ENT-14099: Replace leech with leech2 dependency

README.md

@@ -146,7 +146,7 @@ File `install-dependencies` and the relevant subdirectories in `deps-packaging`
 | [SASL2](https://www.cyrusimap.org/sasl/)                                          | 2.1.28 | 2.1.28 | 2.1.28 | Solaris Enterprise agent |
 | [zlib](https://www.zlib.net/)                                                     | 1.3.2  | 1.3.2  | 1.3.2  |                          |
 | [librsync](https://github.com/librsync/librsync/releases)                         | -      | 2.3.4  | 2.3.4  |                          |
-| [leech](https://github.com/larsewi/leech/releases)                                | -      | 0.2.0  | 0.2.0  |                          |
+| [leech2](https://github.com/larsewi/leech2/releases)                              | -      | 5.0.1  | 5.0.1  |                          |
 
 
 ### Enterprise Hub dependencies

build-scripts/compile-options

@@ -155,10 +155,10 @@ nova)
     # - Mission Portal uses LDAP for authentication functionality
     var_append DEPS "openldap"
 
-    # leech is used for efficient synchronization of tabular data.
+    # leech2 is used for efficient synchronization of tabular data.
     # - cf-hub requests state changes from cf-serverd
     # - state changes are recorded by cf-agent
-    var_append DEPS "leech"
+    var_append DEPS "leech2"
     ;;
 esac
 

build-scripts/configure

@@ -42,7 +42,7 @@ P=$BUILDPREFIX
 
 ARGS="--prefix=$P --libdir=$P/lib --with-workdir=$P --sysconfdir=/etc --with-openssl=$P --with-pcre2=$P --with-librsync=$P --with-init-script --with-lmdb=$P"
 
-for dep in ldap libxml2 libyaml librsync leech libacl libvirt libcurl; do
+for dep in ldap libxml2 libyaml librsync leech2 libacl libvirt libcurl; do
     case "$DEPS" in
     *"$dep"*)
         var_append ARGS "--with-$dep=$P"

ci/cfengine-build-host-setup.cf

@@ -251,6 +251,24 @@ bundle agent cfengine_build_host_setup
     !(debian|ubuntu)::
       "sshd_service_name" string => "sshd";
 
+    # protoc is needed to build the cargo-based leech2 dependency. Reuse
+    # leech2's own installer from master (single source of truth, so the pinned
+    # protoc version tracks leech2's .protoc-version). Fetched only when missing;
+    # the if-guard is evaluated at promise time, unlike a class defined in the
+    # classes: section which would not be set yet during vars.
+    any::
+      "leech2_protoc_setup"
+        data => url_get("https://raw.githubusercontent.com/larsewi/leech2/refs/heads/master/.github/scripts/setup-protoc.sh", "{}"),
+        if => not(fileexists("/usr/local/bin/protoc"));
+
+      "leech2_protoc_version"
+        data => url_get("https://raw.githubusercontent.com/larsewi/leech2/refs/heads/master/.protoc-version", "{}"),
+        if => not(fileexists("/usr/local/bin/protoc"));
+
+      "rustup_init"
+        data => url_get("https://static.rust-lang.org/rustup/rustup-init.sh", "{}"),
+        if => not(fileexists("/opt/rust/bin/rustc"));
+
   classes:
     any::
       "mingw_build_host"
@@ -373,6 +391,35 @@ bundle agent cfengine_build_host_setup
         contain => in_shell,
         classes => results("bundle", "java");
 
+    # leech2 build toolchain: run the installers fetched in the files: section.
+    protoc_script_ok::
+      "$(sys.workdir)/leech2-protoc/setup-protoc.sh"
+        contain => in_dir("$(sys.workdir)/leech2-protoc"),
+        comment => "Install pinned protoc using leech2's own installer; required to build the cargo-based leech2 dependency.";
+
+    rustup_script_ok::
+      # RUSTUP_HOME=/opt/rust  : install the toolchains/targets system-wide
+      #                          (defaults to ~/.rustup).
+      # CARGO_HOME=/opt/rust   : put the cargo/rustc/rustup proxy binaries in
+      #                          /opt/rust/bin (added to PATH via profile.d).
+      #                          Not exported at runtime, so builds use the
+      #                          default ~/.cargo for their writable cache.
+      # -y                     : non-interactive, accept defaults (unattended).
+      # --no-modify-path       : do not let rustup edit shell rc files; we
+      #                          manage PATH ourselves in profile.d/rust.sh.
+      # --profile minimal      : rustc + cargo + rust-std only (no docs/clippy).
+      # --default-toolchain stable : install the stable channel as default.
+      "RUSTUP_HOME=/opt/rust CARGO_HOME=/opt/rust sh $(sys.workdir)/rustup-init.sh -y --no-modify-path --profile minimal --default-toolchain stable"
+        contain => in_shell,
+        comment => "Install the Rust toolchain system-wide under /opt/rust for building the cargo-based leech2 dependency.";
+
+      "RUSTUP_HOME=/opt/rust /opt/rust/bin/rustup target add x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-pc-windows-gnu"
+        contain => in_shell,
+        comment => "Add the cross-compilation targets needed to build leech2.";
+
+      "chmod -R a+rX /opt/rust"
+        comment => "Make sure it's readable by the build user.";
+
     (redhat_7|centos_7|redhat_8|centos_8|redhat_9|redhat_10).(!have_development_tools).(yum_dnf_conf_ok)::
       "yum groups install -y 'Development Tools'" contain => in_shell;
 
@@ -440,6 +487,26 @@ bundle agent cfengine_build_host_setup
         );
 
   files:
+    # leech2 build toolchain: write the fetched installers to disk (only when
+    # the corresponding tool is missing) so the commands: section can run them.
+    any::
+      "$(sys.workdir)/leech2-protoc/.protoc-version"
+        content => "$(leech2_protoc_version[content])",
+        perms => mog("0644", "root", "root"),
+        if => not(fileexists("/usr/local/bin/protoc"));
+
+      "$(sys.workdir)/leech2-protoc/setup-protoc.sh"
+        content => "$(leech2_protoc_setup[content])",
+        perms => mog("0700", "root", "root"),
+        classes => scoped_classes_generic("bundle", "protoc_script"),
+        if => not(fileexists("/usr/local/bin/protoc"));
+
+      "$(sys.workdir)/rustup-init.sh"
+        content => "$(rustup_init[content])",
+        perms => mog("0700", "root", "root"),
+        classes => scoped_classes_generic("bundle", "rustup_script"),
+        if => not(fileexists("/opt/rust/bin/rustc"));
+
     redhat::
       "/etc/environment"
         edit_line => contains_literal_string("LC_ALL=C"),

container/Dockerfile.debian

@@ -8,7 +8,7 @@ RUN apt-get update && apt-get install -y \
     autoconf automake binutils bison build-essential curl debhelper \
     dpkg-dev expat fakeroot flex gdb git libexpat1-dev \
     libmodule-load-conditional-perl libpam0g-dev libtool \
-    pkg-config psmisc python3-pip rsync sudo systemd-coredump wget \
+    pkg-config psmisc python3-pip rsync sudo systemd-coredump unzip wget \
     && rm -rf /var/lib/apt/lists/*
 
 # ncurses: ubuntu-20 uses libncurses5/libncurses5-dev, newer use libncurses6/libncurses-dev
@@ -30,6 +30,21 @@ RUN apt-get purge -y \
     libattr1-dev libssl-dev libpcre2-dev libacl1-dev \
     libyaml-dev libxml2-dev librsync-dev 2>/dev/null || true
 
+# Rust toolchain and protobuf compiler for building the cargo-based leech2
+# dependency (mirrors the rust/protoc setup in cfengine-build-host-setup.cf).
+# rustup is installed system-wide under /opt/rust and consumed by
+# deps-packaging/leech2 via RUSTUP_HOME and PATH.
+#
+# protoc: reuse leech2's own pinned installer (single source of truth).
+RUN curl -fsSL https://raw.githubusercontent.com/larsewi/leech2/refs/heads/master/.protoc-version -o /tmp/.protoc-version
+RUN curl -fsSL https://raw.githubusercontent.com/larsewi/leech2/refs/heads/master/.github/scripts/setup-protoc.sh -o /tmp/setup-protoc.sh
+RUN cd /tmp && bash setup-protoc.sh && rm -f /tmp/.protoc-version /tmp/setup-protoc.sh
+
+# Rust toolchain, installed system-wide under /opt/rust.
+RUN curl -fsSL https://sh.rustup.rs | RUSTUP_HOME=/opt/rust CARGO_HOME=/opt/rust sh -s -- -y --no-modify-path --profile minimal --default-toolchain stable
+RUN RUSTUP_HOME=/opt/rust /opt/rust/bin/rustup target add x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-pc-windows-gnu
+RUN chmod -R a+rX /opt/rust
+
 # Create build user with passwordless sudo (needed by install-dependencies, package, etc.)
 RUN useradd -m -s /bin/bash builder \
     && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder