Replace codespell with typos (#7265)

Replace the python "codespell" tool with the rust "typos" tool.
To accomplish this, add a new rust-based step to the boulder-tools
docker build process, with some complexity to handle builds on
multiple developer architectures.

Co-authored-by: Viktor Szépe <viktor@szepe.net>

.codespell.ignore.txt

@@ -1,14 +0,0 @@
-dur
-hist
-iff
-inflight
-keypair
-ot
-ro
-strat
-te
-uint
-vas
-ede
-vai
-nowns

.github/workflows/boulder-ci.yml

@@ -36,8 +36,8 @@ jobs:
       matrix:
         # Add additional docker image tags here and all tests will be run with the additional image.
         BOULDER_TOOLS_TAG:
-          - go1.21.5_2023-12-11
-          - go1.22rc1_2023-12-20
+          - go1.21.5_2024-01-17
+          - go1.22rc1_2024-01-17
         # Tests command definitions. Use the entire "docker compose" command you want to run.
         tests:
           # Run ./test.sh --help for a description of each of the flags.

.typos.toml

@@ -0,0 +1,39 @@
+[files]
+extend-exclude = [
+    ".git/",
+    "go.mod",
+    "go.sum",
+    "vendor/",
+]
+ignore-hidden = false
+
+[default]
+extend-ignore-re = [
+    # PEM
+    "\\b[+/0-9=A-Za-z]{64}\\b",
+    ' := `\{"[0-9A-Z_a-z-]{36,}"\}`',
+    '"(csr|d|dp|n|protected|qi|signature|y)": ?"[0-9=A-Z_a-z-]{36,}"',
+    'bigIntFromB64\("[0-9=A-Z_a-z-]{36,}"\)',
+    "0002a4ba3cf408927759",
+    "65CuDAA",
+    '"sql_warnings", "TrUe"',
+    '"tx_read_only", "FalSe"',
+    "evenMOREcaps",
+    '"iSsUe"',
+]
+
+[default.extend-words]
+# Extended DNS Error
+"ede" = "ede"
+# Alternative spelling
+"unmarshaling" = "unmarshaling"
+
+[default.extend-identifiers]
+"caaFailer" = "caaFailer"
+"challStrat" = "challStrat"
+"ExpectedStratType" = "ExpectedStratType"
+"otConf" = "otConf"
+"serInt" = "serInt"
+"StratName" = "StratName"
+"UPDATEs" = "UPDATEs"
+"vai" = "vai"

test.sh

@@ -216,12 +216,9 @@ if [[ "${RUN[@]}" =~ "$STAGE" ]] ; then
     # Implicitly loads staticcheck.conf from the root of the boulder repository
     staticcheck ./...
     python3 test/grafana/lint.py
-    # Check for common spelling errors using codespell.
-    # Update .codespell.ignore.txt if you find false positives (NOTE: ignored
-    # words should be all lowercase).
-    run_and_expect_silence codespell \
-      --ignore-words=.codespell.ignore.txt \
-      --skip=.git,.gocache,go.sum,go.mod,vendor,bin,*.pyc,*.pem,*.der,*.resp,*.req,*.csr,.codespell.ignore.txt,.*.swp
+    # Check for common spelling errors using typos.
+    # Update .typos.toml if you find false positives
+    run_and_expect_silence typos
     # Check test JSON configs are formatted consistently
     ./test/format-configs.py 'test/config*/*.json'
     run_and_expect_silence git diff --exit-code .

test/boulder-tools/Dockerfile

@@ -16,6 +16,20 @@ RUN go install github.com/letsencrypt/pebble/v2/cmd/pebble-challtestsrv@66511d8
 RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.53.3
 RUN go install honnef.co/go/tools/cmd/staticcheck@2023.1.5
 
+FROM rust:bullseye as rustdeps
+# Provided automatically by docker buildx.
+ARG TARGETPLATFORM
+ARG BUILDPLATFORM
+ENV TARGETPLATFORM=${TARGETPLATFORM:-$BUILDPLATFORM}
+COPY build-rust-deps.sh /tmp/build-rust-deps.sh
+RUN /tmp/build-rust-deps.sh
+
+# When the version of Ubuntu (focal, jammy, etc) changes, ensure that the
+# version of libc6 is compatible with the rustdeps container above. See
+# https://github.com/letsencrypt/boulder/pull/7248#issuecomment-1896612920 for
+# more information. 
+#
+# Run this command in each container: dpkg -l libc6
 FROM buildpack-deps:focal-scm
 COPY requirements.txt /tmp/requirements.txt
 COPY boulder.rsyslog.conf /etc/rsyslog.d/
@@ -28,5 +42,6 @@ RUN sed -i '/$RepeatedMsgReduction on/s/^/#/' /etc/rsyslog.conf
 
 COPY --from=godeps /usr/local/bin/* /usr/local/bin/
 COPY --from=godeps /usr/local/go/ /usr/local/go/
+COPY --from=rustdeps /usr/local/cargo/bin/typos /usr/local/bin/typos
 
 ENV PATH /usr/local/go/bin:/usr/local/protoc/bin:$PATH

test/boulder-tools/build-rust-deps.sh

@@ -0,0 +1,9 @@
+#!/bin/bash -ex
+
+PROTO_ARCH=x86_64
+if [ "${TARGETPLATFORM}" = linux/arm64 ]; then
+  # For our Mac using friends on Apple Silicon and other 64bit ARM chips.
+  PROTO_ARCH=aarch64
+fi
+
+cargo install typos-cli --target "${PROTO_ARCH}-unknown-linux-gnu"

test/boulder-tools/requirements.txt

@@ -2,4 +2,3 @@ acme>=2.0
 cryptography>=0.7
 PyOpenSSL
 requests
-codespell==2.2.5