feat: remove vendored aws-lambda-cpp dependency

Author: maxday

aws-lambda-java-runtime-interface-client/.gitignore

@@ -1,2 +1,5 @@
 compile-flags.txt
 ric-dev-environment/codeartifact-properties.mk
+
+# aws-lambda-cpp prebuilt lib + headers, fetched and staged at build time
+src/main/jni/deps/aws-lambda-cpp/

aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.glibc

@@ -7,7 +7,6 @@ ARG AWS_REGION
 RUN if [ -n "${AWS_REGION}" ]; then echo "${AWS_REGION}" > /etc/yum/vars/awsregion; fi
 
 RUN yum install -y \
-        cmake3 \
         tar \
         gzip \
         make \
@@ -33,18 +32,12 @@ RUN ./configure \
     make && \
     make install
 
-# Install aws-lambda-cpp dependency
-ADD ./deps/aws-lambda-cpp-* /src/deps/aws-lambda-cpp
-RUN mkdir -p /src/deps/aws-lambda-cpp/build
-WORKDIR /src/deps/aws-lambda-cpp/build
-RUN cmake3 .. \
-        -DENABLE_LTO=OFF \
-        -DCMAKE_CXX_FLAGS="-fPIC -DBACKWARD_SYSTEM_UNKNOWN" \
-        -DCMAKE_CXX_STANDARD=11 \
-        -DCMAKE_INSTALL_PREFIX=$(pwd)/../../artifacts \
-        -DCMAKE_MODULE_PATH=$(pwd)/../../artifacts/lib/pkgconfig && \
-    make && \
-    make install
+# Install prebuilt aws-lambda-cpp dependency. The static library and headers
+# were fetched and GPG-verified on the host by build-jni-lib.sh; here we only
+# COPY them into the artifacts tree the native client links against (the build
+# container never reaches the network).
+COPY ./deps/aws-lambda-cpp/include /src/deps/artifacts/include
+COPY ./deps/aws-lambda-cpp/lib/libaws-lambda-runtime.a /src/deps/artifacts/lib/
 
 # Build native client
 ADD *.cpp *.h /src/

aws-lambda-java-runtime-interface-client/src/main/jni/Dockerfile.musl

@@ -6,7 +6,6 @@ ARG CURL_VERSION
 RUN apk update && \
     apk add \
         openjdk11 \
-        cmake \
         file \
         g++ \
         gcc \
@@ -31,17 +30,8 @@ RUN ./configure \
     make && \
     make install
 
-# Install aws-lambda-cpp dependency
-ADD ./deps/aws-lambda-cpp-* /src/deps/aws-lambda-cpp
-RUN mkdir -p /src/deps/aws-lambda-cpp/build
-WORKDIR /src/deps/aws-lambda-cpp/build
-RUN cmake .. \
-        -DCMAKE_CXX_FLAGS="-fPIC -DBACKWARD_SYSTEM_UNKNOWN" \
-        -DCMAKE_CXX_STANDARD=11 \
-        -DCMAKE_INSTALL_PREFIX=$(pwd)/../../artifacts\
-        -DCMAKE_MODULE_PATH=$(pwd)/../../artifacts/lib/pkgconfig && \
-    make && \
-    make install
+COPY ./deps/aws-lambda-cpp/include /src/deps/artifacts/include
+COPY ./deps/aws-lambda-cpp/lib/libaws-lambda-runtime.a /src/deps/artifacts/lib/
 
 # Build native client
 ADD *.cpp *.h /src/

aws-lambda-java-runtime-interface-client/src/main/jni/build-jni-lib.sh

@@ -9,12 +9,68 @@ MULTI_ARCH=${2}
 BUILD_OS=${3}
 BUILD_ARCH=${4}
 CURL_VERSION=7.83.1
-# Registry hosting the base images. Defaults to public.ecr.aws for local and
-# GitHub-hosted builds; the release workflow overrides it with the ECR
-# pull-through cache so egress-locked runners don't hit public.ecr.aws.
+
 BASE_REGISTRY="${BASE_REGISTRY:-public.ecr.aws}"
 AWS_REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-}}"
 
+# aws-lambda-cpp is consumed as the prebuilt static library published on the
+# upstream GitHub release rather than being compiled from a vendored source
+# tree. We fetch and GPG-verify it
+ALC_VERSION="1.0.1"
+ALC_TAG="v${ALC_VERSION}"
+ALC_REPO_URL="https://github.com/awslabs/aws-lambda-cpp"
+ALC_RELEASE_URL="${ALC_REPO_URL}/releases/download/${ALC_TAG}"
+ALC_SIGNING_KEY_URL="https://raw.githubusercontent.com/awslabs/aws-lambda-cpp/${ALC_TAG}/signing-public-key.asc"
+ALC_STAGE_DIR="${SRC_DIR}/deps/aws-lambda-cpp"
+
+function fetch_aws_lambda_cpp() {
+  arch=$1
+
+  release_arch="${arch/aarch_64/aarch64}"
+
+  if [ -f "${ALC_STAGE_DIR}/.staged-arch" ] && \
+     [ "$(cat "${ALC_STAGE_DIR}/.staged-arch")" == "${release_arch}" ]; then
+    echo "aws-lambda-cpp ${ALC_VERSION} (${release_arch}) already staged, skipping fetch"
+    return
+  fi
+
+  echo "Fetching prebuilt aws-lambda-cpp ${ALC_VERSION} for ${release_arch}"
+  rm -rf "${ALC_STAGE_DIR}"
+  mkdir -p "${ALC_STAGE_DIR}/lib" "${ALC_STAGE_DIR}/include"
+
+  local workdir
+  workdir=$(mktemp -d)
+  local lib_asset="libaws-lambda-runtime-${release_arch}.a"
+
+  curl -fsSL -o "${workdir}/${lib_asset}"     "${ALC_RELEASE_URL}/${lib_asset}"
+  curl -fsSL -o "${workdir}/${lib_asset}.asc" "${ALC_RELEASE_URL}/${lib_asset}.asc"
+  curl -fsSL -o "${workdir}/SHA256SUMS"       "${ALC_RELEASE_URL}/SHA256SUMS"
+  curl -fsSL -o "${workdir}/SHA256SUMS.asc"   "${ALC_RELEASE_URL}/SHA256SUMS.asc"
+  curl -fsSL -o "${workdir}/signing-key.asc"  "${ALC_SIGNING_KEY_URL}"
+
+  local gnupg_home
+  gnupg_home=$(mktemp -d)
+  chmod 700 "${gnupg_home}"
+  GNUPGHOME="${gnupg_home}" gpg --batch --import "${workdir}/signing-key.asc"
+  GNUPGHOME="${gnupg_home}" gpg --batch --verify "${workdir}/${lib_asset}.asc" "${workdir}/${lib_asset}"
+  GNUPGHOME="${gnupg_home}" gpg --batch --verify "${workdir}/SHA256SUMS.asc"   "${workdir}/SHA256SUMS"
+  rm -rf "${gnupg_home}"
+
+  # Cross-check the checksum too (defence in depth; SHA256SUMS is itself signed).
+  ( cd "${workdir}" && grep "${lib_asset}\$" SHA256SUMS | sha256sum -c - )
+
+  cp "${workdir}/${lib_asset}" "${ALC_STAGE_DIR}/lib/libaws-lambda-runtime.a"
+
+  # Headers aren't a release asset, so take them from the source at the same
+  # tag. They are declarations only -- every symbol lives in the prebuilt lib.
+  curl -fsSL -o "${workdir}/src.tar.gz" "${ALC_REPO_URL}/archive/refs/tags/${ALC_TAG}.tar.gz"
+  tar -xzf "${workdir}/src.tar.gz" -C "${workdir}" "aws-lambda-cpp-${ALC_VERSION}/include"
+  cp -R "${workdir}/aws-lambda-cpp-${ALC_VERSION}/include/." "${ALC_STAGE_DIR}/include/"
+
+  echo "${release_arch}" > "${ALC_STAGE_DIR}/.staged-arch"
+  rm -rf "${workdir}"
+}
+
 function get_docker_platform() {
   arch=$1
 
@@ -44,6 +100,8 @@ function build_for_libc_arch() {
   arch=$2
   artifact=$3
 
+  fetch_aws_lambda_cpp "${arch}"
+
   docker_platform=$(get_docker_platform ${arch})
 
   echo "Compiling the native library with libc implementation \`${libc_impl}\` on architecture \`${arch}\` using Docker platform \`${docker_platform}\`"