Add an update script to automate Bazel binary updates. am: 09bfc722 am: f0e345e8

Original change: https://android-review.googlesource.com/c/platform/prebuilts/bazel/linux-x86_64/+/1622719

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I7bae5039a8a7e0c6509e322249b99ab5411bb4d5

README.md

+# Updating the Bazel prebuilts in AOSP
+
+## Instructions
+
+First, decide which version of Bazel you need.
+
+*   A Bazel release (e.g. Bazel 3.7.0)
+*   A Bazel nightly
+*   A Bazel per-commit build
+
+Whichever of these you use, you will need to use official **nojdk x86-64**
+versions of Bazel, for Linux and macOS (Darwin).
+
+Run the `update.sh` script in the Linux prebuilts repository to download the
+and verify the binaries from the trusted Bazel CI pipeline:
+
+`./update.sh <commit>`
+
+To get the commit hash for builds, see the [Bazel releases], [Bazel nightlies]
+or [Bazel per-commit builds] sections below.
+
+`update.sh` will also verify that the downloaded binary has the correct SHA-256
+checksum as provided from Bazel CI metadata.
+
+Once you have the binaries, you will need to create and send two CLs,
+to update the Linux and macOS prebuilts that live in separate Git repositories
+i.e.
+
+*   https://android.googlesource.com/platform/prebuilts/bazel/linux-x86_64/
+*   https://android.googlesource.com/platform/prebuilts/bazel/darwin-x86_64/
+
+The update script does not automatically create CLs, so you need to create them
+manually. In the two CLs descriptions, mention the testing you did, which should
+at least include:
+
+*   For release builds only: **Verifying the file signature**, e.g.
+    *   `gpg --import bazel-release.pub.gpg`
+        *   Taken from https://bazel.build/bazel-release.pub.gpg
+    *   `gpg --verify bazel_nojdk-<commit>-linux-x86_64.sig`
+        *   It should say "Good signature from Bazel Developer ..."
+*   **Verifying that Bazel starts, on Linux and on macOS**, e.g.
+    *   `source build/envsetup.sh`
+    *   `bazel info`
+*   **Verifying basic user journeys succeed.**
+    * `build/bazel/scripts/milestone-2/demo.sh full`
+    * `build/bazel/scripts/milestone-2/demo.sh generate && build/bazel/scripts/milestone-2/demo.sh sync && USE_BAZEL=1 USE_BAZEL_ANALYSIS=1 m libc`
+
+Ensure that the Linux and Darwin CLs are set to the same Gerrit topic so they
+are submitted together.
+
+## Obtaining Bazel binaries
+
+The `update.sh` script automates downloading Bazel binaries. The next sections
+describe how the different Bazel binaries (release, nightly, per-commit) can be
+manually downloaded from the Bazel CI.
+
+### Bazel releases
+
+The commit hash for linux and darwin **nojdk x86-64** binaries are available from https://github.com/bazelbuild/bazel/releases
+
+### Bazel nightlies
+
+The commit hash and urls for linux and macOS **nojdk x86-64** binaries are available in https://storage.googleapis.com/bazel-builds/metadata/latest.json
+
+### Bazel per-commit builds
+
+You need to know the GitHub commit that contains your change, e.g.
+https://github.com/bazelbuild/bazel/commit/364a867df255c57c8edc4a8aae8f78cb54900a54
+
+And the linux and macOS **nojdk x86-64** binaries are available from:
+
+*   `https://storage.googleapis.com/bazel-builds/metadata/<commit>.json`
+    *   e.g. https://storage.googleapis.com/bazel-builds/metadata/364a867df255c57c8edc4a8aae8f78cb54900a54.json

update.sh

+#!/bin/bash
+# Updater script for bazel prebuilt binaries in AOSP.
+#
+# This script handles both linux and darwin binaries in a single invocation. See
+# README.md for more details.
+#
+# Usage: update.sh <commit>
+
+set -euo pipefail
+
+function err() {
+    >&2 echo "$@"
+    exit 1
+}
+
+# Check that the necessary tools are installed.
+function check_prereqs() {
+    if ! [[ "${PWD}" =~ .*/prebuilts/bazel/linux-x86_64$ ]]; then
+        err "Error: Run this script from within the prebuilts/bazel/linux-x86_64 directory."
+    fi
+
+    for cmd in jq curl; do
+        if ! command -v "${cmd}" &> /dev/null; then
+            err "Error: This script requires ${cmd}. Install it and ensure it is on your PATH."
+        fi
+    done
+}
+
+check_prereqs
+commit="$1"; shift
+
+ci_url="https://storage.googleapis.com/bazel-builds/metadata/${commit}.json"
+platforms_json="$(curl -s "${ci_url}" | jq '{ platforms: .platforms }')"
+if [[ $? != 0 ]]; then
+    err "Failed to download or parse ${ci_url}. Exiting."
+fi
+
+darwin_nojdk_url="$(echo "${platforms_json}" | jq --raw-output '.[].macos.nojdk_url')"
+darwin_nojdk_sha256="$(echo "${platforms_json}" | jq --raw-output '.[].macos.nojdk_sha256')"
+
+linux_nojdk_url="$(echo "${platforms_json}" | jq --raw-output '.[].linux.nojdk_url')"
+linux_nojdk_sha256="$(echo "${platforms_json}" | jq --raw-output '.[].linux.nojdk_sha256')"
+
+function download_and_verify() {
+    local os=$1; shift
+    local url=$1; shift
+    local sha256=$1; shift
+
+    echo "Cleaning previous ${os} bazel binary.."
+    rm -f "bazel_nojdk-*-${os}-x86_64"
+
+    echo "Downloading ${os} bazel binary for ${commit}.."
+    downloaded_file="bazel_nojdk-${commit}-${os}-x86_64"
+    curl "${url}" --output "${downloaded_file}"
+    echo "Verifying checksum for ${downloaded_file} to be ${sha256}.."
+    echo "${sha256} ${downloaded_file}" | sha256sum --check --status
+
+    echo "Setting up bazel symlink for ${os}.."
+    rm -f bazel && ln -s "${downloaded_file}" bazel
+    chmod +x "${downloaded_file}"
+}
+
+
+# Update Linux binary.
+download_and_verify "linux" "${linux_nojdk_url}" "${linux_nojdk_sha256}"
+
+(
+    # Update macOS binary.
+    cd "$(dirname "$0")/../darwin-x86_64"
+    download_and_verify "darwin" "${darwin_nojdk_url}" "${darwin_nojdk_sha256}"
+)
+
+echo "Done."