Add Alma 9 rpmbuild + bazel environment for examples (#969)

This provides a consistent starting point for running rpmbuild examples
using a docker container build on Alma 9.

Closes: #968
diff --git a/MODULE.bazel b/MODULE.bazel
index 36e555e..601e36a 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -25,6 +25,15 @@
     dev_dependency = True,
 )
 
+# Find the system Git if one is available.
+find_git = use_extension("//toolchains/git:git_configure.bzl", "experimental_find_system_git_extension", dev_dependency = True)
+use_repo(find_git, "rules_pkg_git")
+
+register_toolchains(
+    "@rules_pkg_git//:all",
+    dev_dependency = True,
+)
+
 local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "local_repository")
 
 local_repository(
diff --git a/WORKSPACE.bzlmod b/WORKSPACE.bzlmod
index 6680fd5..b670788 100644
--- a/WORKSPACE.bzlmod
+++ b/WORKSPACE.bzlmod
@@ -13,16 +13,3 @@
 #    name = "rules_pkg_rpmbuild",
 #    verbose = False,
 #)
-
-# Needed for making our release notes
-load("//toolchains/git:git_configure.bzl", "experimental_find_system_git_bzlmod")
-
-experimental_find_system_git_bzlmod(
-    name = "rules_pkg_git",
-    verbose = False,
-)
-
-register_toolchains(
-    "@rules_pkg_git//:git_auto_toolchain",
-    "//toolchains/git:git_missing_toolchain",
-)
diff --git a/pkg/private/deb/deb.bzl b/pkg/private/deb/deb.bzl
index 53bc2eb..c4b090a 100644
--- a/pkg/private/deb/deb.bzl
+++ b/pkg/private/deb/deb.bzl
@@ -76,6 +76,9 @@
     if ctx.attr.triggers:
         args.append("--triggers=@" + ctx.file.triggers.path)
         files.append(ctx.file.triggers)
+    if ctx.attr.md5sums:
+        args.append("--md5sums=@" + ctx.file.md5sums.path)
+        files.append(ctx.file.md5sums)
 
     # Conffiles can be specified by a file or a string list
     if ctx.attr.conffiles_file:
@@ -276,6 +279,13 @@
             See https://wiki.debian.org/DpkgTriggers.""",
             allow_single_file = True,
         ),
+        "md5sums": attr.label(
+            doc = """A file listing md5 checksums of files in the data archive.
+            This file is optional.
+            See https://manpages.debian.org/bookworm/dpkg-dev/deb-md5sums.5.en.html.
+            """,
+            allow_single_file = True,
+        ),
         "built_using": attr.string(
             doc = """The tool that were used to build this package provided either inline (with built_using) or from a file (with built_using_file).""",
         ),
diff --git a/pkg/private/deb/make_deb.py b/pkg/private/deb/make_deb.py
index 84748c5..c1ce2b8 100644
--- a/pkg/private/deb/make_deb.py
+++ b/pkg/private/deb/make_deb.py
@@ -198,6 +198,7 @@
               config=None,
               templates=None,
               triggers=None,
+              md5sums=None,
               conffiles=None,
               changelog=None,
               **kwargs):
@@ -217,6 +218,8 @@
     extrafiles['templates'] = (templates, 0o644)
   if triggers:
     extrafiles['triggers'] = (triggers, 0o644)
+  if md5sums:
+    extrafiles['md5sums'] = (md5sums, 0o644)
   if conffiles:
     extrafiles['conffiles'] = ('\n'.join(conffiles) + '\n', 0o644)
   if changelog:
@@ -366,6 +369,9 @@
   parser.add_argument(
       '--triggers',
       help='The triggers file (prefix with @ to provide a path).')
+  parser.add_argument(
+      '--md5sums',
+      help='The md5sums file (prefix with @ to provide a path).')
   # see
   # https://www.debian.org/doc/manuals/debian-faq/ch-pkg_basics.en.html#s-conffile
   parser.add_argument(
@@ -387,6 +393,7 @@
       config=helpers.GetFlagValue(options.config, False),
       templates=helpers.GetFlagValue(options.templates, False),
       triggers=helpers.GetFlagValue(options.triggers, False),
+      md5sums=helpers.GetFlagValue(options.md5sums, False),
       conffiles=GetFlagValues(options.conffile),
       changelog=helpers.GetFlagValue(options.changelog, False),
       package=options.package,
diff --git a/tests/deb/BUILD b/tests/deb/BUILD
index 5df0ab2..fa53244 100644
--- a/tests/deb/BUILD
+++ b/tests/deb/BUILD
@@ -33,6 +33,13 @@
     cmd = "for i in $(OUTS); do echo 1 >$$i; done",
 )
 
+genrule(
+    name = "generate_md5sums",
+    srcs = [":generate_files"],
+    outs = ["md5sums"],
+    cmd = "md5sum $(SRCS) | sed 's|$(RULEDIR)/||' > $@",
+)
+
 my_package_naming(
     name = "my_package_variables",
     label = "some_value",
@@ -80,6 +87,7 @@
     distribution = "trusty",
     license = "Apache-2.0",
     maintainer = "soméone@somewhere.com",
+    md5sums = ":generate_md5sums",
     package = "fizzbuzz",
     preinst = "deb_preinst",
     provides = ["hello"],
diff --git a/tests/deb/pkg_deb_test.py b/tests/deb/pkg_deb_test.py
index 8a2e653..8a4e249 100644
--- a/tests/deb/pkg_deb_test.py
+++ b/tests/deb/pkg_deb_test.py
@@ -177,6 +177,7 @@
         {'name': './config', 'mode': 0o755},
         {'name': './control', 'mode': 0o644},
         {'name': './preinst', 'mode': 0o755},
+        {'name': './md5sums', 'mode': 0o644},
         {'name': './templates', 'mode': 0o644},
         {'name': './triggers', 'mode': 0o644},
     ]
diff --git a/toolchains/git/BUILD b/toolchains/git/BUILD
index 7d1596e..8aa80cd 100644
--- a/toolchains/git/BUILD
+++ b/toolchains/git/BUILD
@@ -67,9 +67,3 @@
 git_toolchain(
     name = "no_git",
 )
-
-toolchain(
-    name = "git_missing_toolchain",
-    toolchain = ":no_git",
-    toolchain_type = ":git_toolchain_type",
-)
diff --git a/toolchains/git/BUILD.tpl b/toolchains/git/BUILD.tpl
index f009c1b..5c18a65 100644
--- a/toolchains/git/BUILD.tpl
+++ b/toolchains/git/BUILD.tpl
@@ -14,3 +14,9 @@
     toolchain = ":git_auto",
     toolchain_type = "@rules_pkg//toolchains/git:git_toolchain_type",
 )
+
+toolchain(
+    name = "zzz_git_missing_toolchain",  # keep name lexicographically last
+    toolchain = "@rules_pkg//toolchains/git:no_git",
+    toolchain_type = "@rules_pkg//toolchains/git:git_toolchain_type",
+)
diff --git a/toolchains/git/git_configure.bzl b/toolchains/git/git_configure.bzl
index f537c1a..e6850f6 100644
--- a/toolchains/git/git_configure.bzl
+++ b/toolchains/git/git_configure.bzl
@@ -74,8 +74,7 @@
         workspace_file = Label("//:WORKSPACE")
     _find_system_git(name = name, workspace_file = workspace_file, verbose = verbose)
     native.register_toolchains(
-        "@%s//:git_auto_toolchain" % name,
-        "@rules_pkg//toolchains/git:git_missing_toolchain",
+        "@%s//:all" % name,
     )
 
 # buildifier: disable=function-docstring-args
@@ -93,3 +92,8 @@
     if not workspace_file:
         workspace_file = Label("//:MODULE.bazel")
     _find_system_git(name = name, workspace_file = workspace_file, verbose = verbose)
+
+# For use from MODULE.bzl
+experimental_find_system_git_extension = module_extension(
+    implementation = lambda ctx: _find_system_git(name = "rules_pkg_git", workspace_file = Label("//:MODULE.bazel")),
+)