_rust_proto",
         "@crates//:anyhow",
         "@crates//:dd-sensitive-data-scanner",
         "@crates//:libc",
         "@crates//:postgres",
+        "@crates//:prost",
         "@crates//:serde",
         "@crates//:serde_json",
     ],
 )
 
-# Unit tests embedded in the crate sources (run with `bazel test`).
 rust_test(
     name = "datasecurity_test",
     crate = ":datasecurity",
     crate_features = _FEATURES,
     edition = "2024",
+    rustc_flags = ["--cfg=bazel"],
     target_compatible_with = _LINUX,
 )

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/build.rs

@@ -3,36 +3,14 @@
 // This product includes software developed at Datadog (https://www.datadoghq.com/).
 // Copyright 2026-present Datadog, Inc.
 
-// Compiles the canonical SDS result proto with prost-build so the check can
-// serialize `SdsResultPayload` messages. The crate is built with cargo.
-//
-// Canonical source: pkg/proto/datadog/sds/sds_result.proto
-// Requires `protoc` on PATH (e.g. `brew install protobuf`).
+// cargo-only proto codegen into OUT_DIR; Bazel uses the sds_proto crate (see src/proto.rs).
+// Requires `protoc` on PATH.
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let proto_root = "../../../../../proto";
-    let proto_file = "../../../../../proto/datadog/sds/sds_result.proto";
-
-    println!("cargo:rerun-if-changed={proto_file}");
-
-    let mut config = prost_build::Config::new();
-
-    // TODO(DSEC): remove this serde derive once debugging ends — it only exists to
-    // emit the SDS result payload as JSON (see `send_sds_result_json`), which we do
-    // not need in production. `google.protobuf.Timestamp` (prost-types) has no serde
-    // support, so its fields use a local `serialize_with` helper.
-    config.type_attribute(".", "#[derive(serde::Serialize)]");
-    for field in [
-        ".datadog.sds.SdsResultPayload.ScanMetadata.ScanTaskMetadata.started_at",
-        ".datadog.sds.SdsResultPayload.ScanMetadata.ScanTaskMetadata.ended_at",
-    ] {
-        config.field_attribute(
-            field,
-            "#[serde(serialize_with = \"crate::proto::serialize_timestamp\")]",
-        );
-    }
-
-    config.compile_protos(&[proto_file], &[proto_root])?;
-
+    println!("cargo::rustc-check-cfg=cfg(bazel)");
+    prost_build::compile_protos(
+        &["../../../../../proto/datadog/sds/sds_result.proto"],
+        &["../../../../../proto"],
+    )?;
     Ok(())
 }

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/check.rs

@@ -1,8 +1,8 @@
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use anyhow::{Context, Result, anyhow};
-use shlib_core::*;
 use serde_json::Value;
+use shlib_core::*;
 
 use crate::backend;
 use crate::config::{CheckConfig, SubTask};
@@ -61,9 +61,14 @@ fn run_sub_task(
         Ok(out) => {
             println!(
                 "datasecurity: sub task succeeded ({} match(es))",
-                matches.len()
+                out.matches.len()
             );
-            (ScanStatus::Success, String::new(), out.matches, out.scanned_row_count)
+            (
+                ScanStatus::Success,
+                String::new(),
+                out.matches,
+                out.scanned_row_count,
+            )
         }
         Err(err) => {
             let reason = format!("{err:#}");
@@ -93,26 +98,6 @@ fn run_sub_task(
         check.event_platform_event_bytes(&proto::encode(&payload), SDS_RESULT_EVENT_TYPE)?;
     }
 
-    // TODO(DSEC): remove this JSON event once the protobuf is validated end to
-    // end — we do not need to send SDS results as JSON. It is serialized from the
-    // same protobuf so the two representations cannot drift.
-    if config.send_sds_result_json {
-        let payload_json =
-            proto::to_json(&payload).context("failed to serialize sds result payload to json")?;
-        check.event(
-            "datasecurity scan result",
-            &payload_json,
-            0,
-            "normal",
-            "",
-            &[],
-            "info",
-            "",
-            "datasecurity",
-            "",
-        )?;
-    }
-
     Ok(())
 }
 
@@ -182,7 +167,11 @@ fn build_sds_result(
             r#type: "postgres_table".to_string(),
             name: resource_name(sub_task),
         }),
-        rule_ids: config.scanning_rules.iter().map(|rule| rule.id.clone()).collect(),
+        rule_ids: config
+            .scanning_rules
+            .iter()
+            .map(|rule| rule.id.clone())
+            .collect(),
         // The scanning source is the Agent. TODO(DSEC): populate hostname and
         // agent version once the check receives them (not provided via config yet).
         scanning_source: Some(proto::ScanningSource {

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/config.rs

@@ -1,6 +1,6 @@
 use anyhow::{Context, Result};
-use shlib_core::AgentCheck;
 use serde::Deserialize;
+use shlib_core::AgentCheck;
 
 use crate::scanning::ScanningRule;
 
@@ -21,9 +21,6 @@ impl CheckConfig {
                 .context("failed to read scan_data from instance config")?,
             // Emit the SDS result protobuf on the `sds-result` track (default on).
             send_sds_result: check.instance.get("send_sds_result").unwrap_or(true),
-            // TODO(DSEC): debug only, off by default. Remove once the protobuf is
-            // validated end to end.
-            send_sds_result_json: check.instance.get("send_sds_result_json").unwrap_or(false),
         })
     }
 }
@@ -37,13 +34,6 @@ pub struct CheckConfig {
     /// Emit the SDS result protobuf on the `sds-result` event platform track.
     #[serde(default)]
     pub send_sds_result: bool,
-    /// Emit the SDS result payload as JSON (serialized from the same protobuf) as
-    /// a regular event.
-    ///
-    /// TODO(DSEC): debug only, remove once the protobuf is validated end to end —
-    /// we do not need to send SDS results as JSON.
-    #[serde(default)]
-    pub send_sds_result_json: bool,
 }
 
 /// A single scan sub task: a query to run against one data source.

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/proto.rs

@@ -1,33 +1,41 @@
 //! Protobuf construction for SDS results.
 //!
-//! The crate is built with cargo: `build.rs` compiles
-//! `pkg/proto/datadog/sds/sds_result.proto` with prost-build and this module
-//! includes the generated code from `OUT_DIR`. The check builds these
-//! prost-generated types directly (no intermediate structs).
+//! The `datadog.sds` types are prost-generated: from `OUT_DIR` under cargo, from
+//! the `sds_proto` crate under Bazel.
 
-use std::time::SystemTime;
+use std::time::{SystemTime, UNIX_EPOCH};
 
 use prost::Message;
-use prost_types::Timestamp;
-use serde::Serialize;
 
 use crate::payload::Match;
 
+// cargo maps well-known types to `prost-types`; the Bazel toolchain to a `timestamp_proto` crate.
+#[cfg(not(bazel))]
+use prost_types::Timestamp;
+#[cfg(bazel)]
+use timestamp_proto::google::protobuf::Timestamp;
+
+#[cfg(not(bazel))]
 pub mod datadog {
     pub mod sds {
         include!(concat!(env!("OUT_DIR"), "/datadog.sds.rs"));
     }
 }
 
+#[cfg(bazel)]
+pub mod datadog {
+    pub mod sds {
+        pub use sds_proto::datadog::sds::*;
+    }
+}
+
 // Proto types the check assembles directly.
 pub use datadog::sds::{
-    scanning_source,
+    ScanningSource, SdsResultPayload, scanning_source,
     sds_result_payload::{
-        scan_location,
-        scan_metadata::{scan_task_metadata::Status, ScanTaskMetadata},
-        PostgresTable, Resource, ScanLocation, ScanMetadata, ScanResult, TableMatch,
+        PostgresTable, Resource, ScanLocation, ScanMetadata, ScanResult, TableMatch, scan_location,
+        scan_metadata::{ScanTaskMetadata, scan_task_metadata::Status},
     },
-    ScanningSource, SdsResultPayload,
 };
 
 /// Convert aggregated scanner matches into proto `TableMatch` entries.
@@ -45,42 +53,17 @@ pub fn table_matches(matches: &[Match]) -> Vec<TableMatch> {
 
 /// Convert a wall-clock time into a proto `Timestamp`.
 pub fn to_timestamp(time: SystemTime) -> Timestamp {
-    Timestamp::from(time)
+    let (seconds, nanos) = match time.duration_since(UNIX_EPOCH) {
+        Ok(d) => (d.as_secs() as i64, d.subsec_nanos() as i32),
+        Err(e) => {
+            let d = e.duration();
+            (-(d.as_secs() as i64), -(d.subsec_nanos() as i32))
+        }
+    };
+    Timestamp { seconds, nanos }
 }
 
 /// Marshal `payload` to protobuf bytes for the `sds-result` event platform track.
 pub fn encode(payload: &SdsResultPayload) -> Vec<u8> {
     payload.encode_to_vec()
 }
-
-/// Serialize `payload` to JSON, from the same protobuf sent on the wire.
-///
-/// TODO(DSEC): debug only, remove once the protobuf is validated end to end.
-pub fn to_json(payload: &SdsResultPayload) -> serde_json::Result<String> {
-    serde_json::to_string(payload)
-}
-
-/// Serde helper for the prost-types `Timestamp` fields, which have no serde
-/// support of their own. Serializes `Some` as `{ "seconds", "nanos" }` and
-/// `None` as null. Referenced by generated code via `build.rs`.
-///
-/// TODO(DSEC): remove alongside the JSON debug event.
-pub fn serialize_timestamp<S>(ts: &Option<Timestamp>, serializer: S) -> Result<S::Ok, S::Error>
-where
-    S: serde::Serializer,
-{
-    #[derive(serde::Serialize)]
-    struct SerdeTimestamp {
-        seconds: i64,
-        nanos: i32,
-    }
-
-    match ts {
-        Some(ts) => SerdeTimestamp {
-            seconds: ts.seconds,
-            nanos: ts.nanos,
-        }
-        .serialize(serializer),
-        None => serializer.serialize_none(),
-    }
-}

pkg/collector/sharedlibrary/rustchecks/checks/datasecurity/src/scanning/tests.rs

@@ -1,9 +1,9 @@
-use shlib_core::Config;
 use dd_sds::{
     Labels, ProximityKeywordsConfig, RegexRuleConfig, RootRuleConfig, SecondaryValidator,
     Suppressions,
 };
 use serde_json::json;
+use shlib_core::Config;
 
 use crate::payload::Match;
 

pkg/collector/sharedlibrary/rustchecks/core/src/agent_check.rs

@@ -254,7 +254,10 @@ impl AgentCheck {
         raw_event: &[u8],
         event_track_type: &str,
     ) -> Result<()> {
-        self.aggregator
-            .submit_event_platform_event_bytes(&self.check_id, raw_event, event_track_type)
+        self.aggregator.submit_event_platform_event_bytes(
+            &self.check_id,
+            raw_event,
+            event_track_type,
+        )
     }
 }

pkg/proto/datadog/sds/BUILD.bazel

@@ -1,5 +1,34 @@
-# Compiled with prost-build (cargo) by the datasecurity Rust check; not built or
-# consumed by Bazel. Disable proto generation inherited from ../BUILD.bazel.
-# gazelle:proto disable
+load("@protobuf//bazel:proto_library.bzl", "proto_library")
+load("@rules_go//proto:def.bzl", "go_proto_library")
+load("@rules_rust_prost//:defs.bzl", "rust_prost_library")
 
-exports_files(["sds_result.proto"])
+proto_library(
+    name = "sds_proto",
+    srcs = ["sds_result.proto"],
+    strip_import_prefix = "/pkg/proto",
+    visibility = ["//visibility:public"],
+    deps = ["@protobuf//:timestamp_proto"],
+)
+
+go_proto_library(
+    name = "sds_go_proto",
+    importpath = "pkg/proto/pbgo/sds",
+    proto = ":sds_proto",
+    visibility = ["//visibility:public"],
+)
+
+# Rust bindings for the datasecurity check (Linux-only).
+rust_prost_library(
+    name = "sds_rust_proto",
+    proto = ":sds_proto",
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["//visibility:public"],
+)
+
+# Well-known types get their own `timestamp_proto` crate; expose it for Timestamp construction.
+rust_prost_library(
+    name = "timestamp_rust_proto",
+    proto = "@protobuf//:timestamp_proto",
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["//visibility:public"],
+)