Merge branch 'master' into sy/cisco-catalyst-center

Author: steveny91

.builders/images/linux-aarch64/Dockerfile

@@ -36,11 +36,11 @@ RUN yum install -y perl-IPC-Cmd perl-CPANPLUS perl-core && \
  ldconfig
 
 # Compile and install Python 3
-ENV PYTHON3_VERSION=3.13.14
+ENV PYTHON3_VERSION=3.13.15
 RUN yum install -y libffi-devel && \
  DOWNLOAD_URL="https://python.org/ftp/python/{{version}}/Python-{{version}}.tgz" \
  VERSION="${PYTHON3_VERSION}" \
- SHA256="5ae535a36af0ebca6fca176ecb8197f5db9c1cb8c8f0cd12cdf1787046db1f41" \
+ SHA256="c28d9d213c09b5b5ab2c29812950e12f746999e099b82894231be954b26baed9" \
  RELATIVE_PATH="Python-{{version}}" \
  bash install-from-source.sh \
  --prefix=/opt/python/${PYTHON3_VERSION} \

.builders/images/linux-x86_64/Dockerfile

@@ -35,11 +35,11 @@ RUN yum install -y perl-IPC-Cmd perl-CPANPLUS perl-core && \
  ldconfig
 
 # Compile and install Python 3
-ENV PYTHON3_VERSION=3.13.14
+ENV PYTHON3_VERSION=3.13.15
 RUN yum install -y libffi-devel && \
  DOWNLOAD_URL="https://python.org/ftp/python/{{version}}/Python-{{version}}.tgz" \
  VERSION="${PYTHON3_VERSION}" \
- SHA256="5ae535a36af0ebca6fca176ecb8197f5db9c1cb8c8f0cd12cdf1787046db1f41" \
+ SHA256="c28d9d213c09b5b5ab2c29812950e12f746999e099b82894231be954b26baed9" \
  RELATIVE_PATH="Python-{{version}}" \
  bash install-from-source.sh --prefix=/opt/python/${PYTHON3_VERSION} --with-ensurepip=yes --enable-ipv6 --with-dbmliborder=
 ENV PATH="/opt/python/${PYTHON3_VERSION}/bin:${PATH}"

.builders/images/macos/builder_setup.sh

@@ -12,6 +12,40 @@ install-from-source() {
     bash "install-from-source.sh" --prefix="${DD_PREFIX_PATH}" "$@"
 }
 
+# Rust toolchain, needed to build cryptography from source: it no longer ships macOS x86_64 wheels.
+# Installed under the prefix to keep it in the builder cache, with the shims linked into
+# ${DD_PREFIX_PATH}/bin, which build.py already puts on PATH.
+# RUST_VERSION bumps on its own; the hashes are rustup-init's, so they only change with RUSTUP_VERSION:
+# https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${RUST_TARGET}/rustup-init.sha256
+# renovate: datasource=github-releases depName=rust-lang/rust
+RUST_VERSION="1.91.0"
+# renovate: datasource=github-tags depName=rust-lang/rustup
+RUSTUP_VERSION="1.26.0"
+case "$(uname -m)" in
+    x86_64)
+        RUST_TARGET="x86_64-apple-darwin"
+        RUSTUP_SHA256="f6d1a9fac1a0d0802d87c254f02369a79973bc8c55aa0016d34af4fcdbd67822"
+        ;;
+    arm64)
+        RUST_TARGET="aarch64-apple-darwin"
+        RUSTUP_SHA256="ed299a8fe762dc28161a99a03cf62836977524ad557ad70e13882d2f375d3983"
+        ;;
+    *)
+        echo "Unsupported architecture for the Rust toolchain: $(uname -m)" >&2
+        exit 1
+        ;;
+esac
+export RUSTUP_HOME="${DD_PREFIX_PATH}/rustup" CARGO_HOME="${DD_PREFIX_PATH}/cargo"
+curl --retry 5 --fail "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${RUST_TARGET}/rustup-init" -o /tmp/rustup-init
+echo "${RUSTUP_SHA256}  /tmp/rustup-init" | sha256sum --check
+chmod +x /tmp/rustup-init
+/tmp/rustup-init -y --no-modify-path --profile minimal --default-toolchain "${RUST_VERSION}"
+# The shims are copies of the rustup binary we just verified, so they carry the same hash
+echo "${RUSTUP_SHA256}  ${CARGO_HOME}/bin/rustc" | sha256sum --check
+rm /tmp/rustup-init
+mkdir -p "${DD_PREFIX_PATH}/bin"
+ln -sf "${CARGO_HOME}"/bin/* "${DD_PREFIX_PATH}/bin/"
+
 # mqi
 IBM_MQ_VERSION=9.2.4.0-IBM-MQ-DevToolkit
 curl --retry 5 --fail "https://s3.amazonaws.com/dd-agent-omnibus/ibm-mq-backup/${IBM_MQ_VERSION}-MacX64.pkg" -o /tmp/mq_client.pkg
@@ -99,8 +133,8 @@ VERSION="18.3" \
 SHA256="d95663fbbf3a80f81a9d98d895266bdcb74ba274bcc04ef6d76630a72dee016f" \
 RELATIVE_PATH="postgresql-{{version}}" \
   install-from-source --without-readline --with-openssl --without-icu
-# Add paths to pg_config and to the library
-echo PATH="${DD_PREFIX_PATH}/bin:${PATH:-}" >> "$DD_ENV_FILE"
+# pg_config is reached through ${DD_PREFIX_PATH}/bin, which build.py already puts on PATH. Writing PATH
+# to the env file instead would drop the entries build_wheels.py adds later, such as the maturin script.
 
 # zstd for librdkafka compression support
 # Keep version in sync with github.com/DataDog/datadog-agent/deps/repos.MODULE.bazel

.builders/images/macos/extra_build.sh

@@ -34,6 +34,15 @@ sudo cp -Rf "${DD_PREFIX_PATH}/mqm" /opt
 echo "WITH_XML2_CONFIG=${DD_PREFIX_PATH}/bin/xml2-config" >> $DD_ENV_FILE
 echo "WITH_XSLT_CONFIG=${DD_PREFIX_PATH}/bin/xslt-config" >> $DD_ENV_FILE
 
+# Point the openssl crate, used by cryptography, at the OpenSSL we build instead of the system one.
+# This runs on every build, unlike the builder setup, which is skipped when the cache is warm.
+echo "OPENSSL_LIB_DIR=${DD_PREFIX_PATH}/lib" >> $DD_ENV_FILE
+echo "OPENSSL_INCLUDE_DIR=${DD_PREFIX_PATH}/include" >> $DD_ENV_FILE
+
+# The rustup shims resolve the toolchain through these, so they are needed on cache hits too
+echo "RUSTUP_HOME=${DD_PREFIX_PATH}/rustup" >> $DD_ENV_FILE
+echo "CARGO_HOME=${DD_PREFIX_PATH}/cargo" >> $DD_ENV_FILE
+
 # Empty arrays are flagged as unset when using the `-u` flag. This is the safest way to work around that
 # (see https://stackoverflow.com/a/61551944)
 pip_no_binary=${always_build[@]+"${always_build[@]}"}

.builders/images/macos/pbs.env

@@ -1,7 +1,7 @@
 # Python Build Standalone (PBS) pins for macOS in resolve-build-deps.
 # https://astral.sh/blog/python-build-standalone
 # Sourced by .github/workflows/resolve-build-deps.yaml (set -a; source ...).
-PYTHON_PATCH=14
-PBS_RELEASE=20260610
-PBS_SHA256__aarch64=79daa8e9dea1e64ad50aebb05a807289023a474c2020b72361eb44d67fa2401e
-PBS_SHA256__x86_64=064731aded38b1a12909088d40d9e0e385dc989e38a1e1de9917610254194962
+PYTHON_PATCH=15
+PBS_RELEASE=20260807
+PBS_SHA256__aarch64=dbadb0ffe46f8bace50daaf8a0c5fc6903c003690776da9eb5269e33c856bb53
+PBS_SHA256__x86_64=187eed2282e9c3a5b6b14953d564ee25a9f35cf2c209c9fa292186ee48b0e4a1

.builders/images/windows-x86_64/Dockerfile

@@ -85,11 +85,11 @@ RUN Get-RemoteFile `
     Approve-File -Path $($Env:USERPROFILE + '\.cargo\bin\rustc.exe') -Hash $Env:RUSTC_HASH
 
 # Install Python 3
-ENV PYTHON_VERSION="3.13.14"
+ENV PYTHON_VERSION="3.13.15"
 RUN Get-RemoteFile `
       -Uri https://www.python.org/ftp/python/$Env:PYTHON_VERSION/python-$Env:PYTHON_VERSION-amd64.exe `
       -Path python-$Env:PYTHON_VERSION-amd64.exe `
-      -Hash 'c54d9b9bbb8a36e6489363ddd01139707fd781d72f1f9e90c7ec65d0061368e0'; `
+      -Hash 'edec09c4853aeae9ac36efb8c9f95b6b8e2fee65eee56d9767a8b7c69c574403'; `
     Start-Process -Wait python-$Env:PYTHON_VERSION-amd64.exe -ArgumentList '/quiet', 'InstallAllUsers=1'; `
     Remove-Item python-$Env:PYTHON_VERSION-amd64.exe; `
     & 'C:\Program Files\Python313\python.exe' -m pip install --no-warn-script-location --upgrade pip; `

.ddev/config.toml

@@ -208,7 +208,6 @@ nginx_ingress_controller = "nginx-ingress-controller"
 
 [overrides.dep.updates]
 exclude = [
-    'pyasn1',          # https://github.com/pyasn1/pyasn1/issues/52
     'pysnmp',          # Breaking snmp tests
     'aerospike',       # v8+ breaks agent build.
     'confluent-kafka',
@@ -220,6 +219,10 @@ exclude = [
     'pymysql',      # Pinned to below 1.2.0 as requested by DBM while they work on supporting 1.2+
     'foundationdb', # 7+ has a breaking changes
     'ddtrace', # 4.5.1 does not support MacOS 11, which is used by the Agent
+    'kubernetes',   # Excluded on size: 36 bundles the aio client and aiohttp, +24M on disk.
+                    # Unpin once https://github.com/kubernetes-client/python/issues/2677 is resolved.
+    'redis',        # 8.1.0 adds 788K on disk, over the Agent per-PR gate. Bumped in stages
+                    # instead, see #24817. Unpin once we reach 8.1.0.
 
 ]
 

.deps/builder_inputs.toml

@@ -11,11 +11,11 @@
 # Hash inputs are defined in .builders/inputs_hash.py (SHARED_INPUTS,
 # RESOLUTION_INPUTS).
 [resolution]
-hash = "20526a521fe4bcb1be07e09d4b60b6f8791dddecb3966faa3746d536388c9841"
+hash = "d629da124aca924cb21ad8ec750e18461e134564835a3be29edbde2e885dc90f"
 
 [images]
-linux-aarch64 = "12d028af4a7aaead88c4947dc4996df85eb57f09ac6f0430f3ed640290418e85"
-linux-x86_64 = "947d461418c4dbc246db29b08ae4ff9fd7ebee7081b1e36500990c5d1f0aad99"
-macos-aarch64 = "78e6a48da3021de05ea531e272e5e2ebab7b5e09888144460586602f39368fbc"
-macos-x86_64 = "d27dd57c87253060744c2e1584b17348a921cbf7c343f1bb55005665fa5c61fb"
-windows-x86_64 = "e016f1da3aab33685b9e791535baebec81e6c28e8926a6503fbbee8daf43a2d1"
+linux-aarch64 = "48faaad3beb1c8fc378547f2e5719d5b3b6a475903999a4bf2abb6c1a6d4089f"
+linux-x86_64 = "a7a9010670d189d6ce933695256e4fc9a720e4f0d6fc8a3be6269e65a3be0ec5"
+macos-aarch64 = "58d04ff6c74f75cfa26560596b546b32215ce581861ad8492b54f1dadb89f750"
+macos-x86_64 = "289cc19d76545b596f69d7dbeef679da1cddc2cc25f139d36748a8efd387cc49"
+windows-x86_64 = "da9fa3c61b2d1808cab45eec33d39ba8680f1021066f948e0f760aab218632bc"

.deps/image_digests.json

@@ -1,5 +1,5 @@
 {
-  "linux-aarch64": "sha256:3f814638582595cccb6c5a5725369fd858b4c00022a5b7fb905fcdfe6784e8d2",
-  "linux-x86_64": "sha256:e841e61a71a9e927c52bd49b1e37378bdf27a708210db8a06e00ac8b44cc824c",
-  "windows-x86_64": "sha256:df834692738c720f20a45f6eda15f345e6a9629e1a28f9621a9de37c565b2bda"
+  "linux-aarch64": "sha256:3b0cb5bda376c2c3ed2ec0fcf3d29b93bb1a7038272174307b857a843bcfb838",
+  "linux-x86_64": "sha256:03d85cbbd16a904032ae564f578da49c73f8fefd3c726efa0c66f88305dee6ab",
+  "windows-x86_64": "sha256:bb0fb7104b762c2bc2e268dcaf139f3136ab20caa87ac44fb5b024345d07a267"
 }