# Licensed under the Apache-2.0 license
# SPDX-License-Identifier: Apache-2.0

module(
    name = "openprot",
    version = "0.0.1",
)

bazel_dep(name = "bazel_skylib", version = "1.8.2")
bazel_dep(name = "pigweed")
bazel_dep(name = "platforms", version = "1.0.0")
bazel_dep(name = "rules_rust", version = "0.70.0")
bazel_dep(name = "rules_rust_bindgen", version = "0.70.0")
bazel_dep(name = "rules_rust_mdbook", version = "0.70.0")
bazel_dep(name = "rules_platform", version = "0.1.0")
bazel_dep(name = "rules_python", version = "1.8.3")
bazel_dep(name = "ureg")
bazel_dep(name = "caliptra_deps", version = "0.0.0")
local_path_override(
    module_name = "caliptra_deps",
    path = "third_party/caliptra",
)

git_override(
    module_name = "pigweed",
    commit = "01465b97384a68fa698392ca5ed15c678738aab6",  # roll:pigweed
    patch_args = ["-p1"],
    patches = [
        # Allow integration_tests to build for armv7-m / armv7e-m so the
        # AST10x0 unittest_runner can use it.
        "//third_party/pigweed:integration_tests_armv7m.patch",
        # Stage .bin alongside .elf in system_image_test runfiles.
        "//third_party/pigweed:system_image_test_bin_runfiles.patch",
        # Fix syscall_defs/syscall_user being gated on userspace_build_enabled,
        # which breaks userspace=False kernel builds (pigweed regression).
        "//third_party/pigweed:syscall_no_userspace_constraint.patch",
        # Enhance no_panics infrastructure.  Remove after pwrev/426052.
        "//third_party/pigweed:userspace_no_panics.patch",
    ],
    remote = "https://pigweed.googlesource.com/pigweed/pigweed",
)

git_override(
    module_name = "ureg",
    commit = "4762ed5eef323a4267720a6b6da287c88738f901",
    remote = "https://github.com/chipsalliance/caliptra-ureg",
)

single_version_override(
    module_name = "toolchains_llvm",
    patch_strip = 1,
    patches = [
        # Relaxes the llvm extension so it can be used in non-root modules.
        "//third_party/toolchains_llvm:remove_root_check.patch",
    ],
    version = "1.1.2",
)

single_version_override(
    module_name = "rules_rust",
    patch_strip = 1,
    patches = [
        # This patch can be eliminated after opentitan adds `edition` to their rules.
        "//third_party/rules_rust:default_edition.patch",
    ],
    version = "0.70.0",
)

single_version_override(
    module_name = "rules_rust_bindgen",
    patch_strip = 1,
    patches = [
        # Permit libraries without static-lib outputs (e.g. headers only)
        # Supply a default edition to bindgen.
        "//third_party/rules_rust_bindgen:bindgen_static_lib.patch",
    ],
    version = "0.70.0",
)

pw_rust = use_extension("@pigweed//pw_toolchain/rust:extensions.bzl", "pw_rust")
pw_rust.toolchain(cipd_tag = "git_revisions:fe5c95d4ae33ec9d7831921e448e2daf8264ea42,7b074fc9362a4a6a5f172dd8936a22fb25eff96b")
use_repo(pw_rust, "pw_rust_toolchains")

register_toolchains(
    "@pigweed//pw_toolchain/host_clang:host_cc_toolchain_linux",
    "@pigweed//pw_toolchain/host_clang:host_cc_toolchain_macos",
    "@pigweed//pw_toolchain/arm_clang:arm_clang_cc_toolchain_cortex-m4",
    "@pigweed//pw_toolchain/riscv_clang:riscv_clang_cc_toolchain_rv32imc",
    "@pw_rust_toolchains//:all",
)

crate = use_extension("@rules_rust//crate_universe:extension.bzl", "crate")
crate.from_cargo(
    name = "rust_crates",
    cargo_lockfile = "//third_party/crates_io:Cargo.lock",
    manifests = ["//third_party/crates_io:Cargo.toml"],
    # crate_universe's defaults do not include some embedded triples so the
    # triples are listed explicitly.
    supported_platform_triples = [
        # Host platforms
        "aarch64-unknown-linux-gnu",
        "x86_64-unknown-linux-gnu",
        "aarch64-apple-darwin",
        "x86_64-apple-darwin",

        # Target platforms
        "riscv32imc-unknown-none-elf",
        "thumbv7em-none-eabi",
    ],
)
use_repo(
    crate,
    "rust_caliptra_crates",
    "rust_caliptra_crates_host",
    "rust_crates",
    ot_crate_index = "crate_index",
)

pw_rust_crates_ext = use_extension("@pigweed//pw_build:pw_rust_crates_extension.bzl", "pw_rust_crates_extension")

# Ideally, we shouldn't need to override the pigweed `rust_crates` repo as it
# requires the downstream (openprot) repo adding pigweed cargo deps to its own
# Cargo.toml.  This is currently needed to work around a limitation in
# rules_rust and unsupported target triples.
#
# TODO(cfrantz): Remove this override and non-directly  referenced crates
# once pigweed has adopted a version of rules_rust that fixes the limitation.
override_repo(
    pw_rust_crates_ext,
    rust_crates = "rust_crates",
)

bazel_dep(name = "opentitan_devbundle")
archive_override(
    module_name = "opentitan_devbundle",
    integrity = "sha256-LGKvET6WY+P4kwrZMSnkBrkqxS1f/ES/rmkPBQmfnwg=",
    url = "https://github.com/lowRISC/opentitan/releases/download/devbundle-2026-06-02-1/devbundle.tar.xz",
)

bazel_dep(name = "lowrisc_opentitan")
git_override(
    module_name = "lowrisc_opentitan",
    # Temporarily pointed to my fork until we upstream the needed changes.
    remote = "https://github.com/cfrantz/opentitan",
    tag = "opentitanlib-downstream-v1",
)

# Caliptra source repositories — declared via a module_extension in
# third_party/caliptra/extensions.bzl so the git_repository commits
# can be driven by versions.bzl at BUILD load time. bzlmod forbids
# `load()` in MODULE.bazel files directly, but allows it in .bzl
# files that back module extensions — that is how CALIPTRA_VERSIONS
# gets threaded from versions.bzl to the git_repository commits
# here.
#
# A previous attempt to move these declarations via `use_repo_rule`
# from the nested caliptra_deps module rolled back (Task 1.1 of
# cargo_universe.md) because the repos ended up in the nested
# module's namespace, invisible to the overlay BUILD files at
# //third_party/caliptra/caliptra-*:overlay.BUILD. The module
# extension pattern sidesteps that trap: `use_repo` below lifts the
# extension's repos into the root module's namespace, so every
# downstream target sees @caliptra_sw / @caliptra_mcu_sw exactly as
# they did when the declarations were inline.
caliptra_repos_ext = use_extension(
    "//third_party/caliptra:extensions.bzl",
    "caliptra_repos",
)
use_repo(caliptra_repos_ext, "caliptra_mcu_sw", "caliptra_sw")

nonhermetic_repo = use_repo_rule("//target/earlgrey/tooling/signing:nonhermetic.bzl", "nonhermetic_repo")

nonhermetic_repo(name = "nonhermetic")

# ── AST1060 Peripheral Access Crate (svd2rust-generated) ──
ast1060_pac_ext = use_extension(
    "//third_party:ast1060_pac.bzl",
    "ast1060_pac_ext",
)
use_repo(ast1060_pac_ext, "ast1060_pac", "vcell")

hsm = use_extension("//third_party/hsm:extensions.bzl", "hsm")
use_repo(hsm, "cloud_kms_hsm")

# ── lowRISC QEMU (ot-earlgrey machine for earlgrey QEMU tests) ──
# Tag v10.2.0-2026-01-15, sha256 9e97f93b... (locked in third_party/qemu/extensions.bzl).
qemu = use_extension("//third_party/qemu:extensions.bzl", "qemu")
use_repo(qemu, "qemu_opentitan", "qemu_opentitan_src")

# ── Python deps for QEMU tooling scripts (cfggen, flashgen) ──
pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
    # AMD's Zscaler proxy intercepts TLS to pypi.org with its own cert; skip
    # transport verification. Package integrity is still enforced via the
    # sha256 hashes in requirements_lock.
    extra_pip_args = [
        "--trusted-host",
        "pypi.org",
        "--trusted-host",
        "files.pythonhosted.org",
    ],
    hub_name = "openprot_python_deps",
    python_version = "3.11",
    requirements_lock = "//third_party/qemu:requirements.txt",
)
use_repo(pip, "openprot_python_deps")

# ── zfmt Event Logging standalone module ──
# This points at cfrantz's personal repo for now.  Plan to move this to a more
# official location or vendor a copy into this repo.
bazel_dep(name = "zfmt", version = "0.1.0")
git_override(
    module_name = "zfmt",
    commit = "20a0140eab308783abea3567e1240f3df8296c9e",
    remote = "https://github.com/cfrantz/zfmt.git",
)