fix: different _PACKAGES, :packages and :dpkg_status per architecture

There are cases where the packages differ between architectures. E.g.
currently in the `examples/ubuntu_snapshot`, `coreutils` depends on
`libssl3` on `amd64` but there's no such dependency on `arm64`. Thus,
the list of packages and `dpkg_status` has to be different.

This failure wasn't caught because this corner case was only happening
in the Ubuntu example which was still using "the old `dpkg_status`" that
as done by hand, just passing a shorter list of packages and not the
full list of installed packages (as implemented in GoogleContainerTools#115).

If the test is migrated, when running without the fix it fails with:

ERROR: no such package '@@_main~apt~noble//libssl3/arm64': BUILD file not found in directory 'libssl3/arm64' of external repository @@_main~apt~noble. Add a BUILD file to a directory to mark it as a package.
ERROR: /home/nonroot/.cache/bazel/_bazel_nonroot/a08c2e4811c846650b733c6fc815a920/external/_main~apt~noble/libssl3/BUILD.bazel:1:6: no such package '@@_main~apt~noble//libssl3/arm64': BUILD file not found in directory 'libssl3/arm64' of external repository @@_main~apt~noble. Add a BUILD file to a directory to mark it as a package. and referenced by '@@_main~apt~noble//libssl3:libssl3'
ERROR: Analysis of target '//examples/ubuntu_snapshot:_noble_index_json' failed; build aborted: Analysis failed

I've now moved `examples/ubuntu_snapshot` to use the "new"
`dpkg_status`.

I've also added an explicit test to check that libssl3 is installed
in amd64 and another test to check that it's NOT installed in arm64.

apt/private/deb_translate_lock.bzl

@@ -88,19 +88,19 @@ _PACKAGES = {packages}
 # Creates /var/lib/dpkg/status with installed package information.
 dpkg_status(
     name = "dpkg_status",
-    controls = [
-        "//%s:control" % package
-        for package in _PACKAGES
-    ],
+    controls = select({{
+        "//:linux_%s" % arch: ["//%s:control" % package for package in packages]
+        for arch, packages in _PACKAGES.items()
+    }}),
     visibility = ["//visibility:public"],
 )
 
 filegroup(
     name = "packages",
-    srcs = [
-        "//%s" % package
-        for package in _PACKAGES
-    ],
+    srcs = select({{
+        "//:linux_%s" % arch: ["//%s" % package for package in packages]
+        for arch, packages in _PACKAGES.items()
+    }}),
     visibility = ["//visibility:public"],
 )
 
@@ -139,8 +139,8 @@ def _deb_translate_lock_impl(rctx):
             package_defs.append("   pass")
 
     # TODO: rework lockfile to include architecure information
-    architectures = sets.make()
-    packages = sets.make()
+    architectures = {}
+    packages = {}
 
     for (package) in lockf.packages():
         package_key = lockfile.make_package_key(
@@ -149,8 +149,13 @@ def _deb_translate_lock_impl(rctx):
             package["arch"],
         )
 
-        sets.insert(architectures, package["arch"])
-        sets.insert(packages, package["name"])
+        if package["arch"] not in architectures:
+            architectures[package["arch"]] = []
+        architectures[package["arch"]].append(package["name"])
+
+        if package["name"] not in packages:
+            packages[package["name"]] = []
+        packages[package["name"]].append(package["arch"])
 
         if not lock_content:
             package_defs.append(
@@ -182,27 +187,27 @@ def _deb_translate_lock_impl(rctx):
         )
 
     # TODO: rework lockfile to include architecure information and merge these two loops
-    for (package) in lockf.packages():
+    for package_name, package_archs in packages.items():
         rctx.file(
-            "%s/BUILD.bazel" % (package["name"]),
+            "%s/BUILD.bazel" % (package_name),
             _PACKAGE_TEMPLATE.format(
-                target_name = package["name"],
+                target_name = package_name,
                 data_targets = starlark_codegen_utils.to_dict_attr({
-                    "//:linux_%s" % arch: "//%s/%s" % (package["name"], arch)
-                    for arch in architectures._values
+                    "//:linux_%s" % arch: "//%s/%s" % (package_name, arch)
+                    for arch in package_archs
                 }),
                 control_targets = starlark_codegen_utils.to_dict_attr({
-                    "//:linux_%s" % arch: "//%s/%s:control" % (package["name"], arch)
-                    for arch in architectures._values
+                    "//:linux_%s" % arch: "//%s/%s:control" % (package_name, arch)
+                    for arch in package_archs
                 }),
             ),
         )
 
     rctx.file("packages.bzl", "\n".join(package_defs))
     rctx.file("BUILD.bazel", _ROOT_BUILD_TMPL.format(
         target_name = util.get_repo_name(rctx.attr.name),
-        packages = starlark_codegen_utils.to_list_attr(packages._values),
-        architectures = starlark_codegen_utils.to_list_attr(architectures._values),
+        packages = starlark_codegen_utils.to_dict_list_attr(architectures),
+        architectures = starlark_codegen_utils.to_list_attr(architectures.keys()),
     ))
 
 deb_translate_lock = repository_rule(

examples/ubuntu_snapshot/BUILD.bazel

@@ -46,32 +46,6 @@ tar(
     ],
 )
 
-PACKAGES = [
-    "@noble//ncurses-base",
-    "@noble//libncurses6",
-    "@noble//tzdata",
-    "@noble//bash",
-    "@noble//coreutils",
-    "@noble//dpkg",
-    "@noble//apt",
-    "@noble//perl",
-]
-
-# Creates /var/lib/dpkg/status with installed package information.
-dpkg_status(
-    name = "dpkg_status",
-    controls = select({
-        "@platforms//cpu:arm64": [
-            "%s/arm64:control" % package
-            for package in PACKAGES
-        ],
-        "@platforms//cpu:x86_64": [
-            "%s/amd64:control" % package
-            for package in PACKAGES
-        ],
-    }),
-)
-
 oci_image(
     name = "noble",
     architecture = select({
@@ -83,17 +57,8 @@ oci_image(
         ":sh",
         ":passwd",
         ":group",
-        ":dpkg_status",
-    ] + select({
-        "@platforms//cpu:arm64": [
-            "%s/arm64" % package
-            for package in PACKAGES
-        ],
-        "@platforms//cpu:x86_64": [
-            "%s/amd64" % package
-            for package in PACKAGES
-        ],
-    }),
+        "@noble//:noble",
+    ],
 )
 
 oci_load(