ENT-14099: Replace leech with leech2 dependency

README.md

@@ -146,7 +146,8 @@ File `install-dependencies` and the relevant subdirectories in `deps-packaging`
 | [SASL2](https://www.cyrusimap.org/sasl/)                                          | 2.1.28 | 2.1.28 | 2.1.28 | Solaris Enterprise agent |
 | [zlib](https://www.zlib.net/)                                                     | 1.3.2  | 1.3.2  | 1.3.2  |                          |
 | [librsync](https://github.com/librsync/librsync/releases)                         | -      | 2.3.4  | 2.3.4  |                          |
-| [leech](https://github.com/larsewi/leech/releases)                                | -      | 0.2.0  | 0.2.0  |                          |
+| [leech](https://github.com/larsewi/leech/releases)                                | -      | 0.2.0  | -      |                          |
+| [leech2](https://github.com/larsewi/leech2/releases)                              | -      | -      | 5.0.1  |                          |
 
 
 ### Enterprise Hub dependencies

build-scripts/compile-options

@@ -155,10 +155,10 @@ nova)
     # - Mission Portal uses LDAP for authentication functionality
     var_append DEPS "openldap"
 
-    # leech is used for efficient synchronization of tabular data.
+    # leech2 is used for efficient synchronization of tabular data.
     # - cf-hub requests state changes from cf-serverd
     # - state changes are recorded by cf-agent
-    var_append DEPS "leech"
+    var_append DEPS "leech2"
     ;;
 esac
 

build-scripts/configure

@@ -42,7 +42,7 @@ P=$BUILDPREFIX
 
 ARGS="--prefix=$P --libdir=$P/lib --with-workdir=$P --sysconfdir=/etc --with-openssl=$P --with-pcre2=$P --with-librsync=$P --with-init-script --with-lmdb=$P"
 
-for dep in ldap libxml2 libyaml librsync leech libacl libvirt libcurl; do
+for dep in ldap libxml2 libyaml librsync leech2 libacl libvirt libcurl; do
     case "$DEPS" in
     *"$dep"*)
         var_append ARGS "--with-$dep=$P"

ci/cfengine-build-host-setup.cf

@@ -269,7 +269,7 @@ bundle agent cfengine_build_host_setup
         expression => not(fileexists("/etc/cfengine-in-container.flag")),
         comment => "We use an explicit flag file that we control to avoid ambiguity about whether we are in a container or not.";
 
-    # Rust is build dependency for leech2 (gate on ubuntu>=20, debian>=12, redhat>=8)
+    # Rust is build dependency for leech2 (gate on ubuntu>=20, debian>=12, redhat>=7)
     ubuntu::
       "leech2_build_toolchain_host"
         expression => version_compare("$(sys.os_version_major)", ">=", "20");
@@ -280,7 +280,7 @@ bundle agent cfengine_build_host_setup
 
     (redhat|centos)::
       "leech2_build_toolchain_host"
-        expression => version_compare("$(sys.os_version_major)", ">=", "8");
+        expression => version_compare("$(sys.os_version_major)", ">=", "7");
 
     any::
       "have_rust"

ci/fix-buildhost.sh

@@ -49,14 +49,14 @@ fi
 # not-yet-reimaged hosts (and branches that change these deps) get what they
 # need without a reimage. Each call is guarded by an already-installed check,
 # and gated to the same platforms as the policy (ubuntu>=20, debian>=12,
-# rhel/centos>=8).
+# rhel/centos>=7).
 if [ -f /etc/os-release ]; then
   . /etc/os-release
   os_major="${VERSION_ID%%.*}"
   case "$ID" in
     ubuntu) min_major=20 ;;
     debian) min_major=12 ;;
-    rhel | centos) min_major=8 ;;
+    rhel | centos) min_major=7 ;;
     *) min_major="" ;;
   esac
   if [ -n "$min_major" ] && [ "${os_major:-0}" -ge "$min_major" ]; then

container/Dockerfile.debian

@@ -8,7 +8,7 @@ RUN apt-get update && apt-get install -y \
     autoconf automake binutils bison build-essential curl debhelper \
     dpkg-dev expat fakeroot flex gdb git libexpat1-dev \
     libmodule-load-conditional-perl libpam0g-dev libtool \
-    pkg-config psmisc python3-pip rsync sudo systemd-coredump wget \
+    pkg-config psmisc python3-pip rsync sudo systemd-coredump unzip wget \
     && rm -rf /var/lib/apt/lists/*
 
 # ncurses: ubuntu-20 uses libncurses5/libncurses5-dev, newer use libncurses6/libncurses-dev
@@ -30,6 +30,21 @@ RUN apt-get purge -y \
     libattr1-dev libssl-dev libpcre2-dev libacl1-dev \
     libyaml-dev libxml2-dev librsync-dev 2>/dev/null || true
 
+# Rust toolchain and protobuf compiler for building the cargo-based leech2
+# dependency (mirrors the rust/protoc setup in cfengine-build-host-setup.cf).
+# rustup is installed system-wide under /opt/rust and consumed by
+# deps-packaging/leech2 via RUSTUP_HOME and PATH.
+#
+# protoc: reuse leech2's own pinned installer (single source of truth).
+RUN curl -fsSL https://raw.githubusercontent.com/larsewi/leech2/refs/heads/master/.protoc-version -o /tmp/.protoc-version
+RUN curl -fsSL https://raw.githubusercontent.com/larsewi/leech2/refs/heads/master/.github/scripts/setup-protoc.sh -o /tmp/setup-protoc.sh
+RUN cd /tmp && bash setup-protoc.sh && rm -f /tmp/.protoc-version /tmp/setup-protoc.sh
+
+# Rust toolchain, installed system-wide under /opt/rust.
+RUN curl -fsSL https://sh.rustup.rs | RUSTUP_HOME=/opt/rust CARGO_HOME=/opt/rust sh -s -- -y --no-modify-path --profile minimal --default-toolchain stable
+RUN RUSTUP_HOME=/opt/rust /opt/rust/bin/rustup target add x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-pc-windows-gnu
+RUN chmod -R a+rX /opt/rust
+
 # Create build user with passwordless sudo (needed by install-dependencies, package, etc.)
 RUN useradd -m -s /bin/bash builder \
     && echo "builder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/builder