docs: add buck2 docs

Signed-off-by: Austin Seipp <aseipp@pobox.com>

.buckconfig

@@ -0,0 +1,115 @@
+[cells]
+# 'cells' that are defined in the project. all 'jj' code should remain under
+# 'root', while 'prelude' is the prelude, and third-party is where any vendored
+# code should go.
+root = .
+mode = buck/mode
+prelude = buck/prelude
+toolchains = buck/toolchains
+third-party = buck/third-party
+none = none
+
+[external_cells]
+# use the built-in prelude that is packaged inside of the buck2 executable. at
+# any time we could vendor it, or use a 'git' cell, if we needed to apply custom
+# patches
+prelude = bundled
+
+[cell_aliases]
+# these aliases are all required by the upstream buck2 prelude, with stubs for
+# meta-specific cells. 'config//' is occasionally useful for select() calls
+config = prelude
+buck = none
+fbcode = none
+fbsource = none
+
+[buildfile]
+name = BUILD
+# for the sake of future compatibility and migrations, we don't want any BUILD
+# files in the project to use raw, un-imported symbols from the prelude like
+# 'cxx_library()'; we instead want to make sure every rule is explicitly
+# wrapped, load()ed and called, i.e. they should use 'jj.cxx_library()' instead.
+# do this by loading noprelude.bzl into every BUILD file, which will stub out
+# these bad symbols with an error message.
+includes = root//buck/shims/noprelude.bzl
+
+[buck2]
+# use sha256 since everything supports it. XXX FIXME (aseipp): blake3?
+digest_algorithms = SHA256
+
+# enable deferred materialization. this means that intermediate outputs will
+# never get written to disk, and instead will be stored in the remote cache for
+# all intermediate execution steps.
+#
+# we don' use RE yet, but keep these enabled so we don' have to change things or
+# find problems later. this also enables (local disk) sqlite materialization
+# state, and defers writes to the end of actions to help improve performance.
+materializations = deferred
+sqlite_materializer_state = true
+defer_write_actions = true
+
+# hash all commands in the action graph; this helps avoid some spurious
+# recompilations when the action graph changes, but the actual commands don't.
+# NOTE: this requires `materializations = deferred`
+hash_all_commands = true
+
+# deferred materialization requires that cache outputs never expire. if they do,
+# a command might fail if it expects a hit on an object that was supposed to be
+# an input. in that case, the buck2d daemon needs to restart to 'purge' its
+# knowledge of that object. this enables that.
+restarter = true
+
+# enable checking the peak memory in the interpreter, and also set a byte limit
+# for the interpreter. this is useful for catching runaway memory usage in BUILD
+# files just in case people start going crazy with them.
+check_starlark_peak_memory = true
+# default limit is 5MiB = 5 * 1024 * 1024 = 5242880 bytes
+default_starlark_peak_memory = 5242880
+# also, enforce a max callstack size to prevent ridiculous stack sizes and
+# put a limit on how deep/abstract things can get.
+starlark_max_callstack_size = 50
+
+[build]
+# set the default execution platform for builds on this machine. NOTE: this
+# platform definition is where remote execution (optionally) is enabled via
+# ExecutionPlatformRegistrationInfo
+execution_platforms = root//buck/platforms:default
+
+[parser]
+# set the default execution platform for several target patterns. this is
+# required; the main documentation for the format is the source code, I think...
+target_platform_detector_spec = \
+  target:root//...->root//buck/platforms:default \
+  target:third-party//...->root//buck/platforms:default \
+  target:toolchains//...->root//buck/platforms:default
+
+[project]
+# things that should not be scanned by buck2 for file changes. if you notice
+# something strange is being scanned, it might be worth adding here.
+ignore = \
+  .jj, \
+  .git, \
+  .direnv, \
+  .watchman-cookie** \
+  target
+
+[buck2_re_client]
+# default address for the cas/actioncache. this should be public for users so
+# they can always get build results. this does NOT include the 'engine_address'
+# service, which enables actual remote execution. that must be enabled
+# explicitly in .buckconfig.local
+cas_address          = https://builds.example.com
+action_cache_address = https://builds.example.com
+
+# 'instance name', which in RBE is the basic unit of isolation for projects; we
+# always default this for simplicity
+instance_name = jujutsu
+
+# always use TLS for all build products
+tls = true
+
+# in .buckconfig.local:
+#
+# [buck2_re_client]
+# engine_address = https://builds.jujutsu.dev
+# http_headers   = x-build-api-key:$BUILD_API_KEY

.github/actions/install-dotslash/action.yml

@@ -0,0 +1,30 @@
+name: Install DotSlash
+description: Install DotSlash on the current system
+inputs:
+  version:
+    description: "version of dotslash"
+    required: false
+    default: "0.4.1"
+runs:
+  using: "composite"
+  steps:
+    - name: Install DotSlash
+      shell: bash
+      run: |
+        mkdir -p $RUNNER_TEMP/dotslash
+        echo "$RUNNER_TEMP/dotslash" >> $GITHUB_PATH
+
+        if [[ "$RUNNER_OS" == "Windows" ]]; then
+          C:\\msys64\\usr\\bin\\wget.exe https://github.com/facebook/dotslash/releases/download/v0.4.1/dotslash-windows.v0.4.1.tar.gz
+          tar xf dotslash-windows.v0.4.1.tar.gz
+          mv dotslash.exe $RUNNER_TEMP/dotslash
+        else
+          if [[ "$RUNNER_OS" == "macOS" ]]; then
+            wget https://github.com/facebook/dotslash/releases/download/v0.4.1/dotslash-macos.v0.4.1.tar.gz
+            tar xf dotslash-macos.v0.4.1.tar.gz
+          elif [[ "$RUNNER_OS" == "Linux" ]]; then
+            wget https://github.com/facebook/dotslash/releases/download/v0.4.1/dotslash-ubuntu-22.04.x86_64.v0.4.1.tar.gz
+            tar xf dotslash-ubuntu-22.04.x86_64.v0.4.1.tar.gz
+          fi
+          mv dotslash $RUNNER_TEMP/dotslash
+        fi

.github/workflows/build-buck2.yml

@@ -0,0 +1,55 @@
+name: buck2
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions: read-all
+
+jobs:
+  buck2:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            abi: x86_64-unknown-linux-gnu
+          - os: windows-latest
+            abi: x86_64-pc-windows-msvc
+          - os: macos-latest
+            abi: aarch64-apple-darwin
+          # NOTE: macos-13 is the most recent x86_64 macos runner
+          #- os: macos-13
+          #  abi: x86_64-apple-darwin
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15 # NOTE (aseipp): keep in-sync with the build.yml timeout limit
+
+    name: build with buck2
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+      - name: (Linux) Install Mold
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update && sudo apt-get install -y mold
+      - name: Install DotSlash
+        uses: ./.github/actions/install-dotslash
+      - name: Add build tools to $PATH
+        run: echo "$PWD/tools/bin" >> $GITHUB_PATH
+      # FIXME (aseipp): use 'buck2' out of `$PATH` after we have dotslash .exe
+      # shim files for windows. until then just invoke manually
+      - name: buck2 build //...
+        run: |
+          mkdir -p out
+          dotslash ./tools/bin/buck2 build @mode//debug //...
+          cp buck-out/v2/log/*.pb.zst out
+          dotslash ./tools/bin/buck2 build @mode//debug cli --out out/jj.exe
+          ./out/jj.exe version
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
+        with:
+          name: jj-${{ matrix.abi }}
+          path: out
+          retention-days: 14

.github/workflows/codespell.yml

@@ -18,5 +18,5 @@ jobs:
         with:
           check_filenames: true
           check_hidden: true
-          skip: ./target,./.jj,*.lock
+          skip: ./target,./.jj,*.lock,./buck/third-party/rust/BUILD
           ignore_words_list: crate,NotIn

.gitignore

@@ -4,6 +4,9 @@
 .envrc
 # generated by nix build, nix-build
 result
+# buck2
+/buck-out/
+/.buckconfig.local
 # generated by the insta crate
 *.pending-snap
 *.snap*

.vscode/settings.json

@@ -0,0 +1,30 @@
+{
+    "files.insertFinalNewline": true,
+    "files.trimTrailingWhitespace": true,
+
+    "files.associations": {
+        ".buckconfig": "ini",
+        ".buckconfig.local": "ini",
+        "*.bzl": "starlark",
+        "*.bxl": "starlark",
+        "BUILD": "starlark",
+        "PACKAGE": "starlark",
+    },
+
+    "rust-analyzer.workspace.discoverConfig": {
+        "command": [
+            "rust-project",
+            "develop-json",
+            "--sysroot-mode=rustc",
+            "{arg}"
+        ],
+        "progressLabel": "rust-analyzer[buck2]",
+        "filesToWatch": ["BUILD", "PACKAGE"]
+    },
+
+    "rust-analyzer.check.overrideCommand": [
+        "rust-project",
+        "check",
+        "$saved_file",
+    ]
+}

Cargo.toml

@@ -16,6 +16,9 @@ documentation = "https://martinvonz.github.io/jj/"
 categories = ["version-control", "development-tools"]
 keywords = ["VCS", "DVCS", "SCM", "Git", "Mercurial"]
 
+[workspace.lints.rust]
+unexpected_cfgs = { level = "warn", check-cfg = ['cfg(buck_build)'] }
+
 [workspace.dependencies]
 anyhow = "1.0.86"
 assert_cmd = "2.0.8"

buck/.gitattributes

@@ -0,0 +1,2 @@
+prelude/*    linguist-generated=true merge=binary
+prelude/**/* linguist-generated=true merge=binary

buck/mode/.buckconfig

@@ -0,0 +1,5 @@
+[cells]
+mode = .
+
+[buildfile]
+name = BUILD

buck/mode/BUILD

@@ -0,0 +1,18 @@
+
+MODES = [ 'debug', 'release' ]
+
+constraint_setting(name = 'build-mode')
+
+[
+    constraint_value(
+        name = f'build-mode-{name}',
+        constraint_setting = ':build-mode'
+    ) for name in MODES
+]
+
+[
+    config_setting(
+        name = name,
+        constraint_values = [ f'mode//:build-mode-{name}' ]
+    ) for name in MODES
+]

buck/mode/PACKAGE

@@ -0,0 +1,4 @@
+
+package(
+    visibility = [ 'PUBLIC' ],
+)

buck/mode/debug

@@ -0,0 +1 @@
+--config=jj.buildmode=debug

buck/mode/local

@@ -0,0 +1 @@
+--config=buck2_re_client.default_enabled=false

buck/mode/release

@@ -0,0 +1 @@
+--config=jj.buildmode=release

buck/mode/remote

@@ -0,0 +1 @@
+--config=buck2_re_client.default_enabled=true

buck/platforms/BUILD

@@ -0,0 +1,14 @@
+load("@prelude//utils/buckconfig.bzl", "read_choice")
+load(":defs.bzl", "generate_platforms", "default_platforms")
+
+build_config = read_choice("jj", "buildmode", [
+    "debug",
+    "release",
+], "debug")
+
+default_constraints = [
+    # build mode: debug or release
+    ('mode//:{}'.format(build_config))
+]
+
+generate_platforms(default_platforms, default_constraints)

buck/platforms/defs.bzl

@@ -0,0 +1,221 @@
+def constraint_with_values(name, values, **kwargs):
+    """Declare a constraint setting with a set of values."""
+
+    native.constraint_setting(
+        name = name,
+        **kwargs,
+    )
+
+    for value in values:
+        native.constraint_value(
+            name = value,
+            constraint = ":{}".format(name),
+            **kwargs,
+        )
+
+def _execution_platform_impl(ctx: AnalysisContext) -> list[Provider]:
+    constraints = dict()
+    constraints.update(ctx.attrs.cpu_configuration[ConfigurationInfo].constraints)
+    constraints.update(ctx.attrs.os_configuration[ConfigurationInfo].constraints)
+    for x in ctx.attrs.constraints:
+        constraints.update(x[ConfigurationInfo].constraints)
+
+    cfg = ConfigurationInfo(constraints = constraints, values = {})
+
+    name = ctx.label.raw_target()
+    re_enabled = ctx.attrs.remote_enabled
+    os = ctx.attrs.os
+
+    re_properties = {}
+    if re_enabled:
+        if os == "linux":
+            re_properties = {
+                "OSFamily": "Linux",
+                "container-image": "nix-bb-runner",
+            }
+        elif os == "macos":
+            re_enabled = False # TODO FIXME (aseipp): support macos
+            re_properties = {
+                "OSFamily": "Darwin",
+                # ...
+            }
+        elif os == "windows":
+            re_enabled = False # TODO FIXME (aseipp): support windows
+            re_properties = {
+                "OSFamily": "Windows",
+                # ...
+            }
+        else:
+            fail("Invalid OS for remote execution: {}".format(os))
+
+    # Configuration of how a command should be executed.
+    force_remote_exe = re_enabled and (read_root_config("buck2_re_client", "force_remote", "false") == "true")
+    allow_local_fallback = re_enabled and (read_root_config("buck2_re_client", "allow_local_fallback", "false") == "true")
+    exe_cfg = CommandExecutorConfig(
+        # Whether to use local execution for this execution platform. If both
+        # remote_enabled and local_enabled are True, we will use the hybrid
+        # executor
+        local_enabled = True,
+
+        # Whether to use remote execution for this execution platform
+        remote_enabled = re_enabled,
+
+        # Whether to use the "limited" hybrid executor. If the hybrid
+        # executor is active, by default, it will race the two executors
+        # to completion until one finishes. If the limited hybrid executor
+        # is enabled, then both are exposed, but only the preferred one
+        # is chosen. Finally, if allow_limited_hybrid_fallbacks is true,
+        # then if the preferred executor fails, the other executor will be
+        # tried.
+        use_limited_hybrid = force_remote_exe,
+        allow_limited_hybrid_fallbacks = allow_local_fallback,
+        experimental_low_pass_filter = re_enabled and not force_remote_exe,
+
+        # Use and query the RE cache
+        remote_cache_enabled = re_enabled,
+
+        # Whether to upload local actions to the RE cache
+        allow_cache_uploads = re_enabled,
+
+        # Whether to use Windows path separators in command line arguments
+        use_windows_path_separators = os == "windows",
+
+        # Properties for remote execution for this platform. BuildBarn will
+        # match these properties against the properties of the remote workers it
+        # has attached; all fields must match.
+        remote_execution_properties = re_properties,
+
+        # The use case to use when communicating with RE.
+        remote_execution_use_case = "buck2-default",
+
+        # How to express output paths to RE. This is used internally for the
+        # FB RE implementation and the FOSS implementation; strict means that
+        # the RE implementation should expect the output paths to be specified
+        # as files or directories in all cases, and that's what the Remote
+        # Execution API expects. So this will never change.
+        remote_output_paths = "strict",
+
+        # Max file size that the RE system can support
+        remote_execution_max_input_files_mebibytes = None, # default: 30 * 1024 * 1024 * 1024
+
+        # Max time we're willing to wait in the RE queue
+        remote_execution_queue_time_threshold_s = None,
+
+        remote_dep_file_cache_enabled = False,
+    )
+
+    exe_platform = ExecutionPlatformInfo(
+        label = name,
+        configuration = cfg,
+        executor_config = exe_cfg,
+    )
+
+    return [
+        DefaultInfo(),
+        exe_platform,
+        PlatformInfo(label = str(name), configuration = cfg),
+        ExecutionPlatformRegistrationInfo(platforms = [exe_platform]),
+    ]
+
+__execution_platform = rule(
+    impl = _execution_platform_impl,
+    attrs = {
+        "cpu_configuration": attrs.dep(providers = [ConfigurationInfo]),
+        "os_configuration": attrs.dep(providers = [ConfigurationInfo]),
+        "constraints": attrs.list(attrs.dep(providers = [ConfigurationInfo]), default = []),
+        "remote_enabled": attrs.bool(default = False),
+        "cpu": attrs.string(),
+        "os": attrs.string(),
+    },
+)
+
+def _host_cpu_configuration() -> str:
+    arch = host_info().arch
+    if arch.is_aarch64:
+        return "config//cpu:arm64"
+    else:
+        return "config//cpu:x86_64"
+
+def _host_os_configuration() -> str:
+    os = host_info().os
+    if os.is_macos:
+        return "config//os:macos"
+    elif os.is_windows:
+        return "config//os:windows"
+    else:
+        return "config//os:linux"
+
+def generate_platforms(variants, constraints=[]):
+    """Generate execution platforms for the given variants, as well as a default
+    execution platform matching the host platform."""
+
+    # We want to generate a remote-execution capable variant of every supported
+    # platform (-re suffix) as well as a local variant (-local suffix) for the
+    # current execution platform that buck2 is running on.
+    default_alias_prefix = "none//fake:nonexistent"
+    for (cpu, os) in variants:
+        cpu_configuration = "config//cpu:{}".format(cpu)
+        os_configuration = "config//os:{}".format(os)
+
+        # always generate generate a remote-execution variant
+        __execution_platform(
+            name = "{}-{}-remote".format(cpu, os),
+            cpu_configuration = cpu_configuration,
+            os_configuration = os_configuration,
+            constraints = constraints,
+            remote_enabled = True,
+            cpu = cpu,
+            os = os,
+        )
+
+        # and, if it matches the host platform: generate a -local variant, too,
+        # so builds can happen locally as well.
+        if _host_cpu_configuration() == cpu_configuration and _host_os_configuration() == os_configuration:
+            default_alias_prefix = "root//buck/platforms:{}-{}".format(cpu, os)
+            __execution_platform(
+                name = "{}-{}-local".format(cpu, os),
+                cpu_configuration = cpu_configuration,
+                os_configuration = os_configuration,
+                constraints = constraints,
+                remote_enabled = False,
+                cpu = cpu,
+                os = os,
+            )
+
+    # default to remote compilation being turned off; enable it if the
+    # buck2_re_client.default_enabled option is set to "true", but only on
+    # supported platforms. set it to "force-true" to unconditionally enable it,
+    # which is useful for testing and platform bringup.
+    remote_default = False
+    re_default_enabled = read_root_config("buck2_re_client", "default_enabled", "false")
+
+    if re_default_enabled == "true":
+        if host_info().os.is_linux and not host_info().arch.is_aarch64:
+            remote_default = True
+        else:
+            # TODO FIXME (aseipp): enable on all platforms
+            remote_default = False
+    elif re_default_enabled == "false":
+        remote_default = False
+    elif re_default_enabled == "force-true":
+        remote_default = True
+    else:
+        fail('Invalid buck2_re_client.default_enabled setting: {}'.format(re_default_enabled))
+
+    # now, alias() it to the proper local or remote build
+    native.alias(
+        name = "default",
+        actual = "{}-{}".format(default_alias_prefix, "remote" if remote_default else "local"),
+    )
+
+# NOTE: keep the list of default platforms here instead of in BUILD. why?
+# because it keeps all the internal specifics like _host_cpu_configuration and
+# _host_os_configuration literals all in one spot.
+default_platforms = [
+    ("arm64", "linux"),
+    ("arm64", "macos"),
+   #("arm64", "windows"),
+    ("x86_64", "linux"),
+    ("x86_64", "macos"),
+    ("x86_64", "windows"),
+]

buck/shims/jj.bzl

@@ -0,0 +1,50 @@
+
+# version of JJ for the user to see
+# XXX FIXME (aseipp): unify this with Cargo.toml, somehow?
+JJ_VERSION = '0.21.0-buck2'
+
+# wrap native.rust_*, but provide some extra default args
+def _jj_rust_rule(rule_name: str, **kwargs):
+    edition = kwargs.pop('edition', '2021')
+    env = {
+        'JJ_VERSION': JJ_VERSION,
+    } | kwargs.pop('env', {})
+    rustc_flags = [
+        '--cfg=buck_build',
+    ] + kwargs.pop('rustc_flags', [])
+
+    fn = getattr(native, rule_name)
+    fn(
+        edition = edition,
+        env = env,
+        rustc_flags = rustc_flags,
+        # XXX FIXME (aseipp): incrementality should be optional based on the
+        # build mode, but also not dependent directly on read_config, so as not
+        # to invalidate cache hits. fix when real modes are possible
+        incremental_enabled = True,
+        **kwargs,
+    )
+
+def _jj_rust_library(**kwargs):
+    _jj_rust_rule('rust_library', **kwargs)
+
+def _jj_rust_binary(**kwargs):
+    _jj_rust_rule('rust_binary', **kwargs)
+
+def _jj_cxx_library(**_kwargs):
+    native.cxx_library(**_kwargs)
+
+def _jj_cxx_binary(**_kwargs):
+    native.cxx_binary(**_kwargs)
+
+def _jj_prebuilt_cxx_library(**_kwargs):
+    native.prebuilt_cxx_library(**_kwargs)
+
+jj = struct(
+    rust_library = _jj_rust_library,
+    rust_binary = _jj_rust_binary,
+
+    cxx_library = _jj_cxx_library,
+    prebuilt_cxx_library = _jj_prebuilt_cxx_library,
+    cxx_binary = _jj_cxx_binary,
+)

buck/shims/noprelude.bzl

@@ -0,0 +1,15 @@
+
+def cxx_library(**kwargs):
+    fail('use load("@root//buck/shims/jj.bzl", "jj") and call jj.cxx_library() instead')
+
+def cxx_binary(**kwargs):
+    fail('use load("@root//buck/shims/jj.bzl", "jj") and call jj.cxx_binary() instead')
+
+def prebuilt_cxx_library(**kwargs):
+    fail('use load("@root//buck/shims/jj.bzl", "jj") and call jj.prebuilt_cxx_library() instead')
+
+def rust_library(**kwargs):
+    fail('use load("@root//buck/shims/jj.bzl", "jj") and call jj.rust_library() instead')
+
+def rust_binary(**kwargs):
+    fail('use load("@root//buck/shims/jj.bzl", "jj") and call jj.rust_binary() instead')

buck/shims/third_party_rust.bzl

@@ -0,0 +1,24 @@
+load("@prelude//rust:cargo_package.bzl", "cargo")
+load("@prelude//rust:cargo_buildscript.bzl", "buildscript_run")
+
+load(":jj.bzl", "jj")
+
+def _rust_library(**_kwargs):
+    cargo.rust_library(**_kwargs)
+
+def _rust_binary(**_kwargs):
+    cargo.rust_binary(**_kwargs)
+
+def _cxx_library(**_kwargs):
+    jj.cxx_library(**_kwargs)
+
+def _prebuilt_cxx_library(**_kwargs):
+    jj.prebuilt_cxx_library(**_kwargs)
+
+third_party_rust = struct(
+    rust_library = _rust_library,
+    rust_binary = _rust_binary,
+    cxx_library = _cxx_library,
+    prebuilt_cxx_library = _prebuilt_cxx_library,
+    buildscript_run = buildscript_run,
+)

buck/third-party/.buckconfig

@@ -0,0 +1,7 @@
+[cells]
+third-party = .
+
+[buildfile]
+name = BUILD
+# see root .buckconfig for more information
+includes = root//buck/shims/noprelude.bzl

buck/third-party/bssl/BUILD

@@ -0,0 +1,154 @@
+
+load("@root//buck/shims/jj.bzl", "jj")
+
+load(
+    ":BUILD.generated.bzl",
+    "crypto_headers",
+    "crypto_internal_headers",
+    "crypto_sources",
+    "crypto_sources_asm",
+    "fips_fragments",
+    "ssl_headers",
+    "ssl_internal_headers",
+    "ssl_sources",
+    "tool_headers",
+    "tool_sources",
+)
+
+VERSION = "2024.2.21+g386622719ab38a4f3a484a749bd6e1e6d5fda2e0"
+GIT_COMMIT = VERSION.split('g', 1)[1]
+
+http_archive(
+    name = 'src',
+    sha256 = 'c81ef84430272ce63f9308780981f84dae9a46179aa192f16f79370adf1d3a12',
+    urls = [
+        'https://github.com/google/boringssl/archive/{}.tar.gz'.format(GIT_COMMIT),
+    ],
+    type = 'tar.gz',
+    strip_prefix = 'boringssl-{}'.format(GIT_COMMIT),
+    sub_targets =
+        crypto_headers + \
+        crypto_internal_headers + \
+        crypto_sources + \
+        crypto_sources_asm + \
+        fips_fragments + \
+        ssl_headers + \
+        ssl_internal_headers + \
+        ssl_sources + \
+        tool_headers + \
+        tool_sources + [
+            # rust sources
+            'src/rust/bssl-sys/src/lib.rs',
+            'src/rust/bssl-sys/rust_wrapper.c',
+            'src/rust/bssl-sys/rust_wrapper.h',
+            'src/rust/bssl-sys/wrapper.h',
+        ],
+    visibility = ['third-party//bssl/...'],
+)
+
+src_ref = lambda x: ':src[{}]'.format(x)
+
+cc_copts = [
+    # Assembler option --noexecstack adds .note.GNU-stack to each object to
+    # ensure that binaries can be built with non-executable stack.
+    "-Wa,--noexecstack",
+
+    # This list of warnings should match those in the top-level CMakeLists.txt.
+    "-Wall",
+    "-Werror",
+    "-Wformat=2",
+    "-Wsign-compare",
+    "-Wmissing-field-initializers",
+    "-Wwrite-strings",
+    "-Wshadow",
+    "-fno-common",
+]
+cc_copts_c11 = [
+    "-std=c11",
+    "-Wmissing-prototypes",
+    "-Wold-style-definition",
+    "-Wstrict-prototypes",
+]
+cc_copts_cxx = [
+    "-std=c++14",
+    "-Wmissing-declarations",
+]
+
+boringssl_copts = [
+    "-DBORINGSSL_IMPLEMENTATION",
+] + select({
+    # We assume that non-Windows builds use a GCC-compatible toolchain and that
+    # Windows builds do not.
+    "config//os:windows": [],
+    "DEFAULT": cc_copts,
+}) + select({
+    # This is needed on glibc systems to get rwlock in pthreads, but it should
+    # not be set on Apple platforms or FreeBSD, where it instead disables APIs
+    # we use.
+    # See compat(5), sys/cdefs.h, and https://crbug.com/boringssl/471
+    "config//os:linux": ["-D_XOPEN_SOURCE=700"],
+    # Without WIN32_LEAN_AND_MEAN, <windows.h> pulls in wincrypt.h, which
+    # conflicts with our <openssl/x509.h>.
+    "config//os:windows": ["-DWIN32_LEAN_AND_MEAN", "-DNOMINMAX"],
+    "DEFAULT": [],
+}) + select({
+    "config//os:windows": ["-DOPENSSL_NO_ASM"],
+    "DEFAULT": [],
+})
+
+boringssl_copts_c11 = boringssl_copts + select({
+    "config//os:windows": ["/std:c11"],
+    "DEFAULT": cc_copts_c11,
+})
+
+boringssl_copts_cxx = boringssl_copts + select({
+    "config//os:windows": [],
+    "DEFAULT": cc_copts_cxx,
+})
+
+jj.cxx_library(
+    name = "crypto",
+    srcs = map(src_ref, crypto_sources) + select({
+        "config//os:windows": [],
+        "DEFAULT": map(src_ref, crypto_sources_asm),
+    }),
+    compiler_flags = boringssl_copts_c11,
+
+    header_namespace = "",
+    exported_headers = {
+        x: y for (x, y) in map(lambda x: (x[12:], src_ref(x)), crypto_headers)
+    },
+
+    preferred_linkage = "static",
+    linker_flags = select({
+        "config//os:windows": ["-defaultlib:advapi32.lib"],
+        "DEFAULT": ["-pthread"],
+    }),
+)
+
+jj.cxx_library(
+    name = "ssl",
+    srcs = map(src_ref, ssl_sources),
+    compiler_flags = boringssl_copts_cxx,
+
+    header_namespace = "",
+    exported_headers = {
+        x: y for (x, y) in map(lambda x: (x[12:], src_ref(x)), ssl_headers)
+    },
+
+    preferred_linkage = "static",
+    exported_linker_flags = select({
+        'config//os:linux': [ '-lstdc++' ],
+        'config//os:macos': [ '-lc++' ],
+        'DEFAULT': []
+    }),
+    deps = [ ":crypto" ],
+)
+
+jj.cxx_binary(
+    name = "bssl",
+    srcs = map(src_ref, tool_sources),
+    compiler_flags = boringssl_copts_cxx,
+    deps = [ ":crypto", ":ssl" ],
+    visibility = ['PUBLIC'],
+)

buck/third-party/bssl/BUILD.generated.bzl

@@ -0,0 +1,833 @@
+# This file is created by generate_build_files.py. Do not edit manually.
+
+ssl_headers = [
+    "src/include/openssl/dtls1.h",
+    "src/include/openssl/srtp.h",
+    "src/include/openssl/ssl.h",
+    "src/include/openssl/ssl3.h",
+    "src/include/openssl/tls1.h",
+]
+
+fips_fragments = [
+    "src/crypto/fipsmodule/aes/aes.c",
+    "src/crypto/fipsmodule/aes/aes_nohw.c",
+    "src/crypto/fipsmodule/aes/key_wrap.c",
+    "src/crypto/fipsmodule/aes/mode_wrappers.c",
+    "src/crypto/fipsmodule/bn/add.c",
+    "src/crypto/fipsmodule/bn/asm/x86_64-gcc.c",
+    "src/crypto/fipsmodule/bn/bn.c",
+    "src/crypto/fipsmodule/bn/bytes.c",
+    "src/crypto/fipsmodule/bn/cmp.c",
+    "src/crypto/fipsmodule/bn/ctx.c",
+    "src/crypto/fipsmodule/bn/div.c",
+    "src/crypto/fipsmodule/bn/div_extra.c",
+    "src/crypto/fipsmodule/bn/exponentiation.c",
+    "src/crypto/fipsmodule/bn/gcd.c",
+    "src/crypto/fipsmodule/bn/gcd_extra.c",
+    "src/crypto/fipsmodule/bn/generic.c",
+    "src/crypto/fipsmodule/bn/jacobi.c",
+    "src/crypto/fipsmodule/bn/montgomery.c",
+    "src/crypto/fipsmodule/bn/montgomery_inv.c",
+    "src/crypto/fipsmodule/bn/mul.c",
+    "src/crypto/fipsmodule/bn/prime.c",
+    "src/crypto/fipsmodule/bn/random.c",
+    "src/crypto/fipsmodule/bn/rsaz_exp.c",
+    "src/crypto/fipsmodule/bn/shift.c",
+    "src/crypto/fipsmodule/bn/sqrt.c",
+    "src/crypto/fipsmodule/cipher/aead.c",
+    "src/crypto/fipsmodule/cipher/cipher.c",
+    "src/crypto/fipsmodule/cipher/e_aes.c",
+    "src/crypto/fipsmodule/cipher/e_aesccm.c",
+    "src/crypto/fipsmodule/cmac/cmac.c",
+    "src/crypto/fipsmodule/dh/check.c",
+    "src/crypto/fipsmodule/dh/dh.c",
+    "src/crypto/fipsmodule/digest/digest.c",
+    "src/crypto/fipsmodule/digest/digests.c",
+    "src/crypto/fipsmodule/digestsign/digestsign.c",
+    "src/crypto/fipsmodule/ec/ec.c",
+    "src/crypto/fipsmodule/ec/ec_key.c",
+    "src/crypto/fipsmodule/ec/ec_montgomery.c",
+    "src/crypto/fipsmodule/ec/felem.c",
+    "src/crypto/fipsmodule/ec/oct.c",
+    "src/crypto/fipsmodule/ec/p224-64.c",
+    "src/crypto/fipsmodule/ec/p256-nistz.c",
+    "src/crypto/fipsmodule/ec/p256.c",
+    "src/crypto/fipsmodule/ec/scalar.c",
+    "src/crypto/fipsmodule/ec/simple.c",
+    "src/crypto/fipsmodule/ec/simple_mul.c",
+    "src/crypto/fipsmodule/ec/util.c",
+    "src/crypto/fipsmodule/ec/wnaf.c",
+    "src/crypto/fipsmodule/ecdh/ecdh.c",
+    "src/crypto/fipsmodule/ecdsa/ecdsa.c",
+    "src/crypto/fipsmodule/hkdf/hkdf.c",
+    "src/crypto/fipsmodule/hmac/hmac.c",
+    "src/crypto/fipsmodule/md4/md4.c",
+    "src/crypto/fipsmodule/md5/md5.c",
+    "src/crypto/fipsmodule/modes/cbc.c",
+    "src/crypto/fipsmodule/modes/cfb.c",
+    "src/crypto/fipsmodule/modes/ctr.c",
+    "src/crypto/fipsmodule/modes/gcm.c",
+    "src/crypto/fipsmodule/modes/gcm_nohw.c",
+    "src/crypto/fipsmodule/modes/ofb.c",
+    "src/crypto/fipsmodule/modes/polyval.c",
+    "src/crypto/fipsmodule/rand/ctrdrbg.c",
+    "src/crypto/fipsmodule/rand/fork_detect.c",
+    "src/crypto/fipsmodule/rand/rand.c",
+    "src/crypto/fipsmodule/rand/urandom.c",
+    "src/crypto/fipsmodule/rsa/blinding.c",
+    "src/crypto/fipsmodule/rsa/padding.c",
+    "src/crypto/fipsmodule/rsa/rsa.c",
+    "src/crypto/fipsmodule/rsa/rsa_impl.c",
+    "src/crypto/fipsmodule/self_check/fips.c",
+    "src/crypto/fipsmodule/self_check/self_check.c",
+    "src/crypto/fipsmodule/service_indicator/service_indicator.c",
+    "src/crypto/fipsmodule/sha/sha1.c",
+    "src/crypto/fipsmodule/sha/sha256.c",
+    "src/crypto/fipsmodule/sha/sha512.c",
+    "src/crypto/fipsmodule/tls/kdf.c",
+]
+
+ssl_internal_headers = [
+    "src/ssl/internal.h",
+]
+
+ssl_sources = [
+    "src/ssl/bio_ssl.cc",
+    "src/ssl/d1_both.cc",
+    "src/ssl/d1_lib.cc",
+    "src/ssl/d1_pkt.cc",
+    "src/ssl/d1_srtp.cc",
+    "src/ssl/dtls_method.cc",
+    "src/ssl/dtls_record.cc",
+    "src/ssl/encrypted_client_hello.cc",
+    "src/ssl/extensions.cc",
+    "src/ssl/handoff.cc",
+    "src/ssl/handshake.cc",
+    "src/ssl/handshake_client.cc",
+    "src/ssl/handshake_server.cc",
+    "src/ssl/s3_both.cc",
+    "src/ssl/s3_lib.cc",
+    "src/ssl/s3_pkt.cc",
+    "src/ssl/ssl_aead_ctx.cc",
+    "src/ssl/ssl_asn1.cc",
+    "src/ssl/ssl_buffer.cc",
+    "src/ssl/ssl_cert.cc",
+    "src/ssl/ssl_cipher.cc",
+    "src/ssl/ssl_credential.cc",
+    "src/ssl/ssl_file.cc",
+    "src/ssl/ssl_key_share.cc",
+    "src/ssl/ssl_lib.cc",
+    "src/ssl/ssl_privkey.cc",
+    "src/ssl/ssl_session.cc",
+    "src/ssl/ssl_stat.cc",
+    "src/ssl/ssl_transcript.cc",
+    "src/ssl/ssl_versions.cc",
+    "src/ssl/ssl_x509.cc",
+    "src/ssl/t1_enc.cc",
+    "src/ssl/tls13_both.cc",
+    "src/ssl/tls13_client.cc",
+    "src/ssl/tls13_enc.cc",
+    "src/ssl/tls13_server.cc",
+    "src/ssl/tls_method.cc",
+    "src/ssl/tls_record.cc",
+]
+
+crypto_headers = [
+    "src/include/openssl/aead.h",
+    "src/include/openssl/aes.h",
+    "src/include/openssl/arm_arch.h",
+    "src/include/openssl/asm_base.h",
+    "src/include/openssl/asn1.h",
+    "src/include/openssl/asn1_mac.h",
+    "src/include/openssl/asn1t.h",
+    "src/include/openssl/base.h",
+    "src/include/openssl/base64.h",
+    "src/include/openssl/bio.h",
+    "src/include/openssl/blake2.h",
+    "src/include/openssl/blowfish.h",
+    "src/include/openssl/bn.h",
+    "src/include/openssl/buf.h",
+    "src/include/openssl/buffer.h",
+    "src/include/openssl/bytestring.h",
+    "src/include/openssl/cast.h",
+    "src/include/openssl/chacha.h",
+    "src/include/openssl/cipher.h",
+    "src/include/openssl/cmac.h",
+    "src/include/openssl/conf.h",
+    "src/include/openssl/cpu.h",
+    "src/include/openssl/crypto.h",
+    "src/include/openssl/ctrdrbg.h",
+    "src/include/openssl/curve25519.h",
+    "src/include/openssl/des.h",
+    "src/include/openssl/dh.h",
+    "src/include/openssl/digest.h",
+    "src/include/openssl/dsa.h",
+    "src/include/openssl/e_os2.h",
+    "src/include/openssl/ec.h",
+    "src/include/openssl/ec_key.h",
+    "src/include/openssl/ecdh.h",
+    "src/include/openssl/ecdsa.h",
+    "src/include/openssl/engine.h",
+    "src/include/openssl/err.h",
+    "src/include/openssl/evp.h",
+    "src/include/openssl/evp_errors.h",
+    "src/include/openssl/ex_data.h",
+    "src/include/openssl/experimental/dilithium.h",
+    "src/include/openssl/experimental/kyber.h",
+    "src/include/openssl/experimental/spx.h",
+    "src/include/openssl/hkdf.h",
+    "src/include/openssl/hmac.h",
+    "src/include/openssl/hpke.h",
+    "src/include/openssl/hrss.h",
+    "src/include/openssl/is_boringssl.h",
+    "src/include/openssl/kdf.h",
+    "src/include/openssl/lhash.h",
+    "src/include/openssl/md4.h",
+    "src/include/openssl/md5.h",
+    "src/include/openssl/mem.h",
+    "src/include/openssl/nid.h",
+    "src/include/openssl/obj.h",
+    "src/include/openssl/obj_mac.h",
+    "src/include/openssl/objects.h",
+    "src/include/openssl/opensslconf.h",
+    "src/include/openssl/opensslv.h",
+    "src/include/openssl/ossl_typ.h",
+    "src/include/openssl/pem.h",
+    "src/include/openssl/pkcs12.h",
+    "src/include/openssl/pkcs7.h",
+    "src/include/openssl/pkcs8.h",
+    "src/include/openssl/poly1305.h",
+    "src/include/openssl/pool.h",
+    "src/include/openssl/posix_time.h",
+    "src/include/openssl/rand.h",
+    "src/include/openssl/rc4.h",
+    "src/include/openssl/ripemd.h",
+    "src/include/openssl/rsa.h",
+    "src/include/openssl/safestack.h",
+    "src/include/openssl/service_indicator.h",
+    "src/include/openssl/sha.h",
+    "src/include/openssl/siphash.h",
+    "src/include/openssl/span.h",
+    "src/include/openssl/stack.h",
+    "src/include/openssl/target.h",
+    "src/include/openssl/thread.h",
+    "src/include/openssl/time.h",
+    "src/include/openssl/trust_token.h",
+    "src/include/openssl/type_check.h",
+    "src/include/openssl/x509.h",
+    "src/include/openssl/x509_vfy.h",
+    "src/include/openssl/x509v3.h",
+    "src/include/openssl/x509v3_errors.h",
+]
+
+crypto_internal_headers = [
+    "src/crypto/asn1/internal.h",
+    "src/crypto/bio/internal.h",
+    "src/crypto/bytestring/internal.h",
+    "src/crypto/chacha/internal.h",
+    "src/crypto/cipher_extra/internal.h",
+    "src/crypto/conf/internal.h",
+    "src/crypto/cpu_arm_linux.h",
+    "src/crypto/curve25519/curve25519_tables.h",
+    "src/crypto/curve25519/internal.h",
+    "src/crypto/des/internal.h",
+    "src/crypto/dilithium/internal.h",
+    "src/crypto/dsa/internal.h",
+    "src/crypto/ec_extra/internal.h",
+    "src/crypto/err/internal.h",
+    "src/crypto/evp/internal.h",
+    "src/crypto/fipsmodule/aes/internal.h",
+    "src/crypto/fipsmodule/bn/internal.h",
+    "src/crypto/fipsmodule/bn/rsaz_exp.h",
+    "src/crypto/fipsmodule/cipher/internal.h",
+    "src/crypto/fipsmodule/delocate.h",
+    "src/crypto/fipsmodule/dh/internal.h",
+    "src/crypto/fipsmodule/digest/internal.h",
+    "src/crypto/fipsmodule/digest/md32_common.h",
+    "src/crypto/fipsmodule/ec/builtin_curves.h",
+    "src/crypto/fipsmodule/ec/internal.h",
+    "src/crypto/fipsmodule/ec/p256-nistz-table.h",
+    "src/crypto/fipsmodule/ec/p256-nistz.h",
+    "src/crypto/fipsmodule/ec/p256_table.h",
+    "src/crypto/fipsmodule/ecdsa/internal.h",
+    "src/crypto/fipsmodule/md5/internal.h",
+    "src/crypto/fipsmodule/modes/internal.h",
+    "src/crypto/fipsmodule/rand/fork_detect.h",
+    "src/crypto/fipsmodule/rand/getrandom_fillin.h",
+    "src/crypto/fipsmodule/rand/internal.h",
+    "src/crypto/fipsmodule/rsa/internal.h",
+    "src/crypto/fipsmodule/service_indicator/internal.h",
+    "src/crypto/fipsmodule/sha/internal.h",
+    "src/crypto/fipsmodule/tls/internal.h",
+    "src/crypto/hrss/internal.h",
+    "src/crypto/internal.h",
+    "src/crypto/keccak/internal.h",
+    "src/crypto/kyber/internal.h",
+    "src/crypto/lhash/internal.h",
+    "src/crypto/obj/obj_dat.h",
+    "src/crypto/pkcs7/internal.h",
+    "src/crypto/pkcs8/internal.h",
+    "src/crypto/poly1305/internal.h",
+    "src/crypto/pool/internal.h",
+    "src/crypto/rsa_extra/internal.h",
+    "src/crypto/spx/address.h",
+    "src/crypto/spx/fors.h",
+    "src/crypto/spx/merkle.h",
+    "src/crypto/spx/params.h",
+    "src/crypto/spx/spx_util.h",
+    "src/crypto/spx/thash.h",
+    "src/crypto/spx/wots.h",
+    "src/crypto/trust_token/internal.h",
+    "src/crypto/x509/ext_dat.h",
+    "src/crypto/x509/internal.h",
+    "src/third_party/fiat/curve25519_32.h",
+    "src/third_party/fiat/curve25519_64.h",
+    "src/third_party/fiat/curve25519_64_adx.h",
+    "src/third_party/fiat/curve25519_64_msvc.h",
+    "src/third_party/fiat/p256_32.h",
+    "src/third_party/fiat/p256_64.h",
+    "src/third_party/fiat/p256_64_msvc.h",
+]
+
+crypto_sources = [
+    "src/crypto/asn1/a_bitstr.c",
+    "src/crypto/asn1/a_bool.c",
+    "src/crypto/asn1/a_d2i_fp.c",
+    "src/crypto/asn1/a_dup.c",
+    "src/crypto/asn1/a_gentm.c",
+    "src/crypto/asn1/a_i2d_fp.c",
+    "src/crypto/asn1/a_int.c",
+    "src/crypto/asn1/a_mbstr.c",
+    "src/crypto/asn1/a_object.c",
+    "src/crypto/asn1/a_octet.c",
+    "src/crypto/asn1/a_strex.c",
+    "src/crypto/asn1/a_strnid.c",
+    "src/crypto/asn1/a_time.c",
+    "src/crypto/asn1/a_type.c",
+    "src/crypto/asn1/a_utctm.c",
+    "src/crypto/asn1/asn1_lib.c",
+    "src/crypto/asn1/asn1_par.c",
+    "src/crypto/asn1/asn_pack.c",
+    "src/crypto/asn1/f_int.c",
+    "src/crypto/asn1/f_string.c",
+    "src/crypto/asn1/posix_time.c",
+    "src/crypto/asn1/tasn_dec.c",
+    "src/crypto/asn1/tasn_enc.c",
+    "src/crypto/asn1/tasn_fre.c",
+    "src/crypto/asn1/tasn_new.c",
+    "src/crypto/asn1/tasn_typ.c",
+    "src/crypto/asn1/tasn_utl.c",
+    "src/crypto/base64/base64.c",
+    "src/crypto/bio/bio.c",
+    "src/crypto/bio/bio_mem.c",
+    "src/crypto/bio/connect.c",
+    "src/crypto/bio/errno.c",
+    "src/crypto/bio/fd.c",
+    "src/crypto/bio/file.c",
+    "src/crypto/bio/hexdump.c",
+    "src/crypto/bio/pair.c",
+    "src/crypto/bio/printf.c",
+    "src/crypto/bio/socket.c",
+    "src/crypto/bio/socket_helper.c",
+    "src/crypto/blake2/blake2.c",
+    "src/crypto/bn_extra/bn_asn1.c",
+    "src/crypto/bn_extra/convert.c",
+    "src/crypto/buf/buf.c",
+    "src/crypto/bytestring/asn1_compat.c",
+    "src/crypto/bytestring/ber.c",
+    "src/crypto/bytestring/cbb.c",
+    "src/crypto/bytestring/cbs.c",
+    "src/crypto/bytestring/unicode.c",
+    "src/crypto/chacha/chacha.c",
+    "src/crypto/cipher_extra/cipher_extra.c",
+    "src/crypto/cipher_extra/derive_key.c",
+    "src/crypto/cipher_extra/e_aesctrhmac.c",
+    "src/crypto/cipher_extra/e_aesgcmsiv.c",
+    "src/crypto/cipher_extra/e_chacha20poly1305.c",
+    "src/crypto/cipher_extra/e_des.c",
+    "src/crypto/cipher_extra/e_null.c",
+    "src/crypto/cipher_extra/e_rc2.c",
+    "src/crypto/cipher_extra/e_rc4.c",
+    "src/crypto/cipher_extra/e_tls.c",
+    "src/crypto/cipher_extra/tls_cbc.c",
+    "src/crypto/conf/conf.c",
+    "src/crypto/cpu_aarch64_apple.c",
+    "src/crypto/cpu_aarch64_fuchsia.c",
+    "src/crypto/cpu_aarch64_linux.c",
+    "src/crypto/cpu_aarch64_openbsd.c",
+    "src/crypto/cpu_aarch64_sysreg.c",
+    "src/crypto/cpu_aarch64_win.c",
+    "src/crypto/cpu_arm_freebsd.c",
+    "src/crypto/cpu_arm_linux.c",
+    "src/crypto/cpu_intel.c",
+    "src/crypto/crypto.c",
+    "src/crypto/curve25519/curve25519.c",
+    "src/crypto/curve25519/curve25519_64_adx.c",
+    "src/crypto/curve25519/spake25519.c",
+    "src/crypto/des/des.c",
+    "src/crypto/dh_extra/dh_asn1.c",
+    "src/crypto/dh_extra/params.c",
+    "src/crypto/digest_extra/digest_extra.c",
+    "src/crypto/dilithium/dilithium.c",
+    "src/crypto/dsa/dsa.c",
+    "src/crypto/dsa/dsa_asn1.c",
+    "src/crypto/ec_extra/ec_asn1.c",
+    "src/crypto/ec_extra/ec_derive.c",
+    "src/crypto/ec_extra/hash_to_curve.c",
+    "src/crypto/ecdh_extra/ecdh_extra.c",
+    "src/crypto/ecdsa_extra/ecdsa_asn1.c",
+    "src/crypto/engine/engine.c",
+    "src/crypto/err/err.c",
+    "src/crypto/evp/evp.c",
+    "src/crypto/evp/evp_asn1.c",
+    "src/crypto/evp/evp_ctx.c",
+    "src/crypto/evp/p_dh.c",
+    "src/crypto/evp/p_dh_asn1.c",
+    "src/crypto/evp/p_dsa_asn1.c",
+    "src/crypto/evp/p_ec.c",
+    "src/crypto/evp/p_ec_asn1.c",
+    "src/crypto/evp/p_ed25519.c",
+    "src/crypto/evp/p_ed25519_asn1.c",
+    "src/crypto/evp/p_hkdf.c",
+    "src/crypto/evp/p_rsa.c",
+    "src/crypto/evp/p_rsa_asn1.c",
+    "src/crypto/evp/p_x25519.c",
+    "src/crypto/evp/p_x25519_asn1.c",
+    "src/crypto/evp/pbkdf.c",
+    "src/crypto/evp/print.c",
+    "src/crypto/evp/scrypt.c",
+    "src/crypto/evp/sign.c",
+    "src/crypto/ex_data.c",
+    "src/crypto/fipsmodule/bcm.c",
+    "src/crypto/fipsmodule/fips_shared_support.c",
+    "src/crypto/hpke/hpke.c",
+    "src/crypto/hrss/hrss.c",
+    "src/crypto/keccak/keccak.c",
+    "src/crypto/kyber/kyber.c",
+    "src/crypto/lhash/lhash.c",
+    "src/crypto/mem.c",
+    "src/crypto/obj/obj.c",
+    "src/crypto/obj/obj_xref.c",
+    "src/crypto/pem/pem_all.c",
+    "src/crypto/pem/pem_info.c",
+    "src/crypto/pem/pem_lib.c",
+    "src/crypto/pem/pem_oth.c",
+    "src/crypto/pem/pem_pk8.c",
+    "src/crypto/pem/pem_pkey.c",
+    "src/crypto/pem/pem_x509.c",
+    "src/crypto/pem/pem_xaux.c",
+    "src/crypto/pkcs7/pkcs7.c",
+    "src/crypto/pkcs7/pkcs7_x509.c",
+    "src/crypto/pkcs8/p5_pbev2.c",
+    "src/crypto/pkcs8/pkcs8.c",
+    "src/crypto/pkcs8/pkcs8_x509.c",
+    "src/crypto/poly1305/poly1305.c",
+    "src/crypto/poly1305/poly1305_arm.c",
+    "src/crypto/poly1305/poly1305_vec.c",
+    "src/crypto/pool/pool.c",
+    "src/crypto/rand_extra/deterministic.c",
+    "src/crypto/rand_extra/forkunsafe.c",
+    "src/crypto/rand_extra/getentropy.c",
+    "src/crypto/rand_extra/ios.c",
+    "src/crypto/rand_extra/passive.c",
+    "src/crypto/rand_extra/rand_extra.c",
+    "src/crypto/rand_extra/trusty.c",
+    "src/crypto/rand_extra/windows.c",
+    "src/crypto/rc4/rc4.c",
+    "src/crypto/refcount.c",
+    "src/crypto/rsa_extra/rsa_asn1.c",
+    "src/crypto/rsa_extra/rsa_crypt.c",
+    "src/crypto/rsa_extra/rsa_print.c",
+    "src/crypto/siphash/siphash.c",
+    "src/crypto/spx/address.c",
+    "src/crypto/spx/fors.c",
+    "src/crypto/spx/merkle.c",
+    "src/crypto/spx/spx.c",
+    "src/crypto/spx/spx_util.c",
+    "src/crypto/spx/thash.c",
+    "src/crypto/spx/wots.c",
+    "src/crypto/stack/stack.c",
+    "src/crypto/thread.c",
+    "src/crypto/thread_none.c",
+    "src/crypto/thread_pthread.c",
+    "src/crypto/thread_win.c",
+    "src/crypto/trust_token/pmbtoken.c",
+    "src/crypto/trust_token/trust_token.c",
+    "src/crypto/trust_token/voprf.c",
+    "src/crypto/x509/a_digest.c",
+    "src/crypto/x509/a_sign.c",
+    "src/crypto/x509/a_verify.c",
+    "src/crypto/x509/algorithm.c",
+    "src/crypto/x509/asn1_gen.c",
+    "src/crypto/x509/by_dir.c",
+    "src/crypto/x509/by_file.c",
+    "src/crypto/x509/i2d_pr.c",
+    "src/crypto/x509/name_print.c",
+    "src/crypto/x509/policy.c",
+    "src/crypto/x509/rsa_pss.c",
+    "src/crypto/x509/t_crl.c",
+    "src/crypto/x509/t_req.c",
+    "src/crypto/x509/t_x509.c",
+    "src/crypto/x509/t_x509a.c",
+    "src/crypto/x509/v3_akey.c",
+    "src/crypto/x509/v3_akeya.c",
+    "src/crypto/x509/v3_alt.c",
+    "src/crypto/x509/v3_bcons.c",
+    "src/crypto/x509/v3_bitst.c",
+    "src/crypto/x509/v3_conf.c",
+    "src/crypto/x509/v3_cpols.c",
+    "src/crypto/x509/v3_crld.c",
+    "src/crypto/x509/v3_enum.c",
+    "src/crypto/x509/v3_extku.c",
+    "src/crypto/x509/v3_genn.c",
+    "src/crypto/x509/v3_ia5.c",
+    "src/crypto/x509/v3_info.c",
+    "src/crypto/x509/v3_int.c",
+    "src/crypto/x509/v3_lib.c",
+    "src/crypto/x509/v3_ncons.c",
+    "src/crypto/x509/v3_ocsp.c",
+    "src/crypto/x509/v3_pcons.c",
+    "src/crypto/x509/v3_pmaps.c",
+    "src/crypto/x509/v3_prn.c",
+    "src/crypto/x509/v3_purp.c",
+    "src/crypto/x509/v3_skey.c",
+    "src/crypto/x509/v3_utl.c",
+    "src/crypto/x509/x509.c",
+    "src/crypto/x509/x509_att.c",
+    "src/crypto/x509/x509_cmp.c",
+    "src/crypto/x509/x509_d2.c",
+    "src/crypto/x509/x509_def.c",
+    "src/crypto/x509/x509_ext.c",
+    "src/crypto/x509/x509_lu.c",
+    "src/crypto/x509/x509_obj.c",
+    "src/crypto/x509/x509_req.c",
+    "src/crypto/x509/x509_set.c",
+    "src/crypto/x509/x509_trs.c",
+    "src/crypto/x509/x509_txt.c",
+    "src/crypto/x509/x509_v3.c",
+    "src/crypto/x509/x509_vfy.c",
+    "src/crypto/x509/x509_vpm.c",
+    "src/crypto/x509/x509cset.c",
+    "src/crypto/x509/x509name.c",
+    "src/crypto/x509/x509rset.c",
+    "src/crypto/x509/x509spki.c",
+    "src/crypto/x509/x_algor.c",
+    "src/crypto/x509/x_all.c",
+    "src/crypto/x509/x_attrib.c",
+    "src/crypto/x509/x_crl.c",
+    "src/crypto/x509/x_exten.c",
+    "src/crypto/x509/x_name.c",
+    "src/crypto/x509/x_pubkey.c",
+    "src/crypto/x509/x_req.c",
+    "src/crypto/x509/x_sig.c",
+    "src/crypto/x509/x_spki.c",
+    "src/crypto/x509/x_val.c",
+    "src/crypto/x509/x_x509.c",
+    "src/crypto/x509/x_x509a.c",
+    "src/gen/crypto/err_data.c",
+]
+
+crypto_sources_asm = [
+    "src/crypto/curve25519/asm/x25519-asm-arm.S",
+    "src/crypto/hrss/asm/poly_rq_mul.S",
+    "src/crypto/poly1305/poly1305_arm_asm.S",
+    "src/gen/bcm/aesni-gcm-x86_64-apple.S",
+    "src/gen/bcm/aesni-gcm-x86_64-linux.S",
+    "src/gen/bcm/aesni-x86-apple.S",
+    "src/gen/bcm/aesni-x86-linux.S",
+    "src/gen/bcm/aesni-x86_64-apple.S",
+    "src/gen/bcm/aesni-x86_64-linux.S",
+    "src/gen/bcm/aesv8-armv7-linux.S",
+    "src/gen/bcm/aesv8-armv8-apple.S",
+    "src/gen/bcm/aesv8-armv8-linux.S",
+    "src/gen/bcm/aesv8-armv8-win.S",
+    "src/gen/bcm/aesv8-gcm-armv8-apple.S",
+    "src/gen/bcm/aesv8-gcm-armv8-linux.S",
+    "src/gen/bcm/aesv8-gcm-armv8-win.S",
+    "src/gen/bcm/armv4-mont-linux.S",
+    "src/gen/bcm/armv8-mont-apple.S",
+    "src/gen/bcm/armv8-mont-linux.S",
+    "src/gen/bcm/armv8-mont-win.S",
+    "src/gen/bcm/bn-586-apple.S",
+    "src/gen/bcm/bn-586-linux.S",
+    "src/gen/bcm/bn-armv8-apple.S",
+    "src/gen/bcm/bn-armv8-linux.S",
+    "src/gen/bcm/bn-armv8-win.S",
+    "src/gen/bcm/bsaes-armv7-linux.S",
+    "src/gen/bcm/co-586-apple.S",
+    "src/gen/bcm/co-586-linux.S",
+    "src/gen/bcm/ghash-armv4-linux.S",
+    "src/gen/bcm/ghash-neon-armv8-apple.S",
+    "src/gen/bcm/ghash-neon-armv8-linux.S",
+    "src/gen/bcm/ghash-neon-armv8-win.S",
+    "src/gen/bcm/ghash-ssse3-x86-apple.S",
+    "src/gen/bcm/ghash-ssse3-x86-linux.S",
+    "src/gen/bcm/ghash-ssse3-x86_64-apple.S",
+    "src/gen/bcm/ghash-ssse3-x86_64-linux.S",
+    "src/gen/bcm/ghash-x86-apple.S",
+    "src/gen/bcm/ghash-x86-linux.S",
+    "src/gen/bcm/ghash-x86_64-apple.S",
+    "src/gen/bcm/ghash-x86_64-linux.S",
+    "src/gen/bcm/ghashv8-armv7-linux.S",
+    "src/gen/bcm/ghashv8-armv8-apple.S",
+    "src/gen/bcm/ghashv8-armv8-linux.S",
+    "src/gen/bcm/ghashv8-armv8-win.S",
+    "src/gen/bcm/md5-586-apple.S",
+    "src/gen/bcm/md5-586-linux.S",
+    "src/gen/bcm/md5-x86_64-apple.S",
+    "src/gen/bcm/md5-x86_64-linux.S",
+    "src/gen/bcm/p256-armv8-asm-apple.S",
+    "src/gen/bcm/p256-armv8-asm-linux.S",
+    "src/gen/bcm/p256-armv8-asm-win.S",
+    "src/gen/bcm/p256-x86_64-asm-apple.S",
+    "src/gen/bcm/p256-x86_64-asm-linux.S",
+    "src/gen/bcm/p256_beeu-armv8-asm-apple.S",
+    "src/gen/bcm/p256_beeu-armv8-asm-linux.S",
+    "src/gen/bcm/p256_beeu-armv8-asm-win.S",
+    "src/gen/bcm/p256_beeu-x86_64-asm-apple.S",
+    "src/gen/bcm/p256_beeu-x86_64-asm-linux.S",
+    "src/gen/bcm/rdrand-x86_64-apple.S",
+    "src/gen/bcm/rdrand-x86_64-linux.S",
+    "src/gen/bcm/rsaz-avx2-apple.S",
+    "src/gen/bcm/rsaz-avx2-linux.S",
+    "src/gen/bcm/sha1-586-apple.S",
+    "src/gen/bcm/sha1-586-linux.S",
+    "src/gen/bcm/sha1-armv4-large-linux.S",
+    "src/gen/bcm/sha1-armv8-apple.S",
+    "src/gen/bcm/sha1-armv8-linux.S",
+    "src/gen/bcm/sha1-armv8-win.S",
+    "src/gen/bcm/sha1-x86_64-apple.S",
+    "src/gen/bcm/sha1-x86_64-linux.S",
+    "src/gen/bcm/sha256-586-apple.S",
+    "src/gen/bcm/sha256-586-linux.S",
+    "src/gen/bcm/sha256-armv4-linux.S",
+    "src/gen/bcm/sha256-armv8-apple.S",
+    "src/gen/bcm/sha256-armv8-linux.S",
+    "src/gen/bcm/sha256-armv8-win.S",
+    "src/gen/bcm/sha256-x86_64-apple.S",
+    "src/gen/bcm/sha256-x86_64-linux.S",
+    "src/gen/bcm/sha512-586-apple.S",
+    "src/gen/bcm/sha512-586-linux.S",
+    "src/gen/bcm/sha512-armv4-linux.S",
+    "src/gen/bcm/sha512-armv8-apple.S",
+    "src/gen/bcm/sha512-armv8-linux.S",
+    "src/gen/bcm/sha512-armv8-win.S",
+    "src/gen/bcm/sha512-x86_64-apple.S",
+    "src/gen/bcm/sha512-x86_64-linux.S",
+    "src/gen/bcm/vpaes-armv7-linux.S",
+    "src/gen/bcm/vpaes-armv8-apple.S",
+    "src/gen/bcm/vpaes-armv8-linux.S",
+    "src/gen/bcm/vpaes-armv8-win.S",
+    "src/gen/bcm/vpaes-x86-apple.S",
+    "src/gen/bcm/vpaes-x86-linux.S",
+    "src/gen/bcm/vpaes-x86_64-apple.S",
+    "src/gen/bcm/vpaes-x86_64-linux.S",
+    "src/gen/bcm/x86-mont-apple.S",
+    "src/gen/bcm/x86-mont-linux.S",
+    "src/gen/bcm/x86_64-mont-apple.S",
+    "src/gen/bcm/x86_64-mont-linux.S",
+    "src/gen/bcm/x86_64-mont5-apple.S",
+    "src/gen/bcm/x86_64-mont5-linux.S",
+    "src/gen/crypto/aes128gcmsiv-x86_64-apple.S",
+    "src/gen/crypto/aes128gcmsiv-x86_64-linux.S",
+    "src/gen/crypto/chacha-armv4-linux.S",
+    "src/gen/crypto/chacha-armv8-apple.S",
+    "src/gen/crypto/chacha-armv8-linux.S",
+    "src/gen/crypto/chacha-armv8-win.S",
+    "src/gen/crypto/chacha-x86-apple.S",
+    "src/gen/crypto/chacha-x86-linux.S",
+    "src/gen/crypto/chacha-x86_64-apple.S",
+    "src/gen/crypto/chacha-x86_64-linux.S",
+    "src/gen/crypto/chacha20_poly1305_armv8-apple.S",
+    "src/gen/crypto/chacha20_poly1305_armv8-linux.S",
+    "src/gen/crypto/chacha20_poly1305_armv8-win.S",
+    "src/gen/crypto/chacha20_poly1305_x86_64-apple.S",
+    "src/gen/crypto/chacha20_poly1305_x86_64-linux.S",
+    "src/gen/test_support/trampoline-armv4-linux.S",
+    "src/gen/test_support/trampoline-armv8-apple.S",
+    "src/gen/test_support/trampoline-armv8-linux.S",
+    "src/gen/test_support/trampoline-armv8-win.S",
+    "src/gen/test_support/trampoline-x86-apple.S",
+    "src/gen/test_support/trampoline-x86-linux.S",
+    "src/gen/test_support/trampoline-x86_64-apple.S",
+    "src/gen/test_support/trampoline-x86_64-linux.S",
+    "src/third_party/fiat/asm/fiat_curve25519_adx_mul.S",
+    "src/third_party/fiat/asm/fiat_curve25519_adx_square.S",
+    "src/third_party/fiat/asm/fiat_p256_adx_mul.S",
+    "src/third_party/fiat/asm/fiat_p256_adx_sqr.S",
+]
+
+crypto_sources_nasm = [
+    "src/gen/bcm/aesni-gcm-x86_64-win.asm",
+    "src/gen/bcm/aesni-x86-win.asm",
+    "src/gen/bcm/aesni-x86_64-win.asm",
+    "src/gen/bcm/bn-586-win.asm",
+    "src/gen/bcm/co-586-win.asm",
+    "src/gen/bcm/ghash-ssse3-x86-win.asm",
+    "src/gen/bcm/ghash-ssse3-x86_64-win.asm",
+    "src/gen/bcm/ghash-x86-win.asm",
+    "src/gen/bcm/ghash-x86_64-win.asm",
+    "src/gen/bcm/md5-586-win.asm",
+    "src/gen/bcm/md5-x86_64-win.asm",
+    "src/gen/bcm/p256-x86_64-asm-win.asm",
+    "src/gen/bcm/p256_beeu-x86_64-asm-win.asm",
+    "src/gen/bcm/rdrand-x86_64-win.asm",
+    "src/gen/bcm/rsaz-avx2-win.asm",
+    "src/gen/bcm/sha1-586-win.asm",
+    "src/gen/bcm/sha1-x86_64-win.asm",
+    "src/gen/bcm/sha256-586-win.asm",
+    "src/gen/bcm/sha256-x86_64-win.asm",
+    "src/gen/bcm/sha512-586-win.asm",
+    "src/gen/bcm/sha512-x86_64-win.asm",
+    "src/gen/bcm/vpaes-x86-win.asm",
+    "src/gen/bcm/vpaes-x86_64-win.asm",
+    "src/gen/bcm/x86-mont-win.asm",
+    "src/gen/bcm/x86_64-mont-win.asm",
+    "src/gen/bcm/x86_64-mont5-win.asm",
+    "src/gen/crypto/aes128gcmsiv-x86_64-win.asm",
+    "src/gen/crypto/chacha-x86-win.asm",
+    "src/gen/crypto/chacha-x86_64-win.asm",
+    "src/gen/crypto/chacha20_poly1305_x86_64-win.asm",
+    "src/gen/test_support/trampoline-x86-win.asm",
+    "src/gen/test_support/trampoline-x86_64-win.asm",
+]
+
+pki_headers = [
+    "src/include/openssl/pki/certificate.h",
+    "src/include/openssl/pki/signature_verify_cache.h",
+    "src/include/openssl/pki/verify_error.h",
+]
+
+pki_internal_headers = [
+    "src/pki/cert_error_id.h",
+    "src/pki/cert_error_params.h",
+    "src/pki/cert_errors.h",
+    "src/pki/cert_issuer_source.h",
+    "src/pki/cert_issuer_source_static.h",
+    "src/pki/cert_issuer_source_sync_unittest.h",
+    "src/pki/certificate_policies.h",
+    "src/pki/common_cert_errors.h",
+    "src/pki/crl.h",
+    "src/pki/encode_values.h",
+    "src/pki/extended_key_usage.h",
+    "src/pki/general_names.h",
+    "src/pki/input.h",
+    "src/pki/ip_util.h",
+    "src/pki/mock_signature_verify_cache.h",
+    "src/pki/name_constraints.h",
+    "src/pki/nist_pkits_unittest.h",
+    "src/pki/ocsp.h",
+    "src/pki/ocsp_revocation_status.h",
+    "src/pki/ocsp_verify_result.h",
+    "src/pki/parse_certificate.h",
+    "src/pki/parse_name.h",
+    "src/pki/parse_values.h",
+    "src/pki/parsed_certificate.h",
+    "src/pki/parser.h",
+    "src/pki/path_builder.h",
+    "src/pki/pem.h",
+    "src/pki/revocation_util.h",
+    "src/pki/signature_algorithm.h",
+    "src/pki/simple_path_builder_delegate.h",
+    "src/pki/string_util.h",
+    "src/pki/test_helpers.h",
+    "src/pki/testdata/nist-pkits/pkits_testcases-inl.h",
+    "src/pki/trust_store.h",
+    "src/pki/trust_store_collection.h",
+    "src/pki/trust_store_in_memory.h",
+    "src/pki/verify_certificate_chain.h",
+    "src/pki/verify_certificate_chain_typed_unittest.h",
+    "src/pki/verify_name_match.h",
+    "src/pki/verify_signed_data.h",
+]
+
+pki_sources = [
+    "src/pki/cert_error_id.cc",
+    "src/pki/cert_error_params.cc",
+    "src/pki/cert_errors.cc",
+    "src/pki/cert_issuer_source_static.cc",
+    "src/pki/certificate.cc",
+    "src/pki/certificate_policies.cc",
+    "src/pki/common_cert_errors.cc",
+    "src/pki/crl.cc",
+    "src/pki/encode_values.cc",
+    "src/pki/extended_key_usage.cc",
+    "src/pki/general_names.cc",
+    "src/pki/input.cc",
+    "src/pki/ip_util.cc",
+    "src/pki/name_constraints.cc",
+    "src/pki/ocsp.cc",
+    "src/pki/ocsp_verify_result.cc",
+    "src/pki/parse_certificate.cc",
+    "src/pki/parse_name.cc",
+    "src/pki/parse_values.cc",
+    "src/pki/parsed_certificate.cc",
+    "src/pki/parser.cc",
+    "src/pki/path_builder.cc",
+    "src/pki/pem.cc",
+    "src/pki/revocation_util.cc",
+    "src/pki/signature_algorithm.cc",
+    "src/pki/simple_path_builder_delegate.cc",
+    "src/pki/string_util.cc",
+    "src/pki/trust_store.cc",
+    "src/pki/trust_store_collection.cc",
+    "src/pki/trust_store_in_memory.cc",
+    "src/pki/verify.cc",
+    "src/pki/verify_certificate_chain.cc",
+    "src/pki/verify_error.cc",
+    "src/pki/verify_name_match.cc",
+    "src/pki/verify_signed_data.cc",
+]
+
+rust_bssl_sys = [
+    "src/rust/bssl-sys/src/lib.rs",
+]
+
+rust_bssl_crypto = [
+    "src/rust/bssl-crypto/src/aead.rs",
+    "src/rust/bssl-crypto/src/aes.rs",
+    "src/rust/bssl-crypto/src/cipher/aes_cbc.rs",
+    "src/rust/bssl-crypto/src/cipher/aes_ctr.rs",
+    "src/rust/bssl-crypto/src/cipher/mod.rs",
+    "src/rust/bssl-crypto/src/digest.rs",
+    "src/rust/bssl-crypto/src/ec.rs",
+    "src/rust/bssl-crypto/src/ecdh.rs",
+    "src/rust/bssl-crypto/src/ecdsa.rs",
+    "src/rust/bssl-crypto/src/ed25519.rs",
+    "src/rust/bssl-crypto/src/hkdf.rs",
+    "src/rust/bssl-crypto/src/hmac.rs",
+    "src/rust/bssl-crypto/src/hpke.rs",
+    "src/rust/bssl-crypto/src/lib.rs",
+    "src/rust/bssl-crypto/src/macros.rs",
+    "src/rust/bssl-crypto/src/mem.rs",
+    "src/rust/bssl-crypto/src/rand.rs",
+    "src/rust/bssl-crypto/src/rsa.rs",
+    "src/rust/bssl-crypto/src/scoped.rs",
+    "src/rust/bssl-crypto/src/test_helpers.rs",
+    "src/rust/bssl-crypto/src/x25519.rs",
+]
+
+tool_sources = [
+    "src/tool/args.cc",
+    "src/tool/ciphers.cc",
+    "src/tool/client.cc",
+    "src/tool/const.cc",
+    "src/tool/digest.cc",
+    "src/tool/fd.cc",
+    "src/tool/file.cc",
+    "src/tool/generate_ech.cc",
+    "src/tool/generate_ed25519.cc",
+    "src/tool/genrsa.cc",
+    "src/tool/pkcs12.cc",
+    "src/tool/rand.cc",
+    "src/tool/server.cc",
+    "src/tool/sign.cc",
+    "src/tool/speed.cc",
+    "src/tool/tool.cc",
+    "src/tool/transport_common.cc",
+]
+
+tool_headers = [
+    "src/tool/internal.h",
+    "src/tool/transport_common.h",
+]

buck/third-party/bssl/PACKAGE

@@ -0,0 +1,5 @@
+
+package(
+    inherit = True,
+    visibility = [ 'PUBLIC' ],
+)

buck/third-party/bssl/README.md

@@ -0,0 +1,13 @@
+## BoringSSL Notes
+
+When you update this package, including the git commit and archive hash, make
+sure you also re-download the proper `BUILD.generated.bzl` file, which is
+produced automatically by a bot in the upstream `master-with-bazel` branch:
+
+- https://github.com/google/boringssl/tree/master-with-bazel
+
+```
+curl -Lo \
+    buck/third-party/cxx/bssl/BUILD.generated.bzl \
+    https://raw.githubusercontent.com/google/boringssl/.../BUILD.generated.bzl
+```

buck/third-party/bssl/rust/BUILD

@@ -0,0 +1,100 @@
+
+load("@prelude//:export_exe.bzl", "export_exe")
+
+load("@root//buck/shims/jj.bzl", "jj")
+
+# MARK: main library
+
+# XXX HACK (aseipp): get bindgen-cli binaries everywhere, somehow
+aarch64_linux = host_info().os.is_linux and host_info().arch.is_aarch64
+bindgen = 'bindgen' if aarch64_linux else '$(exe :bindgen)'
+
+genrule(
+    name = 'wrapper.rs',
+    out = 'wrapper.rs',
+    srcs = {
+        'rust_wrapper.c': 'third-party//bssl:src[src/rust/bssl-sys/rust_wrapper.c]',
+        'rust_wrapper.h': 'third-party//bssl:src[src/rust/bssl-sys/rust_wrapper.h]',
+        'wrapper.h': 'third-party//bssl:src[src/rust/bssl-sys/wrapper.h]',
+    },
+    cmd = f"""
+      {bindgen} \
+        wrapper.h -o $OUT \
+          --no-derive-default \
+          --enable-function-attribute-detection \
+          --use-core \
+          --default-macro-constant-type=signed \
+          --rustified-enum=point_conversion_form_t \
+          --allowlist-file=".*[[:punct:]]include[[:punct:]]openssl[[:punct:]].*\\.h" \
+          --experimental \
+          --wrap-static-fns \
+        -- -I$(location third-party//bssl:src)/src/include
+    """,
+    visibility = [],
+)
+
+jj.rust_library(
+    name = 'bssl-sys',
+    srcs = [
+        'third-party//bssl:src[src/rust/bssl-sys/src/lib.rs]',
+    ],
+    env = {
+        'BINDGEN_RS_FILE': '$(location :wrapper.rs)',
+    },
+    deps = [
+        'third-party//bssl:ssl'
+    ],
+    visibility = ['PUBLIC'],
+)
+
+alias(
+    name = 'rust',
+    actual = ':bssl-sys',
+    visibility = ['PUBLIC'],
+)
+
+# MARK: bindgen tooling
+
+VERSION = '0.69.4'
+
+[
+    http_archive(
+        name = f'{name}.tar.xz',
+        sha256 = sha256,
+        urls = [ f'https://github.com/rust-lang/rust-bindgen/releases/download/v{VERSION}/{name}.tar.xz', ],
+        type = 'tar.xz',
+        strip_prefix = name,
+        sub_targets = [ binary ],
+        visibility = [],
+    ) for name, sha256, binary in [
+        ('bindgen-cli-aarch64-apple-darwin', '46b99211e1e8102b0df6ba1dcff9de9e1ac43a895ba77f023feed6ef4fbd5e6e', 'bindgen'),
+        ('bindgen-cli-x86_64-unknown-linux-gnu', '3ede28f4f5e66d3a62d9337e0f485650915ac2c2df75cca69debf04413ad28d0', 'bindgen'),
+    ]
+]
+
+[
+    http_archive(
+        name = f'{name}.tar.gz',
+        sha256 = sha256,
+        urls = [ f'https://github.com/cargo-bins/cargo-quickinstall/releases/download/bindgen-cli-{VERSION}/bindgen-cli-{VERSION}-x86_64-pc-windows-msvc.tar.gz' ],
+        type = 'tar.gz',
+        sub_targets = [ binary ],
+        visibility = [],
+    ) for name, sha256, binary in [
+        ('bindgen-cli-x86_64-pc-windows-msvc', '3416fcd40adaa08e8fc3fbf2d40160fa4db03d6e70bd330df18c33456e2b418c', 'bindgen.exe'),
+    ]
+]
+
+export_exe(
+    name = 'bindgen',
+    src = select({
+        'config//cpu:x86_64': select({
+            'config//os:linux': ':bindgen-cli-x86_64-unknown-linux-gnu.tar.xz[bindgen]',
+            'config//os:windows': ':bindgen-cli-x86_64-pc-windows-msvc.tar.gz[bindgen.exe]',
+        }),
+        'config//cpu:arm64': select({
+            'config//os:macos': ':bindgen-cli-aarch64-apple-darwin.tar.xz[bindgen]',
+        }),
+    }),
+    visibility = [],
+)

buck/third-party/libgit2/BUILD

@@ -0,0 +1,523 @@
+
+load("@root//buck/shims/jj.bzl", "jj")
+
+VERSION = '1.8.1'
+
+http_archive(
+    name = 'src',
+    sha256 = '8c1eaf0cf07cba0e9021920bfba9502140220786ed5d8a8ec6c7ad9174522f8e',
+    urls = [
+        f'https://github.com/libgit2/libgit2/archive/refs/tags/v{VERSION}.tar.gz',
+    ],
+    type = 'tar.gz',
+    strip_prefix = f'libgit2-{VERSION}',
+    sub_targets = [
+        "deps/llhttp/api.c",
+        "deps/llhttp/http.c",
+        "deps/llhttp/llhttp.c",
+        "deps/llhttp/llhttp.h",
+        "deps/pcre/pcre_byte_order.c",
+        "deps/pcre/pcre_chartables.c",
+        "deps/pcre/pcre_compile.c",
+        "deps/pcre/pcre_config.c",
+        "deps/pcre/pcre_dfa_exec.c",
+        "deps/pcre/pcre_exec.c",
+        "deps/pcre/pcre_fullinfo.c",
+        "deps/pcre/pcre_get.c",
+        "deps/pcre/pcre_globals.c",
+        "deps/pcre/pcre_jit_compile.c",
+        "deps/pcre/pcre_maketables.c",
+        "deps/pcre/pcre_newline.c",
+        "deps/pcre/pcre_ord2utf8.c",
+        "deps/pcre/pcre_printint.c",
+        "deps/pcre/pcre_refcount.c",
+        "deps/pcre/pcre_string_utils.c",
+        "deps/pcre/pcre_study.c",
+        "deps/pcre/pcre_tables.c",
+        "deps/pcre/pcre_ucd.c",
+        "deps/pcre/pcre_valid_utf8.c",
+        "deps/pcre/pcre_version.c",
+        "deps/pcre/pcre_xclass.c",
+        "deps/pcre/pcreposix.c",
+        "deps/xdiff/xdiffi.c",
+        "deps/xdiff/xemit.c",
+        "deps/xdiff/xhistogram.c",
+        "deps/xdiff/xmerge.c",
+        "deps/xdiff/xpatience.c",
+        "deps/xdiff/xprepare.c",
+        "deps/xdiff/xutils.c",
+        "src/libgit2/annotated_commit.c",
+        "src/libgit2/apply.c",
+        "src/libgit2/attr.c",
+        "src/libgit2/attr_file.c",
+        "src/libgit2/attrcache.c",
+        "src/libgit2/blame.c",
+        "src/libgit2/blame_git.c",
+        "src/libgit2/blob.c",
+        "src/libgit2/branch.c",
+        "src/libgit2/buf.c",
+        "src/libgit2/cache.c",
+        "src/libgit2/checkout.c",
+        "src/libgit2/cherrypick.c",
+        "src/libgit2/clone.c",
+        "src/libgit2/commit.c",
+        "src/libgit2/commit_graph.c",
+        "src/libgit2/commit_list.c",
+        "src/libgit2/config.c",
+        "src/libgit2/config_cache.c",
+        "src/libgit2/config_list.c",
+        "src/libgit2/config_file.c",
+        "src/libgit2/config_mem.c",
+        "src/libgit2/config_parse.c",
+        "src/libgit2/config_snapshot.c",
+        "src/libgit2/crlf.c",
+        "src/libgit2/delta.c",
+        "src/libgit2/describe.c",
+        "src/libgit2/diff.c",
+        "src/libgit2/diff_driver.c",
+        "src/libgit2/diff_file.c",
+        "src/libgit2/diff_generate.c",
+        "src/libgit2/diff_parse.c",
+        "src/libgit2/diff_print.c",
+        "src/libgit2/diff_stats.c",
+        "src/libgit2/diff_tform.c",
+        "src/libgit2/diff_xdiff.c",
+        "src/libgit2/email.c",
+        "src/libgit2/fetch.c",
+        "src/libgit2/fetchhead.c",
+        "src/libgit2/filter.c",
+        "src/libgit2/grafts.c",
+        "src/libgit2/graph.c",
+        "src/libgit2/hashsig.c",
+        "src/libgit2/ident.c",
+        "src/libgit2/idxmap.c",
+        "src/libgit2/ignore.c",
+        "src/libgit2/index.c",
+        "src/libgit2/indexer.c",
+        "src/libgit2/iterator.c",
+        "src/libgit2/libgit2.c",
+        "src/libgit2/mailmap.c",
+        "src/libgit2/merge.c",
+        "src/libgit2/merge_driver.c",
+        "src/libgit2/merge_file.c",
+        "src/libgit2/message.c",
+        "src/libgit2/midx.c",
+        "src/libgit2/mwindow.c",
+        "src/libgit2/notes.c",
+        "src/libgit2/object.c",
+        "src/libgit2/object_api.c",
+        "src/libgit2/odb.c",
+        "src/libgit2/odb_loose.c",
+        "src/libgit2/odb_mempack.c",
+        "src/libgit2/odb_pack.c",
+        "src/libgit2/offmap.c",
+        "src/libgit2/oid.c",
+        "src/libgit2/oidarray.c",
+        "src/libgit2/oidmap.c",
+        "src/libgit2/pack.c",
+        "src/libgit2/pack-objects.c",
+        "src/libgit2/parse.c",
+        "src/libgit2/patch.c",
+        "src/libgit2/patch_generate.c",
+        "src/libgit2/patch_parse.c",
+        "src/libgit2/path.c",
+        "src/libgit2/pathspec.c",
+        "src/libgit2/proxy.c",
+        "src/libgit2/push.c",
+        "src/libgit2/reader.c",
+        "src/libgit2/rebase.c",
+        "src/libgit2/refdb.c",
+        "src/libgit2/refdb_fs.c",
+        "src/libgit2/reflog.c",
+        "src/libgit2/refs.c",
+        "src/libgit2/refspec.c",
+        "src/libgit2/remote.c",
+        "src/libgit2/repository.c",
+        "src/libgit2/reset.c",
+        "src/libgit2/revert.c",
+        "src/libgit2/revparse.c",
+        "src/libgit2/revwalk.c",
+        "src/libgit2/settings.c",
+        "src/libgit2/signature.c",
+        "src/libgit2/stash.c",
+        "src/libgit2/status.c",
+        "src/libgit2/strarray.c",
+        "src/libgit2/streams/mbedtls.c",
+        "src/libgit2/streams/openssl.c",
+        "src/libgit2/streams/openssl_dynamic.c",
+        "src/libgit2/streams/openssl_legacy.c",
+        "src/libgit2/streams/registry.c",
+        "src/libgit2/streams/schannel.c",
+        "src/libgit2/streams/socket.c",
+        "src/libgit2/streams/stransport.c",
+        "src/libgit2/streams/tls.c",
+        "src/libgit2/submodule.c",
+        "src/libgit2/sysdir.c",
+        "src/libgit2/tag.c",
+        "src/libgit2/trace.c",
+        "src/libgit2/trailer.c",
+        "src/libgit2/transaction.c",
+        "src/libgit2/transport.c",
+        "src/libgit2/transports/auth.c",
+        "src/libgit2/transports/auth_gssapi.c",
+        "src/libgit2/transports/auth_ntlmclient.c",
+        "src/libgit2/transports/auth_sspi.c",
+        "src/libgit2/transports/credential.c",
+        "src/libgit2/transports/credential_helpers.c",
+        "src/libgit2/transports/git.c",
+        "src/libgit2/transports/http.c",
+        "src/libgit2/transports/httpclient.c",
+        "src/libgit2/transports/httpparser.c",
+        "src/libgit2/transports/local.c",
+        "src/libgit2/transports/smart.c",
+        "src/libgit2/transports/smart_pkt.c",
+        "src/libgit2/transports/smart_protocol.c",
+        "src/libgit2/transports/ssh.c",
+        "src/libgit2/transports/ssh_libssh2.c",
+        "src/libgit2/transports/winhttp.c",
+        "src/libgit2/tree.c",
+        "src/libgit2/tree-cache.c",
+        "src/libgit2/worktree.c",
+        "src/util/alloc.c",
+        "src/util/allocators/failalloc.c",
+        "src/util/allocators/stdalloc.c",
+        "src/util/date.c",
+        "src/util/errors.c",
+        "src/util/filebuf.c",
+        "src/util/fs_path.c",
+        "src/util/futils.c",
+        "src/util/hash.c",
+        "src/util/hash/collisiondetect.c",
+        "src/util/hash/openssl.c",
+        "src/util/hash/sha1dc/sha1.c",
+        "src/util/hash/sha1dc/ubc_check.c",
+        "src/util/net.c",
+        "src/util/pool.c",
+        "src/util/posix.c",
+        "src/util/pqueue.c",
+        "src/util/rand.c",
+        "src/util/regexp.c",
+        "src/util/runtime.c",
+        "src/util/sortedcache.c",
+        "src/util/str.c",
+        "src/util/strmap.c",
+        "src/util/thread.c",
+        "src/util/tsort.c",
+        "src/util/unix/map.c",
+        "src/util/unix/realpath.c",
+        "src/util/win32/dir.c",
+        "src/util/win32/dir.h",
+        "src/util/win32/error.c",
+        "src/util/win32/error.h",
+        "src/util/win32/map.c",
+        "src/util/win32/mingw-compat.h",
+        "src/util/win32/msvc-compat.h",
+        "src/util/win32/path_w32.c",
+        "src/util/win32/path_w32.h",
+        "src/util/win32/posix.h",
+        "src/util/win32/posix_w32.c",
+        "src/util/win32/precompiled.c",
+        "src/util/win32/precompiled.h",
+        "src/util/win32/reparse.h",
+        "src/util/win32/thread.c",
+        "src/util/win32/thread.h",
+        "src/util/win32/utf-conv.c",
+        "src/util/win32/utf-conv.h",
+        "src/util/win32/version.h",
+        "src/util/win32/w32_buffer.c",
+        "src/util/win32/w32_buffer.h",
+        "src/util/win32/w32_common.h",
+        "src/util/win32/w32_leakcheck.c",
+        "src/util/win32/w32_leakcheck.h",
+        "src/util/win32/w32_util.c",
+        "src/util/win32/w32_util.h",
+        "src/util/win32/win32-compat.h",
+        "src/util/utf8.c",
+        "src/util/util.c",
+        "src/util/varint.c",
+        "src/util/vector.c",
+        "src/util/wildmatch.c",
+        "src/util/zstream.c",
+    ],
+)
+
+jj.cxx_library(
+    name = "libgit2",
+    srcs = [
+        ":src[deps/llhttp/api.c]",
+        ":src[deps/llhttp/http.c]",
+        ":src[deps/llhttp/llhttp.c]",
+        ":src[deps/pcre/pcre_byte_order.c]",
+        ":src[deps/pcre/pcre_chartables.c]",
+        ":src[deps/pcre/pcre_compile.c]",
+        ":src[deps/pcre/pcre_config.c]",
+        ":src[deps/pcre/pcre_dfa_exec.c]",
+        ":src[deps/pcre/pcre_exec.c]",
+        ":src[deps/pcre/pcre_fullinfo.c]",
+        ":src[deps/pcre/pcre_get.c]",
+        ":src[deps/pcre/pcre_globals.c]",
+        ":src[deps/pcre/pcre_jit_compile.c]",
+        ":src[deps/pcre/pcre_maketables.c]",
+        ":src[deps/pcre/pcre_newline.c]",
+        ":src[deps/pcre/pcre_ord2utf8.c]",
+        ":src[deps/pcre/pcre_printint.c]",
+        ":src[deps/pcre/pcre_refcount.c]",
+        ":src[deps/pcre/pcre_string_utils.c]",
+        ":src[deps/pcre/pcre_study.c]",
+        ":src[deps/pcre/pcre_tables.c]",
+        ":src[deps/pcre/pcre_ucd.c]",
+        ":src[deps/pcre/pcre_valid_utf8.c]",
+        ":src[deps/pcre/pcre_version.c]",
+        ":src[deps/pcre/pcre_xclass.c]",
+        ":src[deps/pcre/pcreposix.c]",
+        ":src[deps/xdiff/xdiffi.c]",
+        ":src[deps/xdiff/xemit.c]",
+        ":src[deps/xdiff/xhistogram.c]",
+        ":src[deps/xdiff/xmerge.c]",
+        ":src[deps/xdiff/xpatience.c]",
+        ":src[deps/xdiff/xprepare.c]",
+        ":src[deps/xdiff/xutils.c]",
+        ":src[src/libgit2/annotated_commit.c]",
+        ":src[src/libgit2/apply.c]",
+        ":src[src/libgit2/attr.c]",
+        ":src[src/libgit2/attr_file.c]",
+        ":src[src/libgit2/attrcache.c]",
+        ":src[src/libgit2/blame.c]",
+        ":src[src/libgit2/blame_git.c]",
+        ":src[src/libgit2/blob.c]",
+        ":src[src/libgit2/branch.c]",
+        ":src[src/libgit2/buf.c]",
+        ":src[src/libgit2/cache.c]",
+        ":src[src/libgit2/checkout.c]",
+        ":src[src/libgit2/cherrypick.c]",
+        ":src[src/libgit2/clone.c]",
+        ":src[src/libgit2/commit.c]",
+        ":src[src/libgit2/commit_graph.c]",
+        ":src[src/libgit2/commit_list.c]",
+        ":src[src/libgit2/config.c]",
+        ":src[src/libgit2/config_cache.c]",
+        ":src[src/libgit2/config_list.c]",
+        ":src[src/libgit2/config_file.c]",
+        ":src[src/libgit2/config_mem.c]",
+        ":src[src/libgit2/config_parse.c]",
+        ":src[src/libgit2/config_snapshot.c]",
+        ":src[src/libgit2/crlf.c]",
+        ":src[src/libgit2/delta.c]",
+        ":src[src/libgit2/describe.c]",
+        ":src[src/libgit2/diff.c]",
+        ":src[src/libgit2/diff_driver.c]",
+        ":src[src/libgit2/diff_file.c]",
+        ":src[src/libgit2/diff_generate.c]",
+        ":src[src/libgit2/diff_parse.c]",
+        ":src[src/libgit2/diff_print.c]",
+        ":src[src/libgit2/diff_stats.c]",
+        ":src[src/libgit2/diff_tform.c]",
+        ":src[src/libgit2/diff_xdiff.c]",
+        ":src[src/libgit2/email.c]",
+        ":src[src/libgit2/fetch.c]",
+        ":src[src/libgit2/fetchhead.c]",
+        ":src[src/libgit2/filter.c]",
+        ":src[src/libgit2/grafts.c]",
+        ":src[src/libgit2/graph.c]",
+        ":src[src/libgit2/hashsig.c]",
+        ":src[src/libgit2/ident.c]",
+        ":src[src/libgit2/idxmap.c]",
+        ":src[src/libgit2/ignore.c]",
+        ":src[src/libgit2/index.c]",
+        ":src[src/libgit2/indexer.c]",
+        ":src[src/libgit2/iterator.c]",
+        ":src[src/libgit2/libgit2.c]",
+        ":src[src/libgit2/mailmap.c]",
+        ":src[src/libgit2/merge.c]",
+        ":src[src/libgit2/merge_driver.c]",
+        ":src[src/libgit2/merge_file.c]",
+        ":src[src/libgit2/message.c]",
+        ":src[src/libgit2/midx.c]",
+        ":src[src/libgit2/mwindow.c]",
+        ":src[src/libgit2/notes.c]",
+        ":src[src/libgit2/object.c]",
+        ":src[src/libgit2/object_api.c]",
+        ":src[src/libgit2/odb.c]",
+        ":src[src/libgit2/odb_loose.c]",
+        ":src[src/libgit2/odb_mempack.c]",
+        ":src[src/libgit2/odb_pack.c]",
+        ":src[src/libgit2/offmap.c]",
+        ":src[src/libgit2/oid.c]",
+        ":src[src/libgit2/oidarray.c]",
+        ":src[src/libgit2/oidmap.c]",
+        ":src[src/libgit2/pack.c]",
+        ":src[src/libgit2/pack-objects.c]",
+        ":src[src/libgit2/parse.c]",
+        ":src[src/libgit2/patch.c]",
+        ":src[src/libgit2/patch_generate.c]",
+        ":src[src/libgit2/patch_parse.c]",
+        ":src[src/libgit2/path.c]",
+        ":src[src/libgit2/pathspec.c]",
+        ":src[src/libgit2/proxy.c]",
+        ":src[src/libgit2/push.c]",
+        ":src[src/libgit2/reader.c]",
+        ":src[src/libgit2/rebase.c]",
+        ":src[src/libgit2/refdb.c]",
+        ":src[src/libgit2/refdb_fs.c]",
+        ":src[src/libgit2/reflog.c]",
+        ":src[src/libgit2/refs.c]",
+        ":src[src/libgit2/refspec.c]",
+        ":src[src/libgit2/remote.c]",
+        ":src[src/libgit2/repository.c]",
+        ":src[src/libgit2/reset.c]",
+        ":src[src/libgit2/revert.c]",
+        ":src[src/libgit2/revparse.c]",
+        ":src[src/libgit2/revwalk.c]",
+        ":src[src/libgit2/settings.c]",
+        ":src[src/libgit2/signature.c]",
+        ":src[src/libgit2/stash.c]",
+        ":src[src/libgit2/status.c]",
+        ":src[src/libgit2/strarray.c]",
+        ":src[src/libgit2/streams/mbedtls.c]",
+        ":src[src/libgit2/streams/openssl.c]",
+        ":src[src/libgit2/streams/openssl_dynamic.c]",
+        ":src[src/libgit2/streams/openssl_legacy.c]",
+        ":src[src/libgit2/streams/registry.c]",
+        ":src[src/libgit2/streams/schannel.c]",
+        ":src[src/libgit2/streams/socket.c]",
+        ":src[src/libgit2/streams/stransport.c]",
+        ":src[src/libgit2/streams/tls.c]",
+        ":src[src/libgit2/submodule.c]",
+        ":src[src/libgit2/sysdir.c]",
+        ":src[src/libgit2/tag.c]",
+        ":src[src/libgit2/trace.c]",
+        ":src[src/libgit2/trailer.c]",
+        ":src[src/libgit2/transaction.c]",
+        ":src[src/libgit2/transport.c]",
+        ":src[src/libgit2/transports/auth.c]",
+        ":src[src/libgit2/transports/auth_gssapi.c]",
+        ":src[src/libgit2/transports/auth_ntlmclient.c]",
+        ":src[src/libgit2/transports/auth_sspi.c]",
+        ":src[src/libgit2/transports/credential.c]",
+        ":src[src/libgit2/transports/credential_helpers.c]",
+        ":src[src/libgit2/transports/git.c]",
+        ":src[src/libgit2/transports/http.c]",
+        ":src[src/libgit2/transports/httpclient.c]",
+        ":src[src/libgit2/transports/httpparser.c]",
+        ":src[src/libgit2/transports/local.c]",
+        ":src[src/libgit2/transports/smart.c]",
+        ":src[src/libgit2/transports/smart_pkt.c]",
+        ":src[src/libgit2/transports/smart_protocol.c]",
+        ":src[src/libgit2/transports/ssh.c]",
+        ":src[src/libgit2/transports/ssh_libssh2.c]",
+        ":src[src/libgit2/transports/winhttp.c]",
+        ":src[src/libgit2/tree.c]",
+        ":src[src/libgit2/tree-cache.c]",
+        ":src[src/libgit2/worktree.c]",
+        ":src[src/util/alloc.c]",
+        ":src[src/util/allocators/failalloc.c]",
+        ":src[src/util/allocators/stdalloc.c]",
+        ":src[src/util/date.c]",
+        ":src[src/util/errors.c]",
+        ":src[src/util/filebuf.c]",
+        ":src[src/util/fs_path.c]",
+        ":src[src/util/futils.c]",
+        ":src[src/util/hash.c]",
+        ":src[src/util/hash/collisiondetect.c]",
+        ":src[src/util/hash/openssl.c]",
+        ":src[src/util/hash/sha1dc/sha1.c]",
+        ":src[src/util/hash/sha1dc/ubc_check.c]",
+        ":src[src/util/net.c]",
+        ":src[src/util/pool.c]",
+        ":src[src/util/posix.c]",
+        ":src[src/util/pqueue.c]",
+        ":src[src/util/rand.c]",
+        ":src[src/util/regexp.c]",
+        ":src[src/util/runtime.c]",
+        ":src[src/util/sortedcache.c]",
+        ":src[src/util/str.c]",
+        ":src[src/util/strmap.c]",
+        ":src[src/util/thread.c]",
+        ":src[src/util/tsort.c]",
+        ":src[src/util/utf8.c]",
+        ":src[src/util/util.c]",
+        ":src[src/util/varint.c]",
+        ":src[src/util/vector.c]",
+        ":src[src/util/wildmatch.c]",
+        ":src[src/util/zstream.c]",
+    ] + select({
+        'config//os:windows': [
+            ":src[src/util/win32/dir.c]",
+            ":src[src/util/win32/error.c]",
+            ":src[src/util/win32/map.c]",
+            ":src[src/util/win32/path_w32.c]",
+            ":src[src/util/win32/posix_w32.c]",
+            ":src[src/util/win32/precompiled.c]",
+            ":src[src/util/win32/thread.c]",
+            ":src[src/util/win32/utf-conv.c]",
+            ":src[src/util/win32/w32_buffer.c]",
+            ":src[src/util/win32/w32_leakcheck.c]",
+            ":src[src/util/win32/w32_util.c]",
+        ],
+        'DEFAULT': [
+            ":src[src/util/unix/map.c]",
+            ":src[src/util/unix/realpath.c]",
+        ],
+    }),
+    headers = ["include/git2_features.h"],
+    include_directories = ["include"],
+    compiler_flags = select({
+        'config//os:windows': [],
+        'DEFAULT': ["-fvisibility=hidden"],
+    }),
+    preferred_linkage = "static",
+    preprocessor_flags = [
+        "-I$(location :src)/include",
+        "-I$(location :src)/src/libgit2",
+        "-I$(location :src)/src/util",
+        "-I$(location :src)/deps/llhttp",
+        "-I$(location :src)/deps/xdiff",
+        "-I$(location :src)/deps/pcre",
+        "-DGIT_OPENSSL=1",
+        "-DGIT_SHA256_OPENSSL=1",
+        "-DGIT_SHA1_COLLISIONDETECT=1",
+        "-DGIT_HTTPS=1",
+        "-DGIT_REGEX_BUILTIN=1",
+        "-DHAVE_STDINT_H=1",
+        "-DHAVE_MEMMOVE=1",
+        "-DNO_RECURSE=1",
+        "-DNEWLINE=10",
+        "-DPOSIX_MALLOC_THRESHOLD=10",
+        "-DLINK_SIZE=2",
+        "-DPARENS_NEST_LIMIT=250",
+        "-DMATCH_LIMIT=10000000",
+        "-DMATCH_LIMIT_RECURSION=MATCH_LIMIT",
+        "-DMAX_NAME_SIZE=32",
+        "-DMAX_NAME_COUNT=10000",
+        "-DSHA1DC_NO_STANDARD_INCLUDES=1",
+        "-DSHA1DC_CUSTOM_INCLUDE_SHA1_C=\"common.h\"",
+        "-DSHA1DC_CUSTOM_INCLUDE_UBC_CHECK_C=\"common.h\"",
+    ] + select({
+        'config//os:windows': [
+            "-DSTRSAFE_NO_DEPRECATE",
+            "-DWIN32",
+            "-DWIN32_LEAN_AND_MEAN",
+            "-DNOMINMAX",
+            "-DGIT_IO_WSAPOLL=1",
+            "-DGIT_WINHTTP=1",
+            "-DGIT_USE_STAT_MTIM=1",
+        ],
+        'config//os:macos': [
+            "-DGIT_IO_POLL=1",
+            "-DGIT_IO_SELECT=1",
+            "-DGIT_SECURE_TRANSPORT=1",
+            "-DGIT_USE_STAT_MTIMESPEC=1",
+        ],
+        'DEFAULT': [
+            "-DGIT_IO_POLL=1",
+            "-DGIT_IO_SELECT=1",
+            "-DGIT_USE_STAT_MTIM=1",
+        ],
+    }),
+    deps = [
+        "third-party//bssl:crypto",
+        "third-party//bssl:ssl",
+        "third-party//libz:libz",
+        "third-party//libssh2:libssh2",
+    ],
+)

buck/third-party/libgit2/PACKAGE

@@ -0,0 +1,5 @@
+
+package(
+    inherit = True,
+    visibility = [ 'PUBLIC' ],
+)

buck/third-party/libgit2/include/git2_features.h

@@ -0,0 +1,14 @@
+#ifndef INCLUDE_features_h
+#define INCLUDE_features_h
+
+#define GIT_THREADS 1
+#define GIT_TRACE 1
+#define GIT_HTTPPARSER_BUILTIN 1
+
+#define GIT_ARCH_64 1 // XXX FIXME (aseipp)
+
+#define GIT_SSH 1
+#define GIT_SSH_LIBSSH2 1
+#define GIT_SSH_MEMORY_CREDENTIALS 1
+
+#endif // INCLUDE_features_h

buck/third-party/libssh2/BUILD

@@ -0,0 +1,122 @@
+
+load("@root//buck/shims/jj.bzl", "jj")
+
+VERSION = 'ef292424bb5d136f888a2d2e92460de12c143ab4'
+
+http_archive(
+    name = 'src',
+    sha256 = 'de10623f0ab08ca0ccedc95d50f5e827b5f4680935024e6c5ebd7b2ef2129e5f',
+    urls = [
+        f'https://github.com/libssh2/libssh2/archive/{VERSION}.tar.gz',
+    ],
+    type = 'tar.gz',
+    strip_prefix = f'libssh2-{VERSION}',
+    sub_targets = [
+        "include/libssh2.h",
+        "src/agent.c",
+        "src/bcrypt_pbkdf.c",
+        "src/blowfish.c",
+        "src/channel.c",
+        "src/comp.c",
+        "src/crypt.c",
+        "src/global.c",
+        "src/hostkey.c",
+        "src/keepalive.c",
+        "src/kex.c",
+        "src/knownhost.c",
+        "src/mac.c",
+        "src/misc.c",
+        "src/openssl.c",
+        "src/packet.c",
+        "src/pem.c",
+        "src/publickey.c",
+        "src/scp.c",
+        "src/session.c",
+        "src/sftp.c",
+        "src/transport.c",
+        "src/userauth.c",
+        "src/userauth_kbd_packet.c",
+        "src/agent_win.c",
+    ],
+)
+
+jj.cxx_library(
+    name = 'libssh2',
+    srcs = [
+        ":src[src/agent.c]",
+        ":src[src/bcrypt_pbkdf.c]",
+        ":src[src/blowfish.c]",
+        ":src[src/channel.c]",
+        ":src[src/comp.c]",
+        ":src[src/crypt.c]",
+        ":src[src/global.c]",
+        ":src[src/hostkey.c]",
+        ":src[src/keepalive.c]",
+        ":src[src/kex.c]",
+        ":src[src/knownhost.c]",
+        ":src[src/mac.c]",
+        ":src[src/misc.c]",
+        ":src[src/openssl.c]",
+        ":src[src/packet.c]",
+        ":src[src/pem.c]",
+        ":src[src/publickey.c]",
+        ":src[src/scp.c]",
+        ":src[src/session.c]",
+        ":src[src/sftp.c]",
+        ":src[src/transport.c]",
+        ":src[src/userauth.c]",
+        ":src[src/userauth_kbd_packet.c]",
+    ] + select({
+        'config//os:windows': [
+            ':src[src/agent_win.c]',
+        ],
+        'DEFAULT': [],
+    }),
+    headers = ["include/libssh2_config.h"],
+    header_namespace = "",
+    exported_headers = {
+        'libssh2.h': ':src[include/libssh2.h]',
+    },
+    include_directories = ["include"],
+    compiler_flags = select({
+        'config//os:windows': [],
+        'DEFAULT': ["-fvisibility=hidden"],
+    }),
+    preferred_linkage = "static",
+    preprocessor_flags = [
+        "-I$(location :src)/src",
+        "-I$(location :src)/include",
+        "-DLIBSSH2_OPENSSL",
+        "-DHAVE_EVP_AES_128_CTR",
+        "-DLIBSSH2_DH_GEX_NEW",
+        "-DLIBSSH2_HAVE_ZLIB",
+    ] + select({
+        'config//os:windows': [
+            "-I$(location :src)/win32",
+            "-DLIBSSH2_WIN32",
+            "-DWIN32_LEAN_AND_MEAN",
+            "-DNOMINMAX",
+        ],
+        'DEFAULT': [
+            "-DHAVE_SNPRINTF",
+            "-DHAVE_UNISTD_H",
+            "-DHAVE_INTTYPES_H",
+            "-DHAVE_SYS_SELECT_H",
+            "-DHAVE_SYS_UIO",
+            "-DHAVE_SYS_SOCKET_H",
+            "-DHAVE_SYS_IOCTL_H",
+            "-DHAVE_SYS_TIME_H",
+            "-DHAVE_SYS_UN_H",
+            "-DHAVE_O_NONBLOCK",
+            "-DHAVE_LIBCRYPT32",
+            "-DHAVE_POLL",
+            "-DHAVE_GETTIMEOFDAY",
+        ],
+    }),
+
+    deps = [
+        "third-party//bssl:crypto",
+        "third-party//bssl:ssl",
+        "third-party//libz:libz",
+    ],
+)

buck/third-party/libssh2/PACKAGE

@@ -0,0 +1,5 @@
+
+package(
+    inherit = True,
+    visibility = [ 'PUBLIC' ],
+)

buck/third-party/libssh2/include/libssh2_config.h

@@ -0,0 +1,5 @@
+// NOTE (aseipp): this file is supposed to contain CMake-generated #define's in
+// the upstream build system. we don't use CMake to build, and we pass those
+// flags directly using -D, just like the libssh2-rs build.rs script does it. so
+// this file only needs to exist so that the C source files can include it as a
+// no-op

buck/third-party/libz/BUILD

@@ -0,0 +1,66 @@
+
+load("@root//buck/shims/jj.bzl", "jj")
+
+VERSION = '1.3.1'
+
+http_archive(
+    name = 'src',
+    sha256 = '9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23',
+    urls = [
+        f'https://github.com/madler/zlib/releases/download/v{VERSION}/zlib-{VERSION}.tar.gz',
+    ],
+    type = 'tar.gz',
+    strip_prefix = f'zlib-{VERSION}',
+    sub_targets = [
+        "adler32.c",
+        "compress.c",
+        "crc32.c",
+        "deflate.c",
+        "infback.c",
+        "inffast.c",
+        "inflate.c",
+        "inftrees.c",
+        "trees.c",
+        "uncompr.c",
+        "zutil.c",
+        "gzclose.c",
+        "gzlib.c",
+        "gzread.c",
+        "gzwrite.c",
+        "zlib.h",
+        "zconf.h",
+    ],
+)
+
+jj.cxx_library(
+    name = 'libz',
+    srcs = [
+        ':src[adler32.c]',
+        ':src[compress.c]',
+        ':src[crc32.c]',
+        ':src[deflate.c]',
+        ':src[infback.c]',
+        ':src[inffast.c]',
+        ':src[inflate.c]',
+        ':src[inftrees.c]',
+        ':src[trees.c]',
+        ':src[uncompr.c]',
+        ':src[zutil.c]',
+        ':src[gzclose.c]',
+        ':src[gzlib.c]',
+        ':src[gzread.c]',
+        ':src[gzwrite.c]',
+    ],
+    preferred_linkage = "static",
+    headers = [],
+    header_namespace = "",
+    exported_headers = {
+        'zconf.h': ':src[zconf.h]',
+        'zlib.h': ':src[zlib.h]',
+    },
+    compiler_flags = [
+        "-DSTDC",
+        "-D_LARGEFILE64_SOURCE",
+        "-D_POSIX_SOURCE",
+    ],
+)

buck/third-party/libz/PACKAGE

@@ -0,0 +1,5 @@
+
+package(
+    inherit = True,
+    visibility = [ 'PUBLIC' ],
+)

buck/third-party/rust/Cargo.toml

@@ -0,0 +1,96 @@
+# @generated by buck/third-party/rust/synchronize.py
+[workspace]
+
+[package]
+name = "rust-third-party"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+# Dummy target to keep Cargo happy
+[[bin]]
+name = "top"
+path = "top.rs"
+
+[dependencies]
+anyhow = "1.0.86"
+assert_cmd = "2.0.8"
+assert_matches = "1.5.0"
+async-trait = "0.1.82"
+backoff = "0.4.0"
+blake2 = "0.10.6"
+bstr = "1.10.0"
+clap = { version = "4.5.16", features = [ "derive", "deprecated", "wrap_help", "string" ] }
+clap_complete = "4.5.24"
+clap_complete_nushell = "4.5.3"
+clap-markdown = "0.1.4"
+clap_mangen = "0.2.10"
+chrono = { version = "0.4.38", default-features = false, features = [ "std", "clock" ] }
+chrono-english = { version = "0.1.7" }
+clru = "0.6.2"
+config = { version = "0.13.4", default-features = false, features = [ "toml" ] }
+criterion = "0.5.1"
+crossterm = { version = "0.27", default-features = false }
+digest = "0.10.7"
+dirs = "5.0.1"
+dunce = "1.0.5"
+either = "1.13.0"
+esl01-renderdag = "0.3.0"
+futures = "0.3.30"
+git2 = { version = "0.19.0", features = [ "vendored-libgit2" ] }
+gix = { version = "0.66.0", default-features = false, features = [ "index", "max-performance-safe", "blob-diff" ] }
+gix-filter = "0.13.0"
+glob = "0.3.1"
+hex = "0.4.3"
+ignore = "0.4.20"
+indexmap = "2.5.0"
+indoc = "2.0.4"
+insta = { version = "1.39.0", features = [ "filters" ] }
+itertools = "0.13.0"
+libc = { version = "0.2.158" }
+maplit = "1.0.2"
+minus = { version = "5.6.1", features = [ "dynamic_output", "search" ] }
+num_cpus = "1.16.0"
+once_cell = "1.19.0"
+pest = "2.7.11"
+pest_derive = "2.7.11"
+pollster = "0.3.0"
+pretty_assertions = "1.4.0"
+proc-macro2 = "1.0.86"
+prost = "0.12.6"
+prost-build = "0.12.6"
+quote = "1.0.36"
+rand = "0.8.5"
+rand_chacha = "0.3.1"
+rayon = "1.10.0"
+ref-cast = "1.0.23"
+regex = "1.10.6"
+rpassword = "7.3.1"
+scm-record = "0.3.0"
+serde = { version = "1.0", features = [ "derive" ] }
+serde_json = "1.0.127"
+slab = "0.4.9"
+smallvec = { version = "1.13.2", features = [ "const_generics", "const_new", "union" ] }
+strsim = "0.11.1"
+syn = "2.0.77"
+tempfile = "3.12.0"
+test-case = "3.3.1"
+textwrap = "0.16.1"
+thiserror = "1.0.63"
+timeago = { version = "0.4.2", default-features = false }
+tokio = { version = "1.40.0" }
+toml_edit = { version = "0.19.15", features = [ "serde" ] }
+tracing = "0.1.40"
+tracing-chrome = "0.7.2"
+tracing-subscriber = { version = "0.3.18", default-features = false, features = [ "std", "ansi", "env-filter", "fmt" ] }
+unicode-width = "0.1.13"
+version_check = "0.9.5"
+watchman_client = { version = "0.9.0" }
+whoami = "1.5.2"
+zstd = "0.12.4"
+
+[target.'cfg(unix)'.dependencies]
+rustix = { version = "0.38.35", features = [ "fs" ] }
+
+[target.'cfg(windows)'.dependencies]
+winreg = "0.52"

buck/third-party/rust/fixups/ahash/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/anyhow/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/assert_cmd/fixups.toml

@@ -0,0 +1,4 @@
+cargo_env = true
+
+[[buildscript]]
+[buildscript.gen_srcs]

buck/third-party/rust/fixups/async-trait/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/camino/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/crc32fast/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/criterion/fixups.toml

@@ -0,0 +1 @@
+cargo_env = true

buck/third-party/rust/fixups/crossbeam-epoch/fixups.toml

@@ -0,0 +1,2 @@
+buildscript = []
+cargo_env = true

buck/third-party/rust/fixups/crossbeam-utils/fixups.toml

@@ -0,0 +1,2 @@
+buildscript = []
+cargo_env = true

buck/third-party/rust/fixups/doc-comment/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/futures-channel/fixups.toml

@@ -0,0 +1,2 @@
+buildscript = []
+cargo_env = true

buck/third-party/rust/fixups/futures-core/fixups.toml

@@ -0,0 +1,2 @@
+buildscript = []
+cargo_env = true

buck/third-party/rust/fixups/futures-task/fixups.toml

@@ -0,0 +1,2 @@
+buildscript = []
+cargo_env = true

buck/third-party/rust/fixups/futures-util/fixups.toml

@@ -0,0 +1,2 @@
+buildscript = []
+cargo_env = true

buck/third-party/rust/fixups/generic-array/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/git2/fixups.toml

@@ -0,0 +1 @@
+cargo_env = true

buck/third-party/rust/fixups/gix/fixups.toml

@@ -0,0 +1 @@
+cargo_env = true

buck/third-party/rust/fixups/indexmap/fixups.toml

@@ -0,0 +1,2 @@
+buildscript = []
+cfgs = ["has_std"]

buck/third-party/rust/fixups/io-lifetimes/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/libc/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/libgit2-sys/fixups.toml

@@ -0,0 +1,2 @@
+extra_deps = ["third-party//libgit2:libgit2"]
+buildscript = []

buck/third-party/rust/fixups/libssh2-sys/fixups.toml

@@ -0,0 +1,2 @@
+extra_deps = ["third-party//libssh2:libssh2"]
+buildscript = []

buck/third-party/rust/fixups/libz-sys/fixups.toml

@@ -0,0 +1,3 @@
+features = ["stock-zlib"]
+extra_deps = ["third-party//libz:libz"]
+buildscript = []

buck/third-party/rust/fixups/lock_api/fixups.toml

@@ -0,0 +1,3 @@
+# the build script for lock_api is a version check for rust 1.61.
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/memchr/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/memoffset/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/mio/fixups.toml

@@ -0,0 +1 @@
+extra_srcs = ["src/**/*.rs"]

buck/third-party/rust/fixups/num-traits/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/openssl-sys/fixups.toml

@@ -0,0 +1,10 @@
+cfgs = ["boringssl"]
+features = ["unstable_boringssl"]
+extra_deps = [
+    "third-party//bssl:crypto",
+    "third-party//bssl:ssl",
+    "third-party//bssl/rust:bssl-sys",
+]
+omit_deps = ["bssl-sys"]
+
+buildscript = []

buck/third-party/rust/fixups/parking_lot_core/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/paste/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/prettyplease/fixups.toml

@@ -0,0 +1,2 @@
+buildscript = []
+cargo_env = true

buck/third-party/rust/fixups/proc-macro-error-attr/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/proc-macro-error/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/proc-macro-hack/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/proc-macro2-diagnostics/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/proc-macro2/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/quote/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/rayon-core/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/ref-cast/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/rustix/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/rustversion/fixups.toml

@@ -0,0 +1,4 @@
+cargo_env = true
+
+[[buildscript]]
+[buildscript.gen_srcs]

buck/third-party/rust/fixups/semver/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/serde/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/serde_derive/fixups.toml

@@ -0,0 +1,2 @@
+cargo_env = true
+buildscript = []

buck/third-party/rust/fixups/serde_json/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/signal-hook/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/slab/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/syn/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/tempfile/fixups.toml

@@ -0,0 +1,2 @@
+[[buildscript]]
+[buildscript.rustc_flags]

buck/third-party/rust/fixups/thiserror/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/tokio/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/typenum/fixups.toml

@@ -0,0 +1,4 @@
+features = ["force_unix_path_separator"]
+
+[[buildscript]]
+[buildscript.gen_srcs]

buck/third-party/rust/fixups/unicode-linebreak/fixups.toml

@@ -0,0 +1,3 @@
+
+[[buildscript]]
+[buildscript.gen_srcs]

buck/third-party/rust/fixups/winapi-x86_64-pc-windows-gnu/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/winapi/fixups.toml

@@ -0,0 +1,4 @@
+buildscript = []
+
+[[platform_fixup.'cfg(target_os = "windows")'.buildscript]]
+[platform_fixup.'cfg(target_os = "windows")'.buildscript.rustc_flags]

buck/third-party/rust/fixups/windows-targets/fixups.toml

@@ -0,0 +1,3 @@
+[platform_fixup.'cfg(any(target_os = "windows", target_os = "linux"))']
+version = ">=0.48.0"
+cfgs = ["windows_raw_dylib"]

buck/third-party/rust/fixups/windows_x86_64_gnu/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/windows_x86_64_msvc/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/winreg/fixups.toml

@@ -0,0 +1 @@
+buildscript = []

buck/third-party/rust/fixups/zerocopy/fixups.toml

@@ -0,0 +1 @@
+cargo_env = true

buck/third-party/rust/fixups/zstd-safe/fixups.toml

@@ -0,0 +1 @@
+buildscript = []