build: fetch urcrypt instead of vendoring it

.github/workflows/shared.yml

@@ -43,7 +43,7 @@ jobs:
           # runner with BuildJet instead.
           - { target: linux-aarch64, runner: buildjet-2vcpu-ubuntu-2204-arm	}
           - { target: linux-x86_64, runner: ubuntu-22.04 }
-          # GitHub doesn't provide macOS machines with Apple Silicon, so we 
+          # GitHub doesn't provide macOS machines with Apple Silicon, so we
           # self-host a runner with MacStadium instead.
           - { target: macos-aarch64, runner: [self-hosted, macos, ARM64] }
           - { target: macos-x86_64, runner: macos-12 }
@@ -72,7 +72,7 @@ jobs:
             /private/var/tmp/_bazel_$(whoami)
             # Cache musl libc toolchains.
             /usr/local/*-musl
-      
+
       - name: chown /usr/local/*-musl
         if: ${{ matrix.target == 'linux-x86_64' || matrix.target == 'linux-aarch64'}}
         run: |
@@ -119,6 +119,7 @@ jobs:
               bazel run //bazel/toolchain:x86_64-linux-musl-gcc
               ;;
             "macos-aarch64")
+              brew install pkg-config
               ;;
             "macos-x86_64")
               # Switch Xcode path to match the path specified in our bazel toolchain.

README.md

@@ -19,8 +19,6 @@ defined in its own package:
 
 - [`pkg/c3`](pkg/c3): A set of basic utilities for writing Urbit's style of C.
 - [`pkg/ent`](pkg/ent): A cross-platform wrapper for `getentropy(2)`.
-- [`pkg/urcrypt`](pkg/urcrypt): A standardized interface for calling various
-  cryptographic functions used in the Urbit runtime.
 - [`pkg/ur`](pkg/ur): An implementation of [jam][jam] and [cue][cue], Urbit's
   bitwise noun serialization and deserialization algorithms, respectively.
 - [`pkg/noun`](pkg/noun): The Nock virtual machine and snapshotting system.

WORKSPACE.bazel

@@ -121,15 +121,6 @@ versioned_http_archive(
     version = "9681279cfaa6e6399bb7ca3afbbc27fc2e19df4b",
 )
 
-versioned_http_archive(
-    name = "argon2",
-    build_file = "//bazel/third_party/argon2:argon2.BUILD",
-    sha256 = "40850e6e6324be10f14228d17b617ad2074bb926eeddd6fe40ad5df833833949",
-    strip_prefix = "argon2-{version}",
-    url = "https://github.com/urbit/argon2/archive/{version}.tar.gz",
-    version = "a4c1e3f7138c2e577376beb99f964cf71e1c8b1b",
-)
-
 versioned_http_archive(
     name = "bazel_gazelle",
     sha256 = "efbbba6ac1a4fd342d5122cbdfdb82aeb2cf2862e35022c752eaddffada7c3f3",
@@ -154,15 +145,6 @@ versioned_http_archive(
     version = "7.85.0",
 )
 
-versioned_http_archive(
-    name = "ed25519",
-    build_file = "//bazel/third_party/ed25519:ed25519.BUILD",
-    sha256 = "373923c85f61276e3cad2c0ae7a5d5cd4809ffe46c5abc1dc8276683a55782a0",
-    strip_prefix = "ed25519-{version}",
-    url = "https://github.com/orlp/ed25519/archive/{version}.tar.gz",
-    version = "7fa6712ef5d581a6981ec2b08ee623314cd1d1c4",
-)
-
 versioned_http_archive(
     name = "gmp",
     build_file = "//bazel/third_party/gmp:gmp.BUILD",
@@ -214,17 +196,6 @@ versioned_http_file(
     version = "255fb1ca8206072f1d09425f0db61ecfe7ff5b17",
 )
 
-versioned_http_archive(
-    name = "keccak_tiny",
-    build_file = "//bazel/third_party/keccak_tiny:keccak_tiny.BUILD",
-    patch_args = ["-p1"],
-    patches = ["//bazel/third_party/keccak_tiny:{version}.patch"],
-    sha256 = "6d4717f96b84805886c74bad89e911076664d992f197634fd7cdfca2ac0f62ef",
-    strip_prefix = "keccak-tiny-{version}",
-    url = "https://github.com/coruus/keccak-tiny/archive/{version}.tar.gz",
-    version = "64b6647514212b76ae7bca0dea9b7b197d1d8186",
-)
-
 versioned_http_archive(
     name = "lmdb",
     build_file = "//bazel/third_party/lmdb:lmdb.BUILD",
@@ -272,18 +243,6 @@ versioned_http_archive(
     version = "67108d883061043e55d0fb13961ac1b6fc8a485c",
 )
 
-versioned_http_archive(
-    name = "scrypt",
-    build_file = "//bazel/third_party/scrypt:scrypt.BUILD",
-    sha256 = "df681fb19b653b1a12970ebb6091bb2b58411b9e7baf01143870f6be3f099541",
-    strip_prefix = "libscrypt-{version}",
-    url = "https://github.com/technion/libscrypt/archive/{version}.tar.gz",
-    # When bumping the version, compare `Makefile` in the `scrypt` repo to
-    # {build_file} and confirm that {build_file} remains an accurate description
-    # of the scrypt build process.
-    version = "60e585cdd752262b22ed4113eca41c0461a61608",
-)
-
 versioned_http_archive(
     name = "secp256k1",
     build_file = "//bazel/third_party/secp256k1:secp256k1.BUILD",
@@ -337,6 +296,15 @@ versioned_http_file(
     version = "ea8fee3aa0434d4bdf1bf785e5ec346c7ecba7fd",
 )
 
+versioned_http_archive(
+    name = "urcrypt",
+    build_file = "//bazel/third_party/urcrypt:urcrypt.BUILD",
+    sha256 = "00ec597c14c418802d5db2d6a68cf83bd4f5419071b95f979374d3184599d6c8",
+    strip_prefix = "urcrypt-{version}",
+    url = "https://github.com/urbit/urcrypt/archive/{version}.tar.gz",
+    version = "b970baefa6e0a680fffa2b2ee19c956a4ae20355",
+)
+
 versioned_http_archive(
     name = "uv",
     build_file = "//bazel/third_party/uv:uv.BUILD",

bazel/BUILD.bazel

@@ -11,12 +11,11 @@ refresh_compile_commands(
         "//pkg/ent",
         "//pkg/noun",
         "//pkg/ur",
-        "//pkg/urcrypt",
         "//pkg/vere:urbit",
     ],
     # No need to add flags already in .bazelrc. They're automatically picked up.
     # If you don't need flags, a list of targets is also okay, as is a single target string.
     # Wildcard patterns, like //... for everything, *are* allowed here, just like a build.
     # As are additional targets (+) and subtractions (-), like in bazel query https://docs.bazel.build/versions/main/query.html#expressions
     # And if you're working on a header-only library, specify a test or binary target that compiles it.
-)
+)

bazel/third_party/urcrypt/urcrypt.BUILD

@@ -0,0 +1,28 @@
+load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make")
+
+filegroup(
+    name = "all",
+    srcs = glob(["**"]),
+)
+
+configure_make(
+    name = "urcrypt",
+    autogen = True,
+    configure_in_place = True,
+    configure_options = [
+        "--disable-shared",
+    ],
+    copts = [
+        "-Wall",
+        "-g",
+        "-O3",
+    ],
+    deps = [
+        "@aes_siv",
+        "@openssl",
+        "@secp256k1"
+    ],
+    lib_source = ":all",
+    out_static_libs = ["liburcrypt.a"],
+    visibility = ["//visibility:public"],
+)

pkg/noun/BUILD.bazel

@@ -34,13 +34,13 @@ vere_library(
         "//pkg/c3",
         "//pkg/ent",
         "//pkg/ur",
-        "//pkg/urcrypt",
         "@gmp",
         "@murmur3",
         "@openssl",
         "@pdjson",
         "@sigsegv",
         "@softfloat",
+        "@urcrypt",
     ] + select({
         "@platforms//os:macos": ["//pkg/noun/platform/darwin"],
         "@platforms//os:linux": ["//pkg/noun/platform/linux"],

pkg/noun/jets.c

@@ -14,7 +14,7 @@
 #include "retrieve.h"
 #include "serial.h"
 #include "trace.h"
-#include "urcrypt/urcrypt.h"
+#include "urcrypt.h"
 #include "vortex.h"
 #include "xtract.h"
 

pkg/noun/manage.c

@@ -20,7 +20,7 @@
 #include "platform/rsignal.h"
 #include "retrieve.h"
 #include "trace.h"
-#include "urcrypt/urcrypt.h"
+#include "urcrypt.h"
 #include "vortex.h"
 #include "xtract.h"