feat!: Upgrade build-system to 2.0.0

Upgrade to build-system with ubunbu 22.04 (debian 12)

Bug: b/373923491
Change-Id: I2bee71b44c252895a1063e128a2a81f07f485bbd
GitOrigin-RevId: bac0b0ce36b0291aed4f092213c25d071b9ea3e1

Author: Privacy Sandbox Team

builders/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
 
+## 2.0.0 (2025-04-25)
+
+
+### ⚠ BREAKING CHANGES
+
+* Upgrade build-debian to ubunbu 22 (debian 12)
+
 ## 1.0.0 (2025-04-24)
 
 

builders/bazel/container_deps.bzl

@@ -14,60 +14,56 @@
 
 load("@rules_oci//oci:pull.bzl", "oci_pull")
 
-# All container images must be compatible with the `build-debian` image.
 _images = {
     "runtime-debian-debug-nonroot": {
         "arch_hashes": {
-            # Feb 28, 2024
-            "amd64": "72b9108b17a4ef0398998d45cbc14af2f3270af374fc2aa2c74823c6c7054fac",
-            # Feb 28, 2024
-            "arm64": "623676598d55f93ff93ea3b9d95f3cb5a379eca66dfcf9b2734f2cc3e5f34666",
+            # Mar 28, 2025
+            "amd64": "0a8aecaca4eec99be3b8034bcbd4a7541c6dc27c5a1eb9c80b0ba2f597c1e3f1",
+            # Mar 28, 2025
+            "arm64": "e5e85d96a09bef71cf1b6a1b21eadfb7d64f5e1c9bd4222d6762f7464f0e72f4",
         },
         "registry": "gcr.io",
-        "repository": "distroless/cc-debian11",
+        "repository": "distroless/cc-debian12",
     },
     "runtime-debian-debug-root": {
-        # debug build so we can use 'sh'. Root, for gcp coordinators
+        # Debug build so we can use 'sh'. Root, for GCP coordinators
         # auth to work
         "arch_hashes": {
-            # Feb 28, 2024
-            "amd64": "d5a2169bc2282598f0cf886a3d301269d0ee5bf7f7392184198dd41d36b70548",
-            # Feb 28, 2024
-            "arm64": "6449313a9a80b2758f505c81462c492da87f76954d319f2adb55401177798cce",
+            # Mar 28, 2025
+            "amd64": "5d6d0b2f650f41ec0ed490f7b12f3e326af5964517a8a8dc8c65e9dfa4bd8008",
+            # Mar 28, 2025
+            "arm64": "11e03b8351fa3dc15cea2a97a3484617adeadab37045f77d5328046f0fbd9544",
         },
         "registry": "gcr.io",
-        "repository": "distroless/cc-debian11",
+        "repository": "distroless/cc-debian12",
     },
     "runtime-debian-nondebug-nonroot": {
-        # cc-debian11:nonroot
         # This image contains a minimal Linux, glibc runtime for
         # "mostly-statically compiled" languages like Rust and D.
         # https://github.com/GoogleContainerTools/distroless/blob/main/cc/README.md
         "arch_hashes": {
-            # Jul 4, 2024
-            "amd64": "5a9e854bab8498a61a66b2cfa4e76e009111d09cb23a353aaa8d926e29a653d9",
-            # Jul 4, 2024
-            "arm64": "3122cd55375a0a9f32e56a18ccd07572aeed5682421432701a03c335ab79c650",
+            "amd64": "acf6c2fe4179cd5da18bcf433f0b62467c40f2a42dc821c08cc4ce2f7037813b",
+            "arm64": "4e6bf5546fc17c9d434b3975daa5dbdb0e4411db4db5e96b122ba8f697f14810",
         },
         "registry": "gcr.io",
-        "repository": "distroless/cc-debian11",
+        "repository": "distroless/cc-debian12",
     },
     "runtime-debian-nondebug-root": {
         "arch_hashes": {
-            # Jul 29, 2024
-            "amd64": "72f2f861fdc130b1b083f3f055bbe84b73eec8c8c48f16a435194b41feedc674",
-            # Jul 4, 2024
-            "arm64": "74bbfb32c5341d7abc6de0379ffe330a9aec2819c5145c4c71917975c93b83e5",
+            # Mar 28, 2025
+            "amd64": "dc7acdb6300eaa99ae93621b0f033237ae1284fdd5ab323b4d90ba8359c55854",
+            # Mar 28, 2025
+            "arm64": "b97c1911753fbbdf557e5994a5930de9233f9eec7fd0b773f6624c77b01b76db",
         },
         "registry": "gcr.io",
-        "repository": "distroless/cc-debian11",
+        "repository": "distroless/cc-debian12",
     },
     # Non-distroless; only for debugging purposes
     "runtime-ubuntu-fulldist-debug-root": {
-        # Ubuntu 20.04 ubuntu:focal-20240530
+        # Ubuntu 22.04 ubuntu:jammy-20250404
         "arch_hashes": {
-            "amd64": "d86db849e59626d94f768c679aba441163c996caf7a3426f44924d0239ffe03f",
-            "arm64": "6edb9576e2a2080a42e4e0e9a6bc0bd91a2bf06375f9832d400bf33841d35ece",
+            "amd64": "a76d0e9d99f0e91640e35824a6259c93156f0f07b7778ba05808c750e7fa6e68",
+            "arm64": "04c0fd7fceedf5c0fe69ec1685c37cf270f03ae424322a58548b095528f4a3c3",
         },
         "registry": "docker.io",
         "repository": "library/ubuntu",

builders/images/build-debian/Dockerfile

@@ -13,9 +13,9 @@
 # limitations under the License.
 
 # Use fixed manifest digest to ensure reproducible.
-# https://hub.docker.com/layers/library/ubuntu/focal-20240530/images/sha256-85c08a37b74bc18a7b3f8cf89aabdfac51c525cdbc193a753f7907965e310ec2
-# ubuntu v20.04, focal-20240530
-ARG BASE_IMAGE=ubuntu@sha256:fa17826afb526a9fc7250e0fbcbfd18d03fe7a54849472f86879d8bf562c629e
+# https://hub.docker.com/layers/library/ubuntu/jammy-20240911.1/images/sha256-3d1556a8a18cf5307b121e0a98e93f1ddf1f3f8e092f1fddfd941254785b95d7?context=explore
+# ubuntu v22.04, jammy-20240911.1
+ARG BASE_IMAGE=ubuntu@sha256:58b87898e82351c6cf9cf5b9f3c20257bb9e2dcf33af051e12ce532d7f94e3fe
 
 # ignore this hadolint error as BASE_IMAGE contains an image tag
 # hadolint ignore=DL3006

builders/images/build-debian/compile_libprofiler

@@ -15,7 +15,7 @@ function install_build_tools() {
     lsb-release="11.1.*" \
     make="4.*" \
     software-properties-common="0.99.*" \
-    wget="1.20.*"
+    wget="1.21.*"
 }
 
 function install_clang() {

builders/images/build-debian/install_apps

@@ -44,50 +44,52 @@ function apt_update() {
 }
 
 function install_python() {
+  local -r ver="3.10"
   apt-get --quiet install -y --no-install-recommends \
-    python3.9-venv="3.9.*" python3.9-dev
+    python${ver}-venv="${ver}.*" python${ver}-dev
   mkdir -p /opt/bin
   update-alternatives \
     --force \
-    --install /opt/bin/python3 python3-opt /usr/bin/python3.9 100 \
-    --slave /usr/bin/python3 python3-usr /usr/bin/python3.9 \
-    --slave /usr/bin/python python-usr /usr/bin/python3.9 \
-    --slave /opt/bin/python python /usr/bin/python3.9
+    --install /opt/bin/python3 python3-opt /usr/bin/python${ver} 100 \
+    --slave /usr/bin/python3 python3-usr /usr/bin/python${ver} \
+    --slave /usr/bin/python python-usr /usr/bin/python${ver} \
+    --slave /opt/bin/python python /usr/bin/python${ver}
   curl https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py
   /usr/bin/python3 /tmp/get-pip.py
   rm -f /tmp/get-pip.py
   /usr/bin/python3 -m pip --version
   /usr/bin/python3 -m pip install \
     "libclang~=${CLANG_VER}.0" \
-    "numpy~=1.25" \
+    "numpy~=1.26.4" \
     "keyring~=25.6.0" \
     "keyrings.google-artifactregistry-auth~=1.1.2"
 }
 
 function install_misc() {
   declare -r arch="$1"
   apt-get --quiet install -y --no-install-recommends \
-    apt-transport-https="2.0.*" \
+    apt-transport-https="2.4.*" \
     bsdmainutils \
+    bzip2="1.0.8-*" \
     ca-certificates \
     chrpath="0.16-*" \
-    curl="7.68.*" \
+    curl="7.81.*" \
     file="1:5.*" \
     gawk="1:5.*" \
-    gettext="0.19.*" \
-    git="1:2.25.*" \
+    gettext="0.21*" \
+    git="1:2.34.*" \
     gnupg="2.2.*" \
     google-perftools="2.*" \
     jq="1.6-*" \
-    libcurl4="7.68.*" \
-    locales="2.31-*" \
+    libcurl4="7.81.*" \
+    locales="2.35-*" \
     lsb-release="11.1.*" \
-    openssh-client="1:8.2*" \
+    openssh-client="1:8.9*" \
     patch="2.7.*" \
-    rename="1.10-*" \
+    rename="1.30-*" \
     software-properties-common="0.99.*" \
     unzip="6.0-*" \
-    wget="1.20.*" \
+    wget="1.21.*" \
     xz-utils="5.2.*" \
     zip="3.0-*" \
     graphviz=2.*

builders/tests/data/hashes/build-debian

@@ -1 +1 @@
-f0c18dc58423ebf994f30ca936fe4dc3e5ee3a3c7f4237dcdf819058efe839e5
+a39144af81a6ac8fbc1402b77524147b9dd6090b6714fa156e9bd918ceae8233

builders/tools/get-architecture

@@ -27,5 +27,5 @@ function _cleanup() {
 if [[ -n ${BUILD_ARCH} ]]; then
   printf "%s\n" "${BUILD_ARCH}"
 else
-  docker run --rm --entrypoint=/usr/bin/dpkg ubuntu:20.04 --print-architecture
+  docker run --rm --entrypoint=/usr/bin/dpkg ubuntu:22.04 --print-architecture
 fi

builders/version.txt

@@ -1 +1 @@
-1.0.0
+2.0.0

src/public/cpio/validator/testdata/version.yaml

@@ -17,12 +17,12 @@
 schemaVersion: 2.0.0
 
 commandTests:
-  - name: 'Ubuntu version is 20'
+  - name: 'Ubuntu version is not 20'
     command: '/usr/bin/cat'
     args: ['/etc/debian_version']
-    expectedOutput: ['bullseye/sid']
+    excludedOutput: ['bullseye/sid']
 
-  - name: 'Ubuntu version is not 22'
+  - name: 'Ubuntu version is 22'
     command: '/usr/bin/cat'
     args: ['/etc/debian_version']
-    excludedOutput: ['bookworm/sid']
+    expectedOutput: ['bookworm/sid']

src/roma/byob/container/BUILD.bazel

@@ -286,7 +286,7 @@ cp --dereference \
 rm -rf "$${{ROOT_DIR}}/usr/lib"
 if [[ -d $${{ROOT_DIR}}/lib64 ]]; then
    # move ld.so to /lib64
-  mv "$${{ROOT_DIR}}/lib/$${{MACHINE}}-linux-gnu"/ld-2.31.so "$${{ROOT_DIR}}/lib64/ld-linux-$${{MACHINE/_/-}}.so.2"
+  mv "$${{ROOT_DIR}}/lib/$${{MACHINE}}-linux-gnu"/* "$${{ROOT_DIR}}"/lib64
   rm -rf "$${{ROOT_DIR}}/lib"
 fi
 cp --dereference $(execpath :nsjail) "$${{ROOT_DIR}}/usr/bin/"