Add Rust-based rabbitmqadmin-ng and remove Python

[lukebakken]

Fixes #768

The RabbitMQ management images now include the Rust-based rabbitmqadmin-ng CLI tool when possible. The deprecated Python version of rabbitmqadmin will no longer be available.

This change adds a two-stage build to Dockerfile-management.template:

• Download stage: Attempts to download rabbitmqadmin-ng from GitHub release for the target architecture on Ubuntu only.
• Final stage: Copies the Rust binary if download succeeded.

The versions.sh script fetches the latest rabbitmqadmin-ng release tag from the GitHub API and calculates SHA256 checksums and download URLs for the release artifacts for x86_64 and aarch64 architectures into versions.json and templated into the generated management Dockerfiles.

[michaelklishin]

I'd leave the Python version behind entirely. It's no longer maintained.

Plus this tool is entirely optional. The OCI can be used without it.

[michaelklishin]

I would remove rabbitmqadmin v1, or rather, not drag it along.

It is no longer maintained besides truly exceptional issues like security vulnerabilities (which are unlikely to be reported for such a tool).

One of the goals of rabbitmqadmin v2 as a native binary was to avoid numerous [older] Python CVEs that plagued several RabbitMQ images due to the inclusion of rabbitmqadmin v1.

Finally, there are some breaking changes in rabbitmqadmin v2 but the users seem to be adapting to them without any complaints, and rabbitmqadmin v2 is so far ahead in terms of features and test coverage that it feels like shipping two different tools at this point.

rabbitmqadmin v2 is a nice-to-have in this image. If the Rust toolchain does not support a particular platform, well, it won't be available but everything else that this image offers will be.

[michaelklishin]

@yosifkit @tianon this PR should really have a review from one of you folks (or both!)

[tianon]

❤️

Am I reading correctly that where we've ended up here is roughly equivalent to the official released binaries on https://github.com/rabbitmq/rabbitmqadmin-ng/releases/tag/v2.17.0, but I guess also with support for Alpine/musl? 😅

While I do appreciate that you've managed to get this working, I now wonder if we should instead just be downloading those official release binaries, and if Alpine/musl support really is important enough that we need to keep it, we see if Michael would be open to releasing binaries for that platform over there? 🙈

Personally, I think we can make a pretty compelling case that the Alpine variants even exist in the first place primarily for the size consideration, so it's pretty reasonable for them to not include this, but I'd probably couple that with waiting to remove the Python-based version until at least the next patch release if not the next minor/major? 🤔

[lukebakken]

roughly equivalent to the official released binaries

By compiling from source I'd like to think we'd support more architectures than the official binaries. But, if we just want to have Ubuntu x86_64 and aarch64 that makes this PR a lot simpler.

[michaelklishin]

FWIW when I hear arguments for using the Alpine variant, it always comes down to the perceived security aspect. I understand that there is a connection between how much stuff you cram into an image and its attach surface but rabbitmqadmin is the kind of tool that is very unlikely to become a common attack vector.

Either way, this is a nice-to-have and limiting it to the Ubuntu variant with fewer platforms supported is fine with me. The only limiting factor to how many platforms are currently covered by the binary releases of rabbitmqadmin is the availability of aarch64 runners on pubic GitHub Actions out of the box.

[lukebakken]

I'll modify the PR to the following:

• Download the latest version of rabbitmqadmin-ng from GitHub (verifying checksum, of course) on Ubuntu x86_64 and aarch64 builds only.
• Remove it entirely from other architectures and Alpine.

[lukebakken]

@michaelklishin @tianon OK, all set. It's much simpler now 😸

[michaelklishin]

Hooray!