cli/manifest/rocks: luarocks adapter over lib/luarocks

Add cli/manifest/rocks, the single point in tt that knows about
lib/luarocks. It builds a luarocks.Config from the tt environment, hands
out a client factory, and wraps the primitives the resolver, build and
registry layers compose. Policy (lock building, namespace layout, CLI
surface) stays with the callers; the adapter returns primitives.

* BuildConfig maps a TarantoolInfo (executable, prefix, version) plus
  tree/working-dir to luarocks.Config, defaulting servers to
  rocks.tarantool.org then luarocks.org and marking rocks.tarantool.org
  insecure (AS2: upstream luarocks distrusts its certificate).
* Ordered multi-server resolve (first-found-wins): query servers in
  order, first with the rock wins; a dependency's registry field pins a
  single server. The ordered index satisfies luarocks.RemoteIndex so the
  resolver (PR4) can consume it directly. Generic rocks from luarocks.org
  go through the same fetch/build path as Tarantool rocks.
* Checksum extracts source.md5 as "md5:<hex>"; absent md5 returns
  ("", false) so the caller fixes the fallback (content-hash or empty).
* Metadata fetches+evals a rock's rockspec; FetchSource fetches the
  upstream source honoring source.tag/branch.
* Search/Download wrap the facade on BackendLua (the native backend does
  not implement them) so callers need not know the backend.
* Flags re-exports build.DeriveFlags bound to the config: one source of
  per-OS cc flags for both the rock builtin backend and the manifest
  c / lua-c component backends.

Extend the strict cli/manifest .golangci.yml depguard allowlist with
github.com/tarantool/tt/lib/luarocks. Tests drive resolve against fake
manifest-index servers (httptest) and cover config build, md5 extraction
and the per-OS cc flags.

Part of TNTP-8230

Author: bigbes

.golangci.yml

@@ -90,6 +90,7 @@ linters:
           allow:
             - $gostd
             - "github.com/pelletier/go-toml/v2"
+            - "github.com/tarantool/tt/lib/luarocks"
         test:
           files:
             - "$test"
@@ -98,3 +99,4 @@ linters:
             - "github.com/pelletier/go-toml/v2"
             - "github.com/stretchr/testify"
             - "github.com/tarantool/tt/cli/manifest"
+            - "github.com/tarantool/tt/lib/luarocks"

cli/manifest/rocks/config.go

@@ -0,0 +1,103 @@
+package rocks
+
+import (
+	"fmt"
+	"log/slog"
+	"net/url"
+	"path/filepath"
+
+	luarocks "github.com/tarantool/tt/lib/luarocks"
+	"github.com/tarantool/tt/lib/luarocks/client"
+)
+
+// TarantoolInfo carries the Tarantool facts the adapter needs to build a
+// luarocks.Config. The caller fills it from cmdcontext (the resolved binary
+// path and cached version) and the install prefix (tt's GetTarantoolPrefix);
+// tests fill it directly. The library never parses `tarantool --version`
+// itself, so these come from one source of truth on the tt side.
+type TarantoolInfo struct {
+	// Executable is the path to the tarantool binary.
+	Executable string
+	// Prefix is the Tarantool install prefix, e.g. "/usr".
+	Prefix string
+	// Version is the "x.y.z" string used in diagnostic / golden headers.
+	Version string
+}
+
+// IncludeDir returns the Tarantool C-header directory under the prefix
+// (<prefix>/include/tarantool), where the builtin/c backends find the headers.
+func (info TarantoolInfo) IncludeDir() string {
+	return filepath.Join(info.Prefix, "include", "tarantool")
+}
+
+// ConfigOptions tune BuildConfig beyond the Tarantool facts.
+type ConfigOptions struct {
+	// Tree is the rocks tree root to read from and install into (e.g.
+	// <app>/.rocks). Required.
+	Tree string
+	// WorkingDir is the base directory for relative paths and build staging.
+	// Required; the library never reads the process cwd.
+	WorkingDir string
+	// Servers is the ordered rock-server list; nil falls back to
+	// DefaultServers().
+	Servers []string
+	// Logger receives structured operation logs; nil disables logging.
+	Logger *slog.Logger
+}
+
+// BuildConfig maps the tt environment to a luarocks.Config. Servers default to
+// DefaultServers(); rocks.tarantool.org is marked insecure whenever it is in
+// the list (AS2: upstream luarocks distrusts its certificate).
+func BuildConfig(info TarantoolInfo, opts ConfigOptions) luarocks.Config {
+	servers := opts.Servers
+	if servers == nil {
+		servers = DefaultServers()
+	}
+
+	return luarocks.Config{
+		Tree:            opts.Tree,
+		WorkingDir:      opts.WorkingDir,
+		Servers:         servers,
+		InsecureServers: insecureHosts(servers),
+		Logger:          opts.Logger,
+		Rockspec:        luarocks.RockspecConfig{Env: nil},
+		Tarantool: luarocks.TarantoolConfig{
+			Executable: info.Executable,
+			Prefix:     info.Prefix,
+			IncludeDir: info.IncludeDir(),
+			Version:    info.Version,
+		},
+	}
+}
+
+// Client builds a go-luarocks client for the bound config. backend selects the
+// engine: pass client.BackendLua for operations the native backend does not
+// implement (search/download), client.BackendNative otherwise.
+func (a *Adapter) Client(backend client.Backend) (*client.Rocks, error) {
+	rocksClient, err := client.New(a.cfg, client.WithBackend(backend))
+	if err != nil {
+		return nil, fmt.Errorf("rocks: new client: %w", err)
+	}
+
+	return rocksClient, nil
+}
+
+// insecureHosts returns the subset of server hosts whose TLS certificate
+// go-luarocks should not verify. Only rocks.tarantool.org qualifies today;
+// unparseable entries are skipped.
+func insecureHosts(servers []string) []string {
+	var hosts []string
+
+	for _, server := range servers {
+		parsed, err := url.Parse(server)
+		if err != nil {
+			continue
+		}
+
+		if parsed.Host == insecureHost {
+			hosts = append(hosts, parsed.Host)
+		}
+	}
+
+	return hosts
+}

cli/manifest/rocks/config_test.go

@@ -0,0 +1,163 @@
+package rocks_test
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/tarantool/tt/cli/manifest/rocks"
+	luarocks "github.com/tarantool/tt/lib/luarocks"
+	"github.com/tarantool/tt/lib/luarocks/build"
+	"github.com/tarantool/tt/lib/luarocks/client"
+	"github.com/tarantool/tt/lib/luarocks/rockspec"
+)
+
+// sampleTarantool is the Tarantool info the config tests build a config from.
+func sampleTarantool() rocks.TarantoolInfo {
+	return rocks.TarantoolInfo{
+		Executable: "/opt/tt/bin/tarantool",
+		Prefix:     "/opt/tt",
+		Version:    "3.1.0",
+	}
+}
+
+func TestDefaultServers(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, []string{rocks.ServerTarantool, rocks.ServerLuaRocks}, rocks.DefaultServers())
+}
+
+func TestBuildConfigDefaults(t *testing.T) {
+	t.Parallel()
+
+	cfg := rocks.BuildConfig(sampleTarantool(), rocks.ConfigOptions{
+		Tree:       "/app/.rocks",
+		WorkingDir: "/app",
+		Servers:    nil,
+		Logger:     nil,
+	})
+
+	assert.Equal(t, "/app/.rocks", cfg.Tree)
+	assert.Equal(t, "/app", cfg.WorkingDir)
+	assert.Equal(t, rocks.DefaultServers(), cfg.Servers)
+	// rocks.tarantool.org is in the default list, so it must be marked insecure.
+	assert.Equal(t, []string{"rocks.tarantool.org"}, cfg.InsecureServers)
+
+	assert.Equal(t, "/opt/tt/bin/tarantool", cfg.Tarantool.Executable)
+	assert.Equal(t, "/opt/tt", cfg.Tarantool.Prefix)
+	assert.Equal(t, "3.1.0", cfg.Tarantool.Version)
+	assert.Equal(t, "/opt/tt/include/tarantool", cfg.Tarantool.IncludeDir)
+}
+
+func TestBuildConfigCustomServersNoInsecure(t *testing.T) {
+	t.Parallel()
+
+	servers := []string{"http://127.0.0.1:8080/", "https://luarocks.org/"}
+	cfg := rocks.BuildConfig(sampleTarantool(), rocks.ConfigOptions{
+		Tree:       "/app/.rocks",
+		WorkingDir: "/app",
+		Servers:    servers,
+		Logger:     nil,
+	})
+
+	assert.Equal(t, servers, cfg.Servers)
+	// No rocks.tarantool.org among the servers, so none are marked insecure.
+	assert.Empty(t, cfg.InsecureServers)
+}
+
+func TestClientBackends(t *testing.T) {
+	t.Parallel()
+
+	adapter := rocks.New(rocks.BuildConfig(sampleTarantool(), rocks.ConfigOptions{
+		Tree:       "/app/.rocks",
+		WorkingDir: "/app",
+		Servers:    nil,
+		Logger:     nil,
+	}))
+
+	for _, backend := range []client.Backend{client.BackendNative, client.BackendLua} {
+		rocksClient, err := adapter.Client(backend)
+		require.NoError(t, err)
+		assert.NotNil(t, rocksClient)
+	}
+}
+
+func TestFlagsMatchDeriveFlags(t *testing.T) {
+	t.Parallel()
+
+	cfg := rocks.BuildConfig(sampleTarantool(), rocks.ConfigOptions{
+		Tree:       "/app/.rocks",
+		WorkingDir: "/app",
+		Servers:    nil,
+		Logger:     nil,
+	})
+	adapter := rocks.New(cfg)
+
+	flags := adapter.Flags()
+
+	// One source of flags: the adapter must return exactly what the library
+	// derives for the same config.
+	assert.Equal(t, build.DeriveFlags(cfg), flags)
+
+	// Host-independent invariants.
+	assert.Contains(t, flags.CFLAGS, "-fPIC")
+	assert.Contains(t, flags.CFLAGS, "-I/opt/tt/include/tarantool")
+	assert.Equal(t, ".so", flags.Ext)
+	assert.NotEmpty(t, flags.LIBFLAG)
+
+	// Per-OS shared-link flag.
+	switch runtime.GOOS {
+	case "darwin":
+		assert.Equal(t,
+			[]string{"-bundle", "-undefined", "dynamic_lookup", "-all_load"}, flags.LIBFLAG)
+	default:
+		assert.Equal(t, []string{"-shared"}, flags.LIBFLAG)
+	}
+}
+
+func TestChecksum(t *testing.T) {
+	t.Parallel()
+
+	const md5 = "d41d8cd98f00b204e9800998ecf8427e"
+
+	withMD5 := evalRockspec(t, `package = "x"
+version = "1.0-1"
+source = { url = "https://example.com/x-1.0.tar.gz", md5 = "`+md5+`" }
+`)
+
+	got, ok := rocks.Checksum(withMD5)
+	assert.True(t, ok)
+	assert.Equal(t, "md5:"+md5, got)
+
+	withoutMD5 := evalRockspec(t, `package = "x"
+version = "1.0-1"
+source = { url = "https://example.com/x-1.0.tar.gz" }
+`)
+
+	got, ok = rocks.Checksum(withoutMD5)
+	assert.False(t, ok)
+	assert.Empty(t, got)
+
+	// A nil spec carries no checksum.
+	got, ok = rocks.Checksum(nil)
+	assert.False(t, ok)
+	assert.Empty(t, got)
+}
+
+// evalRockspec writes body to a temp .rockspec and evaluates it into a typed
+// rockspec, failing the test on error.
+func evalRockspec(t *testing.T, body string) *luarocks.Rockspec {
+	t.Helper()
+
+	path := filepath.Join(t.TempDir(), "x-1.0-1.rockspec")
+	require.NoError(t, os.WriteFile(path, []byte(body), 0o600))
+
+	spec, err := rockspec.Eval(path, luarocks.RockspecConfig{Env: nil})
+	require.NoError(t, err)
+
+	return spec
+}