Revert "move the verify-libraries CI check into releng (#5779)"

This reverts commit e0a1184.

.github/buildomat/build-and-test.sh

@@ -76,6 +76,19 @@ export RUSTC_BOOTSTRAP=1
 # We report build progress to stderr, and the "--timings=json" output goes to stdout.
 ptime -m cargo build -Z unstable-options --timings=json --workspace --tests --locked --verbose 1> "$OUTPUT_DIR/crate-build-timings.json"
 
+# If we are running on illumos we want to verify that we are not requiring
+# system libraries outside of specific binaries. If we encounter this situation
+# we bail.
+# NB: `cargo xtask verify-libraries` runs `cargo build --bins` to ensure it can
+# check the final executables.
+if [[ $target_os == "illumos" ]]; then
+    banner verify-libraries
+    # This has a separate timeout from `cargo nextest` since `timeout` expects
+    # to run an external command and therefore we cannot run bash functions or
+    # subshells.
+    ptime -m timeout 10m cargo xtask verify-libraries
+fi
+
 #
 # We apply our own timeout to ensure that we get a normal failure on timeout
 # rather than a buildomat timeout.  See oxidecomputer/buildomat#8.

dev-tools/releng/src/main.rs

@@ -549,18 +549,7 @@ async fn main() -> Result<()> {
     jobs.select("host-image").after("host-profile");
 
     stamp_packages!("tuf-stamp", Target::Host, TUF_PACKAGES)
-        .after("host-stamp")
-        .after("recovery-stamp");
-
-    // Run `cargo xtask verify-libraries --release`. (This was formerly run in
-    // the build-and-test Buildomat job, but this fits better here where we've
-    // already built most of the binaries.)
-    jobs.push_command(
-        "verify-libraries",
-        Command::new(&cargo).args(["xtask", "verify-libraries", "--release"]),
-    )
-    .after("host-package")
-    .after("recovery-package");
+        .after("host-stamp");
 
     for (name, base_url) in [
         ("staging", "https://permslip-staging.corp.oxide.computer"),

dev-tools/xtask/src/main.rs

@@ -53,7 +53,7 @@ enum Cmds {
     /// Verify we are not leaking library bindings outside of intended
     /// crates
     #[cfg(target_os = "illumos")]
-    VerifyLibraries(verify_libraries::Args),
+    VerifyLibraries,
     /// Manage virtual hardware
     #[cfg(target_os = "illumos")]
     VirtualHardware(virtual_hardware::Args),
@@ -93,7 +93,7 @@ async fn main() -> Result<()> {
             external.cargo_args(["--release"]).exec_bin("omicron-releng")
         }
         #[cfg(target_os = "illumos")]
-        Cmds::VerifyLibraries(args) => verify_libraries::run_cmd(args),
+        Cmds::VerifyLibraries => verify_libraries::run_cmd(),
         #[cfg(target_os = "illumos")]
         Cmds::VirtualHardware(args) => virtual_hardware::run_cmd(args),
 

dev-tools/xtask/src/verify_libraries.rs

@@ -5,7 +5,6 @@
 use anyhow::{bail, Context, Result};
 use camino::Utf8Path;
 use cargo_metadata::Message;
-use clap::Parser;
 use fs_err as fs;
 use serde::Deserialize;
 use std::{
@@ -17,13 +16,6 @@ use swrite::{swriteln, SWrite};
 
 use crate::load_workspace;
 
-#[derive(Parser)]
-pub struct Args {
-    /// Build in release mode
-    #[clap(long)]
-    release: bool,
-}
-
 #[derive(Deserialize, Debug)]
 struct LibraryConfig {
     binary_allow_list: Option<BTreeSet<String>>,
@@ -91,29 +83,20 @@ fn verify_executable(
 
     Ok(())
 }
-
-pub fn run_cmd(args: Args) -> Result<()> {
+pub fn run_cmd() -> Result<()> {
     let metadata = load_workspace()?;
     let mut config_path = metadata.workspace_root;
     config_path.push(".cargo/xtask.toml");
     let config = read_xtask_toml(&config_path)?;
 
     let cargo = std::env::var("CARGO").unwrap_or_else(|_| "cargo".to_string());
-    let mut command = Command::new(cargo);
-    command.args([
-        "build",
-        "--bins",
-        "--message-format=json-render-diagnostics",
-    ]);
-    if args.release {
-        command.arg("--release");
-    }
-    let mut child = command
+    let mut command = Command::new(cargo)
+        .args(["build", "--bins", "--message-format=json-render-diagnostics"])
         .stdout(Stdio::piped())
         .spawn()
         .context("failed to spawn cargo build")?;
 
-    let reader = BufReader::new(child.stdout.take().context("take stdout")?);
+    let reader = BufReader::new(command.stdout.take().context("take stdout")?);
 
     let mut errors = Default::default();
     for message in cargo_metadata::Message::parse_stream(reader) {
@@ -125,7 +108,7 @@ pub fn run_cmd(args: Args) -> Result<()> {
         }
     }
 
-    let status = child.wait()?;
+    let status = command.wait()?;
     if !status.success() {
         bail!("Failed to execute cargo build successfully {}", status);
     }