fix: patch llguidance to remove reference to ring crate

cmake/external/llguidance/remove-ring-ref-in-cargo-lock.patch

@@ -0,0 +1,74 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 031d0c5..c2fda96 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1937,20 +1937,6 @@ dependencies = [
+  "web-sys",
+ ]
+
+-[[package]]
+-name = "ring"
+-version = "0.17.14"
+-source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+-dependencies = [
+- "cc",
+- "cfg-if",
+- "getrandom 0.2.16",
+- "libc",
+- "untrusted",
+- "windows-sys 0.52.0",
+-]
+-
+ [[package]]
+ name = "rstest"
+ version = "0.25.0"
+diff --git a/Cargo.toml b/Cargo.toml
+index c23c372..8637592 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -1,23 +1,23 @@
+ [workspace]
+ members = [
+-    "python_ext",
++    # "python_ext",
+     "parser",
+-    "sample_parser",
+-    "json_stats",
++    # "sample_parser",
++    # "json_stats",
+     "toktrie",
+-    "toktrie_hf_tokenizers",
+-    "toktrie_hf_downloader",
+-    "toktrie_tiktoken",
++    # "toktrie_hf_tokenizers",
++    # "toktrie_hf_downloader",
++    # "toktrie_tiktoken",
+ ]
+ # just exclude python_ext since it doesn't build without maturin
+ default-members = [
+     "parser",
+-    "sample_parser",
+-    "json_stats",
++    # "sample_parser",
++    # "json_stats",
+     "toktrie",
+-    "toktrie_hf_tokenizers",
+-    "toktrie_hf_downloader",
+-    "toktrie_tiktoken",
++    # "toktrie_hf_tokenizers",
++    # "toktrie_hf_downloader",
++    # "toktrie_tiktoken",
+ ]
+ resolver = "2"
+
+@@ -41,6 +41,6 @@ opt-level = 3
+ [workspace.dependencies]
+ toktrie = { path = "toktrie" }
+ llguidance = { path = "parser" }
+-toktrie_hf_tokenizers = { path = "toktrie_hf_tokenizers" }
+-toktrie_hf_downloader = { path = "toktrie_hf_downloader" }
+-toktrie_tiktoken = { path = "toktrie_tiktoken" }
++# toktrie_hf_tokenizers = { path = "toktrie_hf_tokenizers" }
++# toktrie_hf_downloader = { path = "toktrie_hf_downloader" }
++# toktrie_tiktoken = { path = "toktrie_tiktoken" }

cmake/external/onnxruntime_external_deps.cmake

@@ -107,5 +107,17 @@ if(USE_GUIDANCE)
     GIT_TAG ${DEP_SHA1_llguidance}
   )
   onnxruntime_fetchcontent_makeavailable(llguidance)
+
+  # HACK: Patch llguidance's cargo.lock to avoid tripping component governance due to unused `ring`.
+  #       `ring` is deprecated in favour of `rust-openssl`.
+  #       `ring` is a transitive dep of several (unused by onnx-rt) modules in `llguidance`.
+  if(NOT EXISTS "${llguidance_SOURCE_DIR}/.onnx-rt-applied-remove-ring-ref-in-cargo-lock")
+    execute_process(
+      COMMAND git apply -- "${CMAKE_CURRENT_LIST_DIR}/llguidance/remove-ring-ref-in-cargo-lock.patch"
+      WORKING_DIRECTORY       "${llguidance_SOURCE_DIR}"
+      COMMAND_ERROR_IS_FATAL  ANY
+    )
+    file(TOUCH "${llguidance_SOURCE_DIR}/.onnx-rt-applied-remove-ring-ref-in-cargo-lock")
+  endif()
   corrosion_import_crate(MANIFEST_PATH ${llguidance_SOURCE_DIR}/parser/Cargo.toml)
 endif()