MODULE.bazel

# Bazel modules for the IC build.

module(
    name = "ic",
)

ext = use_extension("@rules_buf//buf:extensions.bzl", "buf")
use_repo(ext, "rules_buf_toolchains")

register_toolchains("@rules_buf_toolchains//:all")

# General Bazel helpers
bazel_dep(name = "bazel_skylib", version = "1.9.0")
bazel_dep(name = "aspect_bazel_lib", version = "2.19.3")
bazel_dep(name = "rules_shell", version = "0.6.1")

bazel_dep(name = "buildifier_prebuilt", version = "8.2.0.2", dev_dependency = True)

# CC dependencies (for C libs like miracl-core, etc)
bazel_dep(name = "rules_cc", version = "0.2.22")
bazel_dep(name = "platforms", version = "1.1.0")

# Hermetic clang/lld-based CC toolchain
# (https://github.com/hermeticbuild/hermetic-llvm)
bazel_dep(name = "llvm", version = "0.8.16")

# Keep clang from warning that the toolchain's own --unwindlib=none is unused
# on rustc links (surfaced by rustc's linker_messages lint); see the patch
# header for details.
single_version_override(
    module_name = "llvm",
    patch_strip = 1,
    patches = ["//bazel:hermetic_llvm_unwindlib.patch"],
)

# configure/make dependencies
bazel_dep(name = "rules_foreign_cc", version = "0.15.2")

register_toolchains(
    "@rules_foreign_cc//toolchains:preinstalled_pkgconfig_toolchain",
    "@rules_foreign_cc//toolchains:preinstalled_make_toolchain",
)

# Use a patch to work around determinism issues in make & pkgconfig toolchains
# https://github.com/bazel-contrib/rules_foreign_cc/issues/1313
# Also we use HEAD to have the latest version of the dependencies (Meson in
# particular, which needs a recent rules_foreign_cc to work with hermetic
# toolchains)
archive_override(
    module_name = "rules_foreign_cc",
    patch_strip = 1,
    patches = ["//bazel:rules_foreign_cc.patch"],
    sha256 = "7f05eb9cc4b1c600c643e69221c88203244ccadc75ae28c4ade960f0f0742f26",
    strip_prefix = "rules_foreign_cc-f68b351c4691e747f889dc5e4c2cac3cd3b66ea2",
    type = "tar.gz",
    urls = ["https://codeload.github.com/bazel-contrib/rules_foreign_cc/tar.gz/f68b351c4691e747f889dc5e4c2cac3cd3b66ea2"],
)

# Misc tools

bazel_dep(name = "pigz", version = "2.8.bcr.1")  # (parallel) gzip
bazel_dep(name = "zstd", version = "1.5.7.bcr.1")  # zstd can change format across versions

# QEMU, for the local system test backend. We only use the prebuilt (hermetic)
# qemu binaries; calling qemu is handled by the system test driver.
bazel_dep(name = "rules_qemu", version = "0.3.0")

qemu = use_extension("@rules_qemu//qemu/extension:qemu.bzl", "qemu")
use_repo(
    qemu,
    "qemu_img_prebuilt_linux_amd64",
    "qemu_system_bin_prebuilt_linux_amd64_x86_64_softmmu",
    "qemu_system_data_prebuilt_linux_amd64",
)

# Rust

include("//bazel:rust.MODULE.bazel")

# Python dependencies

bazel_dep(name = "rules_python", version = "2.4.6")

python_version = "3.12"

python = use_extension("@rules_python//python/extensions:python.bzl", "python")
python.toolchain(python_version = python_version)

pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
    hub_name = "python_deps",
    python_version = python_version,
    requirements_lock = "//:requirements.txt",
)
use_repo(pip, "python_deps")

# Don't generate empty __init__.py files in the runfiles of this module's py_binary and py_test targets.
# rules_python deprecated that and warns about every target that relies on it
# (https://github.com/bazel-contrib/rules_python/issues/2945). Directories without an __init__.py
# import as namespace packages instead (PEP 420). This only covers the targets of this module:
# --incompatible_default_to_explicit_init_py in bazel/conf/.bazelrc.build covers those of other modules.
rules_python_config = use_extension("@rules_python//python/extensions:config.bzl", "config")
rules_python_config.explicit_init_py(default = True)

# Protobuf dependencies
# toolchains_protoc must be declared before protobuf so its toolchain registration wins
bazel_dep(name = "toolchains_protoc", version = "0.6.1")

# Pin protoc to the prebuilt binary toolchains_protoc provides (v33.0, its
# latest) and pin the `protobuf` module to the matching 33.0 below. protobuf 33+
# enforces (via ProtocAuthenticityCheck) that protoc and the protobuf module
# share the same version, so they are kept in lockstep.
# https://registry.bazel.build/modules/toolchains_protoc
protoc = use_extension("@toolchains_protoc//protoc:extensions.bzl", "protoc")
protoc.toolchain(version = "v33.0")
use_repo(
    protoc,
    "toolchains_protoc_hub",
    "toolchains_protoc_hub.linux_aarch_64",
    "toolchains_protoc_hub.linux_x86_64",
    "toolchains_protoc_hub.osx_aarch_64",
    "toolchains_protoc_hub.osx_x86_64",
)

register_toolchains("@toolchains_protoc_hub//:all")

bazel_dep(
    name = "protobuf",
    version = "33.0",
)

# Bazel 9's builtin modules (rules_cc/rules_go/rules_python/...) pull in
# protobuf 33.4, but toolchains_protoc only ships a prebuilt protoc up to v33.0.
# Pin protobuf to 33.0 so it matches the prebuilt protoc and satisfies
# protobuf's ProtocAuthenticityCheck (33.0 and 33.4 are the same release line).
single_version_override(
    module_name = "protobuf",
    version = "33.0",
)

# protobuf linter
bazel_dep(name = "rules_buf", version = "0.5.2")

# Go dependencies

# 0.62.0 matches what the resolved dependency graph selects (pulled in via
# the llvm module); keep the declaration in line with the resolution.
bazel_dep(name = "rules_go", version = "0.62.0")
bazel_dep(name = "gazelle", version = "0.51.3")

go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
go_deps.from_file(go_mod = "//:go.mod")

# All direct go deps
go_deps.module(
    path = "github.com/fatih/color",
    sum = "h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w=",
    version = "v1.13.0",
)
go_deps.module(
    path = "github.com/spf13/cobra",
    sum = "h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=",
    version = "v1.6.1",
)
use_repo(
    go_deps,
    "com_github_fatih_color",
    "com_github_google_go_cmp",
    "com_github_schollz_closestmatch",
    "com_github_spf13_cobra",
    "com_github_stretchr_testify",
)

# Docker/OCI & archive rules with image definitions
# Mirror image to GHCR if image is in DockerHub:
#   1st PR: add it to the list .github/workflows/container-mirror-images.json
#   2nd PR: add it below

bazel_dep(name = "rules_pkg", version = "1.0.1")
bazel_dep(name = "rules_oci", version = "2.0.0")

oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")

# file server used in tests
oci.pull(
    name = "static-file-server",
    image = "ghcr.io/dfinity/halverneus/static-file-server@sha256:9e46688910b1cf9328c3b55784f08a63c53e70a276ccaf76bfdaaf2fbd0019fa",
    platforms = [
        "linux/amd64",
    ],
)
use_repo(oci, "static-file-server", "static-file-server_linux_amd64")

# bitcoin container used in test
oci.pull(
    name = "bitcoind",
    image = "ghcr.io/dfinity/kylemanna/bitcoind@sha256:17c7dd21690f3be34630db7389d2f0bff14649e27a964afef03806a6d631e0f1",
    platforms = [
        "linux/amd64",
    ],
)
use_repo(oci, "bitcoind", "bitcoind_linux_amd64")

# dogecoin container used in test
oci.pull(
    name = "dogecoind",
    image = "ghcr.io/dfinity/fiftysix/dogecoin-core@sha256:13c8b150b759eed9e11ebaf0edfdf998022bfd622164c8768d7057b43e4e156c",
    platforms = [
        "linux/amd64",
    ],
)
use_repo(oci, "dogecoind", "dogecoind_linux_amd64")

# IC HTTP Gateway container used in tests
oci.pull(
    name = "ic_gatewayd",
    image = "ghcr.io/dfinity/ic-gateway@sha256:ae2de90b6224fcbe1fdfcadd033159b3a6a2c2f4e9174311d6fc18a0dd06e024",
    platforms = [
        "linux/amd64",
    ],
)
use_repo(oci, "ic_gatewayd", "ic_gatewayd_linux_amd64")

# foundry container used in test
oci.pull(
    name = "foundry",
    image = "ghcr.io/foundry-rs/foundry@sha256:8347b728d5d393dac1c018691b36f506d23b9dcd78341d40ea0fcb11c3a19cdd",  # v1.7.1 https://github.com/foundry-rs/foundry/pkgs/container/foundry?tag=v1.7.1
    platforms = [
        "linux/amd64",
    ],
)
use_repo(oci, "foundry", "foundry_linux_amd64")

# nginx-proxy container used in test
oci.pull(
    name = "nginx-proxy",
    image = "ghcr.io/dfinity/nginxproxy/nginx-proxy@sha256:c9ba1ba8a93223305a8bce2ae09024060797698121cd01a48e5cd7462b22faa1",
    platforms = [
        "linux/amd64",
    ],
)
use_repo(oci, "nginx-proxy", "nginx-proxy_linux_amd64")

# Used by tests
oci.pull(
    name = "jaeger",
    image = "ghcr.io/dfinity/jaegertracing/all-in-one@sha256:836e9b69c88afbedf7683ea7162e179de63b1f981662e83f5ebb68badadc710f",
    platforms = [
        "linux/amd64",
    ],
)
use_repo(oci, "jaeger", "jaeger_linux_amd64")

oci.pull(
    name = "vector-with-log-fetcher",
    image = "ghcr.io/dfinity/dre/log-fetcher@sha256:61696bcce605f4ef7b86f606077b47675191ed099f7559b7746281d3bb2a3fba",
    platforms = [
        "linux/amd64",
    ],
)
use_repo(oci, "vector-with-log-fetcher", "vector-with-log-fetcher_linux_amd64")

# Used by tests
oci.pull(
    name = "minica",
    image = "ghcr.io/dfinity/ryantk/minica@sha256:c67e2c1885d438b5927176295d41aaab8a72dd9e1272ba85054bfc78191d05b0",
    platforms = ["linux/amd64"],
)
use_repo(oci, "minica", "minica_linux_amd64")

# used by rosetta image
oci.pull(
    name = "rust_base",
    image = "gcr.io/distroless/cc-debian12@sha256:3310655aac0d85eb9d579792387af1ff3eb7a1667823478be58020ab0e0d97a8",
    platforms = ["linux/amd64"],
)
use_repo(oci, "rust_base", "rust_base_linux_amd64")

# used in various places as base
oci.pull(
    name = "ubuntu_base",
    image = "ghcr.io/dfinity/ubuntu@sha256:6015f66923d7afbc53558d7ccffd325d43b4e249f41a6e93eef074c9505d2233",
    platforms = ["linux/amd64"],
)
use_repo(oci, "ubuntu_base", "ubuntu_base_linux_amd64")

# used by boundary node tests
oci.pull(
    name = "coredns",
    image = "ghcr.io/dfinity/coredns/coredns@sha256:be7652ce0b43b1339f3d14d9b14af9f588578011092c1f7893bd55432d83a378",
    platforms = ["linux/amd64"],
)
use_repo(oci, "coredns", "coredns_linux_amd64")

# used by custom domains tests
oci.pull(
    name = "pebble",
    image = "ghcr.io/dfinity/letsencrypt/pebble@sha256:68cf1ec8a8db96f64244d5f559c448bc8e54f2934e0dd53a414eabffda7a6f22",
    platforms = ["linux/amd64"],
)
use_repo(oci, "pebble", "pebble_linux_amd64")

oci.pull(
    name = "python3",
    image = "ghcr.io/dfinity/library/python@sha256:0a56f24afa1fc7f518aa690cb8c7be661225e40b157d9bb8c6ef402164d9faa7",
    platforms = ["linux/amd64"],
)
use_repo(oci, "python3", "python3_linux_amd64")

oci.pull(
    name = "alpine_openssl",
    image = "ghcr.io/dfinity/alpine/openssl@sha256:cf89651f07a33d2faf4499f72e6f8b0ee2542cd40735d51c7e75b8965c17af0e",
    platforms = ["linux/amd64"],
)
use_repo(oci, "alpine_openssl", "alpine_openssl_linux_amd64")

# Ubuntu snapshots

bazel_dep(name = "rules_distroless", version = "0.8.0")

apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")

# Packageset based on an Ubuntu resolute snapshot, see manifest file
# for details
# To update, comment out the `lock` field below and run:
#   bazel run @resolute//:lock
apt.install(
    name = "resolute",
    lock = "//bazel:resolute.lock.json",
    manifest = "//bazel:resolute.yaml",
)
use_repo(apt, "resolute")

# Single files & archives that are not bazel modules

http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")

http_jar = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_jar")

# OVMF (UEFI) firmware for the local system-test backend's QEMU VMs. At the
# moment there are no official prebuilt firmwares so we extract one from a
# `.deb`. We download the `.deb` instead of going through the
# `rules_distroless` snapshot to avoid bloating the lockfile with (unused)
# dependencies from the ovmf package.
# https://github.com/tianocore/tianocore.github.io/issues/101
http_file(
    name = "ovmf_deb",
    downloaded_file_path = "ovmf-generic-hwe.deb",
    sha256 = "619680e1be05bf501ef723b40665c494de96e41804dc37f3ea5f9558a717e099",
    url = "https://snapshot.ubuntu.com/ubuntu/20260422T000000Z/pool/main/e/edk2-hwe/ovmf-generic-hwe_2025.11-3ubuntu8_all.deb",
)

# OVMF (UEFI) firmware for AMD SEV-SNP confidential VMs, extracted from the
# `ovmf-amdsev` `.deb` (see https://packages.debian.org/sid/ovmf-amdsev). Same
# rationale as `ovmf_deb` above: no official prebuilt firmware, so we pull it
# from a `.deb` snapshot instead of `rules_distroless` to avoid bloating the
# lockfile.
http_file(
    name = "ovmf_amdsev_deb",
    downloaded_file_path = "ovmf-amdsev.deb",
    sha256 = "4655196c4e3131c77f172a17d422beba350f09e8385f2e55e3abda83276781fe",
    url = "https://snapshot.debian.org/archive/debian/20260403T143651Z/pool/main/e/edk2/ovmf-amdsev_2025.11-5_all.deb",
)

# ntpd-rs, the NTS time server the local system-test backend serves its VMs'
# clocks from (see `rs/tests/driver/src/driver/local_backend.rs`). Its releases
# ship no plain binary archive, so we extract the daemon from the `.deb`, like
# OVMF above.
http_file(
    name = "ntpd_rs_deb",
    downloaded_file_path = "ntpd-rs.deb",
    sha256 = "bfb1cb83bdc3705ef6a945ed81b00d8da2443057e57dfb8e7f4b61f695317a4d",
    url = "https://github.com/pendulum-project/ntpd-rs/releases/download/v1.9.0/ntpd-rs_1.9.0-1_amd64.deb",
)

# TLA+ tools
bazel_dep(name = "rules_java", version = "9.3.0")

http_jar(
    name = "tlaplus_community_modules",
    sha256 = "109e0828d192c33703d5cbc50b5b6e128acd816565616e27b3855949c7baba9c",
    url = "https://github.com/tlaplus/CommunityModules/releases/download/202302091937/CommunityModules-202302091937.jar",
)

http_jar(
    name = "tlaplus_community_modules_deps",
    sha256 = "762c4bdc25a0cb67043411c7f4f062cc2c038631c9c569539df880e0e78d5cf4",
    url = "https://github.com/tlaplus/CommunityModules/releases/download/202302091937/CommunityModules-deps-202302091937.jar",
)

# Apalache model checker for TLA+
http_archive(
    name = "tla_apalache",
    build_file = "@//third_party:BUILD.tla_apalache.bazel",
    sha256 = "e0ebea7e45c8f99df8d92f2755101dda84ab71df06d1ec3a21955d3b53a886e2",
    strip_prefix = "apalache-0.52.2",
    url = "https://github.com/apalache-mc/apalache/releases/download/v0.52.2/apalache-0.52.2.tgz",
)

# Official WebAssembly test suite.
# To be used for testing libraries that handle canister Wasm code.
http_archive(
    name = "wasm_spec_testsuite",
    build_file = "@//third_party:BUILD.wasmtestsuite.bazel",
    sha256 = "9afc0e7c250b5f0dcf32e9a95860b99a392ab78a653fcf3705778e8a9357f3c4",
    strip_prefix = "testsuite-4f77306bb63151631d84f58dedf67958eb9911b9",
    type = "tar.gz",
    url = "https://codeload.github.com/WebAssembly/testsuite/tar.gz/4f77306bb63151631d84f58dedf67958eb9911b9",
)

# Asset canister

http_file(
    name = "asset_canister",
    downloaded_file_path = "assetstorage.wasm.gz",
    sha256 = "1286960c50eb7a773cfb5fdd77cc238588f39e21f189cc3eb0f35199a99b9c7e",
    url = "https://github.com/dfinity/sdk/raw/0.14.2/src/distributed/assetstorage.wasm.gz",
)

# Asset canister that certifies long assets chunk-wise

http_file(
    name = "long_asset_canister",
    downloaded_file_path = "http_gateway_canister_custom_assets.wasm.gz",
    sha256 = "eedcbf986c67fd4ebe3042094604a9a5703e825e56433e2509a6a4d0384ccf95",
    url = "https://raw.githubusercontent.com/dfinity/ic-http-gateway-protocol/07bc0f3e6e95a8011de9d1712211cbafdf2e5bfe/examples/http-gateway/canister/http_gateway_canister_custom_assets.wasm.gz",
)

# Bitcoin canister

http_file(
    name = "btc_canister",
    downloaded_file_path = "ic-btc-canister.wasm.gz",
    sha256 = "a0dfef8f5c52e628ce3a197277f0d5fc427f3b34f6f4deb771572855616c9749",
    url = "https://github.com/dfinity/bitcoin-canister/releases/download/release/2026-03-06/ic-btc-canister.wasm.gz",
)

# Dogecoin canister

http_file(
    name = "doge_canister",
    downloaded_file_path = "ic-doge-canister.wasm.gz",
    sha256 = "1fe3ce73e9422a0a3e0444ea7b5a615d2b36c4b940d3cbcfe9e3d5c6cdc32494",
    url = "https://github.com/dfinity/dogecoin-canister/releases/download/release/2026-03-12/ic-doge-canister.wasm.gz",
)

# solc compilers used by //rs/tests/cross_chain:ic_xc_cketh_test to compile the
# ckETH/ckERC20 helper smart contracts offline. Vendoring these avoids `forge`
# downloading solc from https://binaries.soliditylang.org at test runtime, which
# made the test flaky in data centers with unreliable IPv4 connectivity.
# The sha256 hashes are taken from https://binaries.soliditylang.org/linux-amd64/list.json.
#
# `solc` is used to compile most contracts. `EthDepositHelper.sol` pins an older
# Solidity version to stay faithful to its immutable mainnet deployment, so it
# gets its own `solc_eth_deposit_helper`.
http_file(
    name = "solc",
    downloaded_file_path = "solc",
    executable = True,
    sha256 = "0479d44fdf9c501c25337fdc540419f1593b884a87b47f023da4f1c700fda782",
    url = "https://binaries.soliditylang.org/linux-amd64/solc-linux-amd64-v0.8.20+commit.a1b79de6",
)

http_file(
    name = "solc_eth_deposit_helper",
    downloaded_file_path = "solc_eth_deposit_helper",
    executable = True,
    sha256 = "95e6ed4949a63ad89afb443ecba1fb8302dd2860ee5e9baace3e674a0f48aa77",
    url = "https://binaries.soliditylang.org/linux-amd64/solc-linux-amd64-v0.8.18+commit.87f61d96",
)

# Latest stable solc, used by //rs/ethereum/cketh/minter:deposit_from_cex_demo_test
# to compile the demo contracts (pinned exactly for reproducible bytecode/gas).
# One binary per host platform; the consuming target selects the right one.
# The macosx-amd64 download is a universal (x86_64 + arm64) Mach-O, so it runs
# natively on both Intel and Apple Silicon Macs.
http_file(
    name = "solc_0_8_35_linux_amd64",
    downloaded_file_path = "solc",
    executable = True,
    sha256 = "fa8ac9a32d301ad023a36ee5a29f8e291fe3200c60244e43c142539e82a617f4",
    url = "https://binaries.soliditylang.org/linux-amd64/solc-linux-amd64-v0.8.35+commit.47b9dedd",
)

http_file(
    name = "solc_0_8_35_linux_arm64",
    downloaded_file_path = "solc",
    executable = True,
    sha256 = "4218d2936d2b582bc5751dac548f97b36a8652b21ded52b60a1c1259143ee0e4",
    url = "https://binaries.soliditylang.org/linux-arm64/solc-linux-arm64-v0.8.35+commit.47b9dedd",
)

http_file(
    name = "solc_0_8_35_macosx_amd64",
    downloaded_file_path = "solc",
    executable = True,
    sha256 = "6e432580d973cae74c869ef4f737529e73fec5b200dce3c08d5e76c4a6b19159",
    url = "https://binaries.soliditylang.org/macosx-amd64/solc-macosx-amd64-v0.8.35+commit.47b9dedd",
)

# foundry release binaries (anvil/cast/forge/chisel) used to run a local
# EIP-7702-capable Ethereum node hermetically from a rust_test, without docker.
# This release (>= v1.0) supports EIP-7702, unlike the v0.3.0 `@foundry` oci
# image used by //rs/tests/cross_chain:ic_xc_cketh_test. One archive per host
# platform; the consuming target selects the right one (see
# //rs/ethereum/cketh/deposit_from_cex_demo:BUILD.bazel).
FOUNDRY_BUILD_FILE = 'exports_files(["anvil", "cast", "forge", "chisel"])'

http_archive(
    name = "foundry_bin_linux_amd64",
    build_file_content = FOUNDRY_BUILD_FILE,
    sha256 = "cf7e688ed0c4c48adffca788b496076e31060b67ac5afe1e43dbb5499c20c88b",
    url = "https://github.com/foundry-rs/foundry/releases/download/v1.7.1/foundry_v1.7.1_linux_amd64.tar.gz",
)

http_archive(
    name = "foundry_bin_linux_arm64",
    build_file_content = FOUNDRY_BUILD_FILE,
    sha256 = "c8fe8fa09ae3aba2c81b510c6f9da3a9d468029b9580e690b245b3f0aea687ae",
    url = "https://github.com/foundry-rs/foundry/releases/download/v1.7.1/foundry_v1.7.1_linux_arm64.tar.gz",
)

http_archive(
    name = "foundry_bin_darwin_amd64",
    build_file_content = FOUNDRY_BUILD_FILE,
    sha256 = "c7fd1f5c9bf718d30b5cb6fc94eac605039de2aa50afc4c545a4dddc1e411acb",
    url = "https://github.com/foundry-rs/foundry/releases/download/v1.7.1/foundry_v1.7.1_darwin_amd64.tar.gz",
)

http_archive(
    name = "foundry_bin_darwin_arm64",
    build_file_content = FOUNDRY_BUILD_FILE,
    sha256 = "eacdc67718fac857cad9e19c7f6729dd80de731d09df81856391d093cfcab547",
    url = "https://github.com/foundry-rs/foundry/releases/download/v1.7.1/foundry_v1.7.1_darwin_arm64.tar.gz",
)

# Bitcoin Adapter Mainnet Data for Integration Test

# The files have been generated by syncing bitcoind client, followed
# by requesting all the desired data using a bash script, such as:
#
# declare -a headers=()
# for h in {0..800000}
# do
#     hash=$(bitcoin-cli getblockhash $h)
#     header=$(bitcoin-cli getblockheader $hash | jq '{version, prev_blockhash:.previousblockhash, merkle_root:.merkleroot, time, bits, nonce}')
#     headers+=("$header")
# done
# echo "[" $(IFS=,; echo "${headers[*]}") "]"

# Contains the first 800_000 headers of the Bitcoin mainnet blockchain.
http_file(
    name = "bitcoin_adapter_mainnet_headers",
    downloaded_file_path = "mainnet_headers_800k.json.gz",
    sha256 = "fb58cd3c0e2efe298eeb96751ae2276e938b39e2f1d9760ea47a9f3a8288d214",
    url = "https://download.dfinity.systems/testdata/mainnet_headers_800k.json.gz",
)

# Contains the first 800_000 headers of the Dogecoin mainnet blockchain with auxiliary proof-of-work.
http_file(
    name = "doge_headers_800k_mainnet_auxpow",
    downloaded_file_path = "doge_headers_800k_mainnet_auxpow.json.gz",
    sha256 = "e138d7c59d237d0eea70943b60038b8755d9aa1f04bc94f315a74775cf8bfc2d",
    url = "http://download.dfinity.systems/testdata/doge/doge_headers_800k_mainnet_auxpow.json.gz",
)

# Contains blocks 350_990 to 350_999 (inclusive) of the Bitcoin mainnet blockchain.
http_file(
    name = "bitcoin_adapter_mainnet_blocks",
    downloaded_file_path = "blocks.json.gz",
    sha256 = "4ba1e7d0b4a2fea5692bb4c79a4c9e077325312a50facef13256ba8d45bc8f2a",
    url = "https://download.dfinity.systems/testdata/blocks.json.gz",
)

# Contains the first 800_000 headers of the Bitcoin testnet blockchain.
http_file(
    name = "bitcoin_adapter_testnet_headers",
    downloaded_file_path = "testnet_headers.json.gz",
    sha256 = "c01542d816d9631a7e59210aea29c1d46ed805b0bcbfd9e067d8d53a5e5919c8",
    url = "https://download.dfinity.systems/testdata/testnet_headers.json.gz",
)

# Contains blocks 350_990 to 350_999 (inclusive) of the Bitcoin testnet blockchain.
http_file(
    name = "bitcoin_adapter_testnet_blocks",
    downloaded_file_path = "testnet_blocks.json.gz",
    sha256 = "ae57b5b58d8a1e89545c0caedeb114d0dd179e0c5fd4a44e43321b2cdbac74fb",
    url = "https://download.dfinity.systems/testdata/testnet_blocks.json.gz",
)

# Contains blocks 0 to 700_000 (inclusive) of the Dogecoin mainnet blockchain.
http_file(
    name = "dogecoin_adapter_mainnet_headers",
    downloaded_file_path = "doge_headers_mainnet_0_700000_raw.csv",
    sha256 = "42c9f72499308f847312cae8fdb5148dcaed71120041a60d336f5628dd93e1fc",
    url = "https://download.dfinity.systems/testdata/doge/doge_headers_mainnet_0_700000_raw.csv",
)

# Contains blocks 1 to 15_000 (inclusive) of the Dogecoin mainnet blockchain in parsed format.
http_file(
    name = "dogecoin_adapter_mainnet_headers_parsed",
    downloaded_file_path = "doge_headers_mainnet_1_15000_parsed.csv",
    sha256 = "a76d47758cf8251e1a524510cd2372287888784f2587cea0834b6af9582b6448",
    url = "https://download.dfinity.systems/testdata/doge/doge_headers_mainnet_1_15000_parsed.csv",
)

# Contains blocks 521_337 to 536_336 (inclusive) of the Dogecoin mainnet blockchain in parsed format.
# Contains 14_955 AuxPow headers out of 15,000 headers.
http_file(
    name = "dogecoin_adapter_mainnet_headers_auxpow_parsed",
    downloaded_file_path = "doge_headers_mainnet_521337_536336_auxpow_parsed.csv",
    sha256 = "248e36cf7962cb0d55f9e8f20d2beecee9611045713d118a6ad6ff8c98cd2070",
    url = "https://download.dfinity.systems/testdata/doge/doge_headers_mainnet_521337_536336_auxpow_parsed.csv",
)

# Contains blocks 0 to 2_000_000 (inclusive) of the Dogecoin testnet blockchain.
http_file(
    name = "dogecoin_adapter_testnet_headers",
    downloaded_file_path = "doge_headers_testnet_0_2000000_raw.csv",
    sha256 = "feefd751b10c174622f9a81bb0777eac035936a6a6f4ec3604fdcfa1201b0e42",
    url = "https://download.dfinity.systems/testdata/doge/doge_headers_testnet_0_2000000_raw.csv",
)

# Contains blocks 1 to 15_000 (inclusive) of the Dogecoin testnet blockchain in parsed format.
http_file(
    name = "dogecoin_adapter_testnet_headers_parsed",
    downloaded_file_path = "doge_headers_testnet_1_15000_parsed.csv",
    sha256 = "39d12178923b95e4f98257aaf537336e42ce1940b6b6c69277164c8c556fd15e",
    url = "https://download.dfinity.systems/testdata/doge/doge_headers_testnet_1_15000_parsed.csv",
)

# Contains blocks 293_100 to 308_099 (inclusive) of the Dogecoin testnet blockchain in parsed format.
# Contains 14_746 AuxPow headers out of 15_000 headers.
http_file(
    name = "dogecoin_adapter_testnet_headers_auxpow_parsed",
    downloaded_file_path = "doge_headers_testnet_293100_308099_auxpow_parsed.csv",
    sha256 = "2aeb78d9564153607900a8e86d2e0fae72fb9fda362c2ce475e60c5d3e43f5e2",
    url = "https://download.dfinity.systems/testdata/doge/doge_headers_testnet_293100_308099_auxpow_parsed.csv",
)

# NNS frontend dapp canister

http_file(
    name = "nns_dapp_canister",
    downloaded_file_path = "nns_dapp_canister.wasm.gz",
    sha256 = "46e5cdad3c77465e938c6ddcc5f41f0ed0b22fd0efc4c9832c3bbd5eee656b0e",
    url = "https://github.com/dfinity/nns-dapp/releases/download/nightly-2025-09-03/nns-dapp_test.wasm.gz",
)

# SNS aggregator canister

http_file(
    name = "sns_aggregator",
    downloaded_file_path = "sns_aggregator_dev.wasm.gz",
    sha256 = "ad1b1a3faa5f5db553198ee68f36361b173cf6cfdc064f7727b2c02a81020c7b",
    url = "https://github.com/dfinity/nns-dapp/releases/download/nightly-2025-09-03/sns_aggregator_dev.wasm.gz",
)

# KongSwap backend canister

http_file(
    name = "kong_backend_canister",
    downloaded_file_path = "kong_backend.wasm.gz",
    sha256 = "bed9a193158348843c8661616c65b152f57f875863f75dad3b75627ad6a2b4fc",
    # The kong repository disappeared so the old URL of
    # https://github.com/KongSwap/kong/raw/4bf8f99df53dbd34bef0e55ab6364d85bb31c71a/wasm/kong_backend.wasm.gz
    # no longer works. So we uploaded the wasm.gz to the DFINITY CDN at:
    url = "https://download.dfinity.systems/testdata/kong_backend-4bf8f99df53dbd34bef0e55ab6364d85bb31c71a.wasm.gz",
)

# SNS-KongSwap Adaptor canister (an SNS extension of the TreasuryManager kind)

http_file(
    name = "kongswap-adaptor-canister",
    downloaded_file_path = "kongswap-adaptor-canister.wasm.gz",
    sha256 = "1c07ceba560e7bcffa43d1b5ae97db81151854f068b707c1728e213948212a6c",
    url = "https://github.com/dfinity/sns-kongswap-adaptor/releases/download/v1.0.0/kongswap-adaptor-canister.wasm.gz",
)

# Cycles Ledger canister

http_file(
    name = "cycles-ledger.wasm.gz",
    downloaded_file_path = "cycles-ledger.wasm.gz",
    sha256 = "d2aacbd214f20d752fd1696c2e36d7eceaafe07b932b3ae9e7e5564d1bda0178",
    url = "https://github.com/dfinity/cycles-ledger/releases/download/cycles-ledger-v1.0.3/cycles-ledger.wasm.gz",
)

# Financial Integration artifacts for upgrade testing

# ic-icrc1-ledger releases without ICRC-3
http_file(
    name = "ic-icrc1-ledger-wo-icrc-3.wasm.gz",
    sha256 = "dc42ffd30d6616068b2dd10023ab0ff8d49b0cbce7582c4673c18caa7412dd3a",
    url = "https://download.dfinity.systems/ic/300dc603a92b5f70dae79229793c902f346af3cc/canisters/ic-icrc1-ledger.wasm.gz",
)

http_file(
    name = "ic-icrc1-ledger-wo-icrc-3-u256.wasm.gz",
    sha256 = "8730fd2aa3b9fe67468fc5e853436f618d0b16be34ff30d7e6492eac55f78d90",
    url = "https://download.dfinity.systems/ic/300dc603a92b5f70dae79229793c902f346af3cc/canisters/ic-icrc1-ledger-u256.wasm.gz",
)

# XC artifacts for testing

# ckBTC
http_file(
    name = "ckbtc_mainnet_events.gz",
    sha256 = "bbfdc95352645fbf7439c3b6d69df2698d37bbd4a3dfc36c1ef8846653176999",
    url = "https://download.dfinity.systems/testdata/ckbtc/mainnet_events_v1.gz",
)

http_file(
    name = "ckbtc_testnet_events.gz",
    sha256 = "2a0a6da625a9149e3411d519e0866c13b3a48e36d12f0d3bf42bdef2f93575b0",
    url = "https://download.dfinity.systems/testdata/ckbtc/testnet_events_v1.gz",
)

# ckDOGE
http_file(
    name = "ckdoge_mainnet_events.gz",
    sha256 = "9f2959621216371fefec3b2f6a4d6876b7d699009e64363adc514d6abff18f09",
    url = "https://download.dfinity.systems/testdata/ckdoge/mainnet_events_v1.gz",
)

# ckETH
http_file(
    name = "cketh_mainnet_events.gz",
    sha256 = "19531a137015b4c685134d7a454e981dbc8723227a947a78a274894c1ea7c867",
    url = "https://download.dfinity.systems/testdata/cketh/mainnet_events_v2.gz",
)

http_file(
    name = "cketh_sepolia_events.gz",
    sha256 = "a4e034db414ea13e03e2533bbdf0e5291d9ccc6e81748191ec5b747389e74921",
    url = "https://download.dfinity.systems/testdata/cketh/sepolia_events_v2.gz",
)

# EVM RPC canister

http_file(
    name = "evm_rpc.wasm.gz",
    sha256 = "5dbcce40bf3020cfc2d869373a8f3094785c80882fc4d52980814aa89abd541a",
    url = "https://github.com/internet-computer-protocol/evm-rpc-canister/releases/download/evm_rpc-v2.6.0/evm_rpc.wasm.gz",
)

http_archive(
    name = "bitcoin_core_linux_x86",
    build_file_content = """
package(default_visibility = ["//visibility:public"])
filegroup(
    name = "bitcoind",
    srcs = ["bin/bitcoind"],
)
""",
    sha256 = "2a6974c5486f528793c79d42694b5987401e4a43c97f62b1383abf35bcee44a8",
    strip_prefix = "bitcoin-27.0",
    urls = [
        "https://bitcoin.org/bin/bitcoin-core-27.0/bitcoin-27.0-x86_64-linux-gnu.tar.gz",
        "https://bitcoincore.org/bin/bitcoin-core-27.0/bitcoin-27.0-x86_64-linux-gnu.tar.gz",
    ],
)

http_archive(
    name = "bitcoin_core_linux_aarch64",
    build_file_content = """
package(default_visibility = ["//visibility:public"])
filegroup(
    name = "bitcoind",
    srcs = ["bin/bitcoind"],
)
""",
    sha256 = "cb35e250ae9d0328aa90e7aad0b877ed692597420a1092e8ab1a5dd756209722",
    strip_prefix = "bitcoin-27.0",
    urls = [
        "https://bitcoin.org/bin/bitcoin-core-27.0/bitcoin-27.0-aarch64-linux-gnu.tar.gz",
        "https://bitcoincore.org/bin/bitcoin-core-27.0/bitcoin-27.0-aarch64-linux-gnu.tar.gz",
    ],
)

http_archive(
    name = "bitcoin_core_darwin_x86",
    build_file_content = """
package(default_visibility = ["//visibility:public"])
filegroup(
    name = "bitcoind",
    srcs = ["bin/bitcoind"],
)
""",
    sha256 = "e1efd8c4605b2aabc876da93b6eee2bedd868ce7d1f02b0220c1001f903b3e2c",
    strip_prefix = "bitcoin-27.0",
    urls = [
        "https://bitcoin.org/bin/bitcoin-core-27.0/bitcoin-27.0-x86_64-apple-darwin.tar.gz",
        "https://bitcoincore.org/bin/bitcoin-core-27.0/bitcoin-27.0-x86_64-apple-darwin.tar.gz",
    ],
)

http_archive(
    name = "bitcoin_core_darwin_arm64",
    build_file_content = """
package(default_visibility = ["//visibility:public"])
filegroup(
    name = "bitcoind",
    srcs = ["bin/bitcoind"],
)
""",
    sha256 = "1d9d9b837297a73fc7a3b1cfed376644e3fa25c4e1672fbc143d5946cb52431d",
    strip_prefix = "bitcoin-27.0",
    urls = [
        "https://bitcoin.org/bin/bitcoin-core-27.0/bitcoin-27.0-arm64-apple-darwin.tar.gz",
        "https://bitcoincore.org/bin/bitcoin-core-27.0/bitcoin-27.0-arm64-apple-darwin.tar.gz",
    ],
)

http_archive(
    name = "dogecoin_core_linux_x86",
    build_file_content = """
package(default_visibility = ["//visibility:public"])
filegroup(
    name = "dogecoind",
    srcs = ["bin/dogecoind"],
)
""",
    sha256 = "4f227117b411a7c98622c970986e27bcfc3f547a72bef65e7d9e82989175d4f8",
    strip_prefix = "dogecoin-1.14.9",
    url = "https://github.com/dogecoin/dogecoin/releases/download/v1.14.9/dogecoin-1.14.9-x86_64-linux-gnu.tar.gz",
)

http_archive(
    name = "openssl",
    build_file = "@//third_party:BUILD.openssl.bazel",
    integrity = "sha256-4V3agv4v6BOdwqwho21MoB1TE8dfmfRsTooncJtylL8=",
    strip_prefix = "openssl-3.4.0",
    urls = ["https://github.com/openssl/openssl/releases/download/openssl-3.4.0/openssl-3.4.0.tar.gz"],
)

http_archive(
    name = "libfuzzer",
    build_file = "@//third_party:BUILD.libfuzzer.bazel",
    integrity = "sha256-CLw4JzN3fdo8liWeNzL/lsHfmNBHDE+FsWMnTq5of08=",
    strip_prefix = "llvm-project-llvmorg-20.1.0/compiler-rt/lib/fuzzer",
    type = "tar.gz",
    urls = ["https://codeload.github.com/llvm/llvm-project/tar.gz/refs/tags/llvmorg-20.1.0"],
)

http_archive(
    name = "jemalloc",
    build_file = "@//third_party:BUILD.jemalloc.bazel",
    sha256 = "ef6f74fd45e95ee4ef7f9e19ebe5b075ca6b7fbe0140612b2a161abafb7ee179",
    strip_prefix = "jemalloc-5.3.0",
    type = "tar.gz",
    urls = [
        "https://codeload.github.com/jemalloc/jemalloc/tar.gz/refs/tags/5.3.0",
    ],
)

http_archive(
    name = "libfuse",
    build_file = "@//third_party:BUILD.libfuse.bazel",
    sha256 = "f01de85717e20adf5f98aff324acd85dd73d61a5ca3834d573dcf0bd6e54a298",
    strip_prefix = "fuse-3.18.2",
    type = "tar.gz",
    urls = ["https://github.com/libfuse/libfuse/releases/download/fuse-3.18.2/fuse-3.18.2.tar.gz"],
)

http_archive(
    name = "e2fsprogs",
    build_file = "@//third_party:BUILD.e2fsprogs.bazel",
    # Drops the absolute build-time install prefix that mke2fs otherwise bakes
    # into its binary (the compiled-in mke2fs.conf path), which breaks build
    # reproducibility. See the patch for details.
    patch_strip = 1,
    patches = ["//bazel:e2fsprogs_no_external_config.patch"],
    sha256 = "9f82eaa7002673291629077b80ee005cadfcd49854907a22007fed70b0ef596e",
    strip_prefix = "e2fsprogs-1.47.4",
    type = "tar.gz",
    urls = ["https://codeload.github.com/tytso/e2fsprogs/tar.gz/refs/tags/v1.47.4"],
)

http_archive(
    name = "dosfstools",
    build_file = "@//third_party:BUILD.dosfstools.bazel",
    sha256 = "64926eebf90092dca21b14259a5301b7b98e7b1943e8a201c7d726084809b527",
    strip_prefix = "dosfstools-4.2",
    urls = ["https://github.com/dosfstools/dosfstools/releases/download/v4.2/dosfstools-4.2.tar.gz"],
)

http_archive(
    name = "mtools",
    build_file = "@//third_party:BUILD.mtools.bazel",
    sha256 = "10cd1111da87bf2400a380c1639a6cba8bfb937a24f9c51f5f88d393ae5f6f76",
    strip_prefix = "mtools-4.0.49",
    urls = [
        # mirrors.kernel.org first: ftp.gnu.org and ftpmirror.gnu.org have a
        # history of outages that broke CI (e.g. 2026-08-28).
        "https://mirrors.kernel.org/gnu/mtools/mtools-4.0.49.tar.gz",
        "https://ftpmirror.gnu.org/mtools/mtools-4.0.49.tar.gz",
        "https://ftp.gnu.org/gnu/mtools/mtools-4.0.49.tar.gz",
    ],
)

# e2fsdroid, used to populate ext4 filesystem images for IC-OS.
# We use the prebuilt binary from android platform-tools.
http_archive(
    name = "android_platform_tools",
    build_file = "@//third_party:BUILD.e2fsdroid.bazel",
    sha256 = "defcee9da1f22fe5c2324ec0edf612122f1c6ffe01a7b124191e07fcc74f8fff",
    strip_prefix = "platform-tools",
    urls = ["https://dl.google.com/android/repository/platform-tools_r33.0.2-linux.zip"],
)

http_archive(
    name = "lmdb",
    build_file = "@//third_party:BUILD.lmdb.bazel",
    sha256 = "d424c1eb841d0b78b91994b6ddef31aa6a3300727b9d9e7868033edfca0f142c",
    strip_prefix = "openldap-OPENLDAP_REL_ENG_2_5_9/libraries/liblmdb",
    urls = [
        "https://github.com/openldap/openldap/archive/refs/tags/OPENLDAP_REL_ENG_2_5_9.zip",
    ],
)

http_file(
    name = "bitcoin_example_canister",
    downloaded_file_path = "basic_bitcoin.wasm.gz",
    sha256 = "e5560c9f7ca3f06c62b0169ffdc5b568ce0eb48e600a1ab893fdeb7414117dc2",
    url = "https://github.com/dfinity/examples/releases/download/rust-basic-bitcoin-25-10-10/basic_bitcoin.wasm.gz",
)

http_file(
    name = "dogecoin_example_canister",
    downloaded_file_path = "basic_dogecoin.wasm",
    sha256 = "2eacb8de00dc2fc9bd43f7a5a8a4cd79c61c40ed3f761df84105a4a450f9e0c4",
    url = "https://github.com/dfinity/dogecoin-canister/releases/download/example/basic-dogecoin/2025-11-12/basic_dogecoin.wasm",
)

http_file(
    name = "pocket-ic-mainnet-gz",
    # Calculate this hash using:
    # git checkout $revision
    # ci/container/container-run.sh
    # bazel build //publish/binaries:pocket-ic.gz
    # sha256sum bazel-bin/publish/binaries/pocket-ic.gz
    sha256 = "1186d16d98dbed1a9dbf06194ef11e3938a5386e8bf6c45d4f1165f62c8f04e0",
    url = "https://download.dfinity.systems/ic/c0126e95b74ee154caf4c3ebd7f3c91dcdd51301/binaries/x86_64-linux/pocket-ic.gz",
)

## Rosetta CLI

http_archive(
    name = "rosetta-cli-x86_64-darwin",
    build_file = "@//third_party:BUILD.rosetta-cli.bazel",
    sha256 = "6426d69d8ce6851a00eb47c4b3bb5a5f2f792daca58a58d077ac5ade7c07f42b",
    url = "https://github.com/coinbase/mesh-cli/releases/download/v0.10.3/rosetta-cli-0.10.3-darwin-amd64.tar.gz",
)

http_archive(
    name = "rosetta-cli-aarch64-darwin",
    build_file = "@//third_party:BUILD.rosetta-cli.bazel",
    sha256 = "41eaa23bc2a34568549e7c0d99c3471fd0c20959ffb7a1e9fd2acc658f500b20",
    url = "https://github.com/coinbase/mesh-cli/releases/download/v0.10.3/rosetta-cli-0.10.3-darwin-arm64.tar.gz",
)

http_archive(
    name = "rosetta-cli-x86_64-linux",
    build_file = "@//third_party:BUILD.rosetta-cli.bazel",
    sha256 = "1ea96b427dfa69a93d2915bc57669014b58d66a9ee7d761509d50b66486d42f8",
    url = "https://github.com/coinbase/mesh-cli/releases/download/v0.10.3/rosetta-cli-0.10.3-linux-amd64.tar.gz",
)

# ruff, python linter & formatter

http_archive(
    name = "ruff-x86_64-linux",
    build_file = "@//third_party:BUILD.ruff.bazel",
    sha256 = "7edce7075bf6d43b1ef2a9383b76a43310bbf5d70fa4471330fd5aaf655192b0",
    strip_prefix = "ruff-x86_64-unknown-linux-gnu",
    url = "https://github.com/astral-sh/ruff/releases/download/0.6.8/ruff-x86_64-unknown-linux-gnu.tar.gz",
)

http_archive(
    name = "ruff-aarch64-darwin",
    build_file = "@//third_party:BUILD.ruff.bazel",
    sha256 = "e554d55281391138e44b30ccd38c666388e4aeb05417c9ffb98a6cbb014aef0d",
    strip_prefix = "ruff-aarch64-apple-darwin",
    url = "https://github.com/astral-sh/ruff/releases/download/0.6.8/ruff-aarch64-apple-darwin.tar.gz",
)

http_archive(
    name = "ruff-x86_64-darwin",
    build_file = "@//third_party:BUILD.ruff.bazel",
    sha256 = "44039cea2aed4787cedcda0c35e5b352530d6ca2178f39c8bd4ff63526c43aef",
    strip_prefix = "ruff-x86_64-apple-darwin",
    url = "https://github.com/astral-sh/ruff/releases/download/0.6.8/ruff-x86_64-apple-darwin.tar.gz",
)

http_archive(
    name = "rclone-x86_64-darwin",
    build_file = "@//third_party:BUILD.rclone.bazel",
    sha256 = "0a9a107ba911bf6bd3c61ad5160a379ac7c81a1b63498e12efcccb4676c65361",
    strip_prefix = "rclone-v1.69.2-osx-amd64",
    url = "https://github.com/rclone/rclone/releases/download/v1.69.2/rclone-v1.69.2-osx-amd64.zip",
)

http_archive(
    name = "rclone-x86_64-linux",
    build_file = "@//third_party:BUILD.rclone.bazel",
    sha256 = "14aaed7163df57894c96f8aca94757f19065f9cb3cb8a84ff9c33234271e1d69",
    strip_prefix = "rclone-v1.69.2-linux-amd64",
    url = "https://github.com/rclone/rclone/releases/download/v1.69.2/rclone-v1.69.2-linux-amd64.zip",
)

http_archive(
    name = "trivy-x86_64-linux",
    build_file = "@//third_party:BUILD.trivy.bazel",
    sha256 = "affa59a1e37d86e4b8ab2cd02f0ab2e63d22f1bf9cf6a7aa326c884e25e26ce3",
    url = "https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_Linux-64bit.tar.gz",
)

http_archive(
    name = "trivy-aarch64-darwin",
    build_file = "@//third_party:BUILD.trivy.bazel",
    sha256 = "320c0e6af90b5733b9326da0834240e944c6f44091e50019abdf584237ff4d0c",
    url = "https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_macOS-ARM64.tar.gz",
)

http_archive(
    name = "trivy-x86_64-darwin",
    build_file = "@//third_party:BUILD.trivy.bazel",
    sha256 = "41f6eac3ebe3a00448a16f08038b55ce769fe2d5128cb0d64bdf282cdad4831a",
    url = "https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_macOS-64bit.tar.gz",
)

# We pull in the binary artifact to break a circular dependency
# between repositories: `canbench` is hosted in a separate repository
# and depends on `pocket_ic` hosted in this repository;
# this prevents us from bumping `reqwest` from 0.12 to 0.13
# in `canbench` and `pocket_ic` in an atomic step if we want to build
# both from sources => we pull in `canbench` as a binary artifact instead.
# Bumping `reqwest` from 0.12 to 0.13 in an atomic step is required
# because having both version in the dependency tree (of this repository)
# causes issues.
http_file(
    name = "canbench_bin",
    downloaded_file_path = "canbench",
    executable = True,
    sha256 = "9d55976505e0e77a47be2f3240813090f84242f3912bb587fda8b97b9304bdd4",
    url = "https://github.com/dfinity/canbench/releases/download/v0.6.0/canbench",
)

http_file(
    name = "didc-x86_64-linux",
    downloaded_file_path = "didc",
    executable = True,
    sha256 = "1ed8f69036438217c0672097bba75aaf91e6851847d378ea4e0064377d8939fa",
    url = "https://github.com/dfinity/candid/releases/download/2023-11-16/didc-linux64",
)

http_file(
    name = "didc-x86_64-darwin",
    downloaded_file_path = "didc",
    executable = True,
    sha256 = "5df9a457c5ede103c7d017c23a4c1abce4d17db50442a9407724a9006db2f710",
    url = "https://github.com/dfinity/candid/releases/download/2023-11-16/didc-macos",
)

# pebble & pebble dns server for Boundary Nodes ACME tests

http_archive(
    name = "pebble-aarch64-darwin",
    build_file = "@//third_party:BUILD.pebble.bazel",
    sha256 = "09a3a4e6ebed71e8d83294a26d361232262f45a7488f5de7bccb5887b395217f",
    strip_prefix = "pebble-darwin-arm64/darwin/arm64",
    url = "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-darwin-arm64.tar.gz",
)

http_archive(
    name = "pebble-x86_64-darwin",
    build_file = "@//third_party:BUILD.pebble.bazel",
    sha256 = "e670ff869886022637e077502a62e7f23be693c45a5a6727ebd76da8fdce64dc",
    strip_prefix = "pebble-darwin-amd64/darwin/amd64",
    url = "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-darwin-amd64.tar.gz",
)

http_archive(
    name = "pebble-aarch64-linux",
    build_file = "@//third_party:BUILD.pebble.bazel",
    sha256 = "b53fd072a69eb7692451de4e8b0667e0bdf5cccd7e36fc51b8eaf2fcc135ed9f",
    strip_prefix = "pebble-linux-arm64/linux/arm64",
    url = "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-linux-arm64.tar.gz",
)

http_archive(
    name = "pebble-x86_64-linux",
    build_file = "@//third_party:BUILD.pebble.bazel",
    sha256 = "4f2fcb5bca8c85c9cf73ad140fccfc0d2be40bd81ab99879c79b7b8a0b4f70ed",
    strip_prefix = "pebble-linux-amd64/linux/amd64",
    url = "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-linux-amd64.tar.gz",
)

http_archive(
    name = "pebble-challtestsrv-aarch64-darwin",
    build_file = "@//third_party:BUILD.pebble-challtestsrv.bazel",
    sha256 = "59bf917fe39c96e2edca980fc2899f4f04aa1ce5485f28d419d18237b902cf82",
    strip_prefix = "pebble-challtestsrv-darwin-arm64/darwin/arm64",
    url = "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-challtestsrv-darwin-arm64.tar.gz",
)

http_archive(
    name = "pebble-challtestsrv-x86_64-darwin",
    build_file = "@//third_party:BUILD.pebble-challtestsrv.bazel",
    sha256 = "796bd923f2c595dd7bf15ae693096abfb1df962cb3673c7981ff306daa5c4a52",
    strip_prefix = "pebble-challtestsrv-darwin-amd64/darwin/amd64",
    url = "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-challtestsrv-darwin-amd64.tar.gz",
)

http_archive(
    name = "pebble-challtestsrv-aarch64-linux",
    build_file = "@//third_party:BUILD.pebble-challtestsrv.bazel",
    sha256 = "db8e1a79ccdb2195c489fbe4f40fddb7f30e86f9cd8a07912566ee5025094d6c",
    strip_prefix = "pebble-challtestsrv-linux-arm64/linux/arm64",
    url = "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-challtestsrv-linux-arm64.tar.gz",
)

http_archive(
    name = "pebble-challtestsrv-x86_64-linux",
    build_file = "@//third_party:BUILD.pebble-challtestsrv.bazel",
    sha256 = "e93a5aa25ecdf3af2f9fbb2de32b0173e64a2eae81002a4ccfe35fa6f4f60b92",
    strip_prefix = "pebble-challtestsrv-linux-amd64/linux/amd64",
    url = "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/pebble-challtestsrv-linux-amd64.tar.gz",
)

## For //ci/githubstats:query to query our BuildBuddy services via protobuf-based RPC to fetch logs

http_archive(
    name = "buildbuddy_proto",
    files = {
        "BUILD.bazel": "//ci/githubstats:BUILD.buildbuddy-proto.bazel",
    },
    patch_cmds = [
        # Remove everything except ./proto/
        "find . -mindepth 1 -maxdepth 1 ! -name proto -exec rm -rf {} +",
        "find ./proto -name BUILD -delete",
        # Make the generated Python modules regular packages, see :buildbuddy_py in the BUILD file above
        "touch proto/__init__.py proto/api/__init__.py proto/api/v1/__init__.py",
    ],
    sha256 = "eff54923b6afdf4507f9b07fc9906f06580fdba72d96e9d58d8e6ea8ac4f71cd",
    strip_prefix = "buildbuddy-89d510c91a18ec0469043a50750145ac51983f74",
    type = "tar.gz",
    url = "https://codeload.github.com/buildbuddy-io/buildbuddy/tar.gz/89d510c91a18ec0469043a50750145ac51983f74",  # v2.242.0
)

## shfmt, for formatting bash code

http_file(
    name = "shfmt-x86_64-linux",
    downloaded_file_path = "shfmt",
    executable = True,
    sha256 = "5741a02a641de7e56b8da170e71a97e58050d66a3cf485fb268d6a5a8bb74afb",
    url = "https://github.com/mvdan/sh/releases/download/v3.6.0/shfmt_v3.6.0_linux_amd64",
)

http_file(
    name = "shfmt-aarch64-darwin",
    downloaded_file_path = "shfmt",
    executable = True,
    sha256 = "633f242246ee0a866c5f5df25cbf61b6af0d5e143555aca32950059cf13d91e0",
    url = "https://github.com/mvdan/sh/releases/download/v3.6.0/shfmt_v3.6.0_darwin_arm64",
)

http_file(
    name = "shfmt-x86_64-darwin",
    downloaded_file_path = "shfmt",
    executable = True,
    sha256 = "b8c9c025b498e2816b62f0b717f6032e9ab49e725a45b8205f52f66318f17185",
    url = "https://github.com/mvdan/sh/releases/download/v3.6.0/shfmt_v3.6.0_darwin_amd64",
)

# Management canister candid interface

http_file(
    name = "management_canister_did",
    downloaded_file_path = "ic.did",
    sha256 = "0e92d8b9c2cf3d3fca166b76b2d3b8a2464d9b2b61117d8b2f63222b388d8dd1",
    url = "https://raw.githubusercontent.com/dfinity/portal/78c93aa37ef17dc67484079d1a4bf58a10a63106/docs/references/_attachments/ic.did",
)

# Mozilla CA certificate store in PEM format
http_file(
    name = "mozilla_root_ca_store",
    downloaded_file_path = "cacert.pem",
    sha256 = "bb1782d281fe60d4a2dcf41bc229abe3e46c280212597d4abcc25bddf667739b",
    url = "https://curl.se/ca/cacert-2024-11-26.pem",
)

mainnet_icos_images = use_repo_rule("//bazel:mainnet-icos-images.bzl", "mainnet_icos_images")

# Mainnet ICOS images
mainnet_icos_images(
    name = "mainnet_latest_hostos_images",
    parts = [
        "hostos",
        "latest_release",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_images(
    name = "mainnet_latest_hostos_images_dev",
    dev = True,
    parts = [
        "hostos",
        "latest_release",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_images(
    name = "mainnet_latest_guestos_images",
    parts = [
        "guestos",
        "latest_release",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_images(
    name = "mainnet_latest_guestos_images_dev",
    dev = True,
    parts = [
        "guestos",
        "latest_release",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_images(
    name = "mainnet_nns_images",
    parts = [
        "guestos",
        "subnets",
        "tdb26-jop6k-aogll-7ltgs-eruif-6kk7m-qpktf-gdiqx-mxtrf-vb5e6-eqe",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_images(
    name = "mainnet_nns_images_dev",
    dev = True,
    parts = [
        "guestos",
        "subnets",
        "tdb26-jop6k-aogll-7ltgs-eruif-6kk7m-qpktf-gdiqx-mxtrf-vb5e6-eqe",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_images(
    name = "mainnet_app_images",
    parts = [
        "guestos",
        "subnets",
        "io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_images(
    name = "mainnet_app_images_dev",
    dev = True,
    parts = [
        "guestos",
        "subnets",
        "io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_binaries = use_repo_rule("//bazel:mainnet-icos-binaries.bzl", "mainnet_icos_binaries")

# Mainnet release binaries, published for the same revisions as the mainnet ICOS
# images above. Declaring them as Bazel dependencies (instead of having the tests
# download them from the CDN while they run) is what allows the system-tests that
# use them to also run on the network-isolated local backend. See the
# mainnet_binaries_runtime_deps dicts in //rs/tests:common.bzl.
mainnet_icos_binaries(
    name = "mainnet_nns_binaries",
    parts = [
        "guestos",
        "subnets",
        "tdb26-jop6k-aogll-7ltgs-eruif-6kk7m-qpktf-gdiqx-mxtrf-vb5e6-eqe",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_binaries(
    name = "mainnet_app_binaries",
    parts = [
        "guestos",
        "subnets",
        "io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe",
    ],
    path = "//:mainnet-icos-revisions.json",
)

mainnet_icos_versions = use_repo_rule("//bazel:mainnet-icos-versions.bzl", "mainnet_icos_versions")

mainnet_icos_versions(
    name = "mainnet_icos_versions",
    path = "//:mainnet-icos-revisions.json",
)

os_info = use_repo_rule("//bazel:os_info.bzl", "os_info")

os_info(name = "os_info")

# Set up hermetic cc toolchains (hermetic-llvm) for binaries and canisters.
#
# We register wrapper toolchain()s from //bazel instead of the generated
# @llvm_toolchains//... toolchains so that every toolchain is additionally
# gated on //bazel:use_hermetic_cc. This lets builds opt out in favor of the
# system toolchain (e.g. --config=afl / --hermetic_cc=false), replicating
# hermetic_cc_toolchain's extra_target_settings mechanism, which hermetic-llvm
# does not provide.
llvm_toolchain = use_extension("@llvm//extensions:toolchain.bzl", "toolchain")

# Executors. macOS executors are declared only so that wasm32 (canister)
# builds keep working on macs; native macOS targets stay on the system Xcode
# toolchain until hermetic-llvm's macOS support matures (see the registration
# below).
llvm_toolchain.exec(
    arch = "x86_64",
    os = "linux",
)
llvm_toolchain.exec(
    arch = "aarch64",
    os = "linux",
)
llvm_toolchain.exec(
    arch = "x86_64",
    os = "macos",
)
llvm_toolchain.exec(
    arch = "aarch64",
    os = "macos",
)

# Targets: native Linux, plus wasm32 for canisters.
llvm_toolchain.target(
    arch = "x86_64",
    os = "linux",
)
llvm_toolchain.target(
    arch = "aarch64",
    os = "linux",
)
llvm_toolchain.target(
    arch = "wasm32",
    os = "none",
)
use_repo(llvm_toolchain, "llvm_toolchains")

# The llvm-project sources, for the libunwind headers used by
# //bazel:libunwind_include.
llvm_project = use_extension("@llvm//extensions:llvm.bzl", "llvm")
use_repo(llvm_project, "llvm-project")

register_toolchains(
    # Linux executors: native + cross + wasm.
    "//bazel:hermetic_cc_linux_x86_64_to_linux_x86_64",
    "//bazel:hermetic_cc_linux_x86_64_to_none_wasm32",
    "//bazel:hermetic_cc_linux_aarch64_to_linux_aarch64",

    # macOS executors: wasm only. Native macOS targets deliberately stay on the system Xcode toolchain:
    # hermetic-llvm's macOS support (trimmed Apple SDK sysroot, resource-dir handling)
    # is not yet mature enough for the full darwin build (e.g. configure-based cargo build scripts fail to find SDK headers).
    "//bazel:hermetic_cc_macos_x86_64_to_none_wasm32",
    "//bazel:hermetic_cc_macos_aarch64_to_none_wasm32",

    # These toolchains are only registered locally.
    dev_dependency = True,
)

new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")

# Use libvirt from the host environment
# Used for managing virtual machines programmatically.
new_local_repository(
    name = "cryptsetup",
    build_file = "@//third_party:BUILD.cryptsetup.bazel",
    path = "/usr",
)

new_local_repository(
    name = "devmapper",
    build_file = "@//third_party:BUILD.devmapper.bazel",
    path = "/usr",
)

new_local_repository(
    name = "libvirt",
    build_file = "@//third_party:BUILD.libvirt.bazel",
    path = "/usr",
)

http_archive(
    name = "dnsmasq",
    build_file = "@//third_party:BUILD.dnsmasq.bazel",
    sha256 = "a038282c6528a2b8c240c1fdddc8e5363f69ebe778b51736b373604021c8671f",
    strip_prefix = "dnsmasq-2.92",
    url = "https://github.com/imp/dnsmasq/archive/refs/tags/v2.92.tar.gz",
)

# Mainnet canister references

canisters = use_repo_rule("//bazel:mainnet-canisters.bzl", "canisters")

# We cannot derive the filenames (e.g. "registry-canister.wasm.gz") directly
# from the canister names because we use inconsistent names.
#
# For each new canister defined in the source JSON file (see `path`) a mapping can be added
# from canister name (as per JSON) to filename.
#
# Additionally the `repositories` list GitHub repositories for canisters. If a canister has an
# entry in `repositories`, then the source JSON file must specify a `tag` and the canister
# artifact will be fetched from the tag's release page.
canisters(
    name = "mainnet_canisters",
    filenames = {
        "registry": "registry-canister.wasm.gz",
        "governance": "governance-canister.wasm.gz",
        "governance-canister_test": "governance-canister_test.wasm.gz",
        "ledger": "ledger-canister_notify-method.wasm.gz",
        "archive": "ledger-archive-node-canister.wasm.gz",
        "index": "ic-icp-index-canister.wasm.gz",
        "root": "root-canister.wasm.gz",
        "lifeline": "lifeline_canister.wasm.gz",
        "genesis-token": "genesis-token-canister.wasm.gz",
        "cycles-minting": "cycles-minting-canister.wasm.gz",
        "sns-wasm": "sns-wasm-canister.wasm.gz",
        "ck_btc_archive": "ic-icrc1-archive.wasm.gz",
        "ck_btc_ledger": "ic-icrc1-ledger.wasm.gz",
        "ck_btc_ledger_v1": "ic-icrc1-ledger.wasm.gz",
        "ck_btc_ledger_v3": "ic-icrc1-ledger.wasm.gz",
        "ck_btc_index": "ic-icrc1-index-ng.wasm.gz",
        "ck_eth_archive": "ic-icrc1-archive-u256.wasm.gz",
        "ck_eth_ledger": "ic-icrc1-ledger-u256.wasm.gz",
        "ck_eth_ledger_v1": "ic-icrc1-ledger-u256.wasm.gz",
        "ck_eth_ledger_v3": "ic-icrc1-ledger-u256.wasm.gz",
        "ck_eth_index": "ic-icrc1-index-ng-u256.wasm.gz",
        "sns_root": "sns-root-canister.wasm.gz",
        "sns_governance": "sns-governance-canister.wasm.gz",
        "swap": "sns-swap-canister.wasm.gz",
        "sns_ledger": "ic-icrc1-ledger.wasm.gz",
        "sns_ledger_v2": "ic-icrc1-ledger.wasm.gz",
        "sns_archive": "ic-icrc1-archive.wasm.gz",
        "sns_index": "ic-icrc1-index-ng.wasm.gz",
        "node-rewards": "node-rewards-canister.wasm.gz",
        "internet_identity_backend": "internet_identity_production.wasm.gz",
        "internet_identity_frontend": "internet_identity_frontend.wasm.gz",
        "nns_dapp_test": "nns-dapp_test.wasm.gz",
        "sns_aggregator_test": "sns_aggregator_dev.wasm.gz",
        "cycles_ledger": "cycles-ledger.wasm.gz",
        "cycles_ledger_index": "ic-icrc1-index-ng-u256.wasm.gz",
        "bitcoin_testnet": "ic-btc-canister.wasm.gz",
        "dogecoin": "ic-doge-canister.wasm.gz",
        "migration": "migration-canister.wasm.gz",
        "engine-controller": "engine-controller-canister.wasm.gz",
        "subnet_rental": "subnet_rental_canister.wasm.gz",
    },
    path = "//:mainnet-canister-revisions.json",
    repositories = {
        "cycles_ledger": "dfinity/cycles-ledger",
        "internet_identity_backend": "dfinity/internet-identity",
        "internet_identity_frontend": "dfinity/internet-identity",
        "nns_dapp_test": "dfinity/nns-dapp",
        "sns_aggregator_test": "dfinity/nns-dapp",
        "bitcoin_testnet": "dfinity/bitcoin-canister",
        "dogecoin": "dfinity/dogecoin-canister",
        "subnet_rental": "dfinity/subnet-rental-canister",
    },
)

bazel_dep(name = "rules_motoko", version = "1.0.0")
archive_override(
    module_name = "rules_motoko",
    integrity = "sha256-skEVw/tHSuYMLJxh8rWuwt6bjyYWpoay0JBZNYz4+5U=",
    strip_prefix = "rules_motoko-0c3d815c0c07c5696a4cb3fa8da25834594a5294",
    type = "tar.gz",
    urls = ["https://codeload.github.com/dfinity/rules_motoko/tar.gz/0c3d815c0c07c5696a4cb3fa8da25834594a5294"],
)

motoko = use_extension("@rules_motoko//motoko:extensions.bzl", "motoko")
motoko.toolchain(version = "1.11.0")  # NOTE: keep version in line with Dockerfile