Merge branch 'v3.10.x' into fix-amqp-1-0-oauth-issue-v3-10fix-amqp-1-0-oauth-issue-v3-10

25 files changed, 445 insertions, 318 deletions

diff --git a/.github/workflows/oci.yaml b/.github/workflows/oci.yaml
index 1a440ec6c8..1661b55582 100644
--- a/.github/workflows/oci.yaml
+++ b/.github/workflows/oci.yaml
@@ -2,11 +2,18 @@
 name: OCI
 on:
   push:
+    paths-ignore:
+      - '.github/workflows/secondary-umbrella.yaml'
+      - '.github/workflows/update-elixir-patches.yaml'
+      - '.github/workflows/update-otp-patches.yaml'
   workflow_dispatch:
 env:
   GENERIC_UNIX_ARCHIVE: ${{ github.workspace }}/bazel-bin/package-generic-unix.tar.xz
   RABBITMQ_VERSION: ${{ github.event.pull_request.head.sha || github.sha }}
   VERSION: ${{ github.event.pull_request.head.sha || github.sha }}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 jobs:
 
   # This job will build one docker image per supported Erlang major version.
@@ -20,133 +27,6 @@ jobs:
   # * 111aaa-otp-max (image OTP 25)
   # * main-otp-max (image OTP 25)
 
-  build-publish-dev:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-          # Build image for every supported Erlang major version.
-          # Source of truth for OTP versions (min & max): https://www.rabbitmq.com/which-erlang.html
-          include:
-          - image_tag_suffix: otp-min
-            otp_major: 24
-          - image_tag_suffix: otp-max
-            otp_major: 25
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Mount Bazel Cache
-        uses: actions/cache@v3.2.6
-        with:
-          path: "/home/runner/repo-cache/"
-          key: repo-cache
-
-      - name: Configure Bazel
-        run: |
-          if [ -n "${{ secrets.BUILDBUDDY_API_KEY }}" ]; then
-          cat << EOF >> user.bazelrc
-            build:buildbuddy --remote_header=x-buildbuddy-api-key=${{ secrets.BUILDBUDDY_API_KEY }}
-          EOF
-          fi
-          cat << EOF >> user.bazelrc
-            build:buildbuddy --build_metadata=ROLE=CI
-            build:buildbuddy --build_metadata=VISIBILITY=PRIVATE
-            build:buildbuddy --repository_cache=/home/runner/repo-cache/
-            build:buildbuddy --color=yes
-            build:buildbuddy --disk_cache=
-
-            build:buildbuddy --remote_download_toplevel
-          EOF
-
-      - name: Load version info
-        id: load-info
-        run: |
-          bazelisk build :otp_version --config=rbe-${{ matrix.otp_major }}
-          echo "::set-output name=otp::$(cat bazel-bin/otp_version.txt)"
-
-      - name: Build generic unix package
-        run: |
-          sed -i"_orig" -E '/APP_VERSION/ s/3\.[0-9]+\.[0-9]+/${{ github.event.pull_request.head.sha || github.sha }}/' rabbitmq.bzl
-          bazelisk build :package-generic-unix \
-            --config=rbe-${{ matrix.otp_major }}
-
-      - name: Resolve generic unix package path
-        run: |
-          echo "::set-output name=ARTIFACT_PATH::$(readlink -f ${GENERIC_UNIX_ARCHIVE})"
-        id: resolve-artifact-path
-
-      - name: Save the package as a workflow artifact
-        uses: actions/upload-artifact@v3
-        continue-on-error: true
-        with:
-          name: package-generic-unix-${{ steps.load-info.outputs.otp }}.tar.xz
-          path: ${{ steps.resolve-artifact-path.outputs.ARTIFACT_PATH }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Cache Docker layers
-        uses: actions/cache@v3.2.6
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-${{ matrix.image_tag_suffix }}-buildx-${{ github.event.pull_request.head.sha || github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-${{ matrix.image_tag_suffix }}-buildx-
-
-      - name: Check for Push Credentials
-        id: authorized
-        run: |
-          if [ -n "${{ secrets.DOCKERHUB_USERNAME }}" ]; then
-            echo "::set-output name=PUSH::true"
-          else
-            echo "::set-output name=PUSH::false"
-          fi
-
-      - name: Login to DockerHub
-        if: steps.authorized.outputs.PUSH == 'true'
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-      - name: Expand generic-unix-package
-        working-directory: packaging/docker-image
-        run: |
-          xzcat ${{ steps.resolve-artifact-path.outputs.ARTIFACT_PATH }} | tar xvf -
-
-      - name: Compute image tags
-        id: compute-tags
-        run: |
-          echo "::set-output name=TAG_1::${{ github.event.pull_request.head.sha || github.sha }}-${{ matrix.image_tag_suffix }}"
-          echo "::set-output name=TAG_2::${GITHUB_REF##*/}-${{ matrix.image_tag_suffix }}"
-
-      - name: Build and push
-        uses: docker/build-push-action@v4
-        with:
-          context: packaging/docker-image
-          pull: true
-          push: ${{ steps.authorized.outputs.PUSH }}
-          tags: |
-            pivotalrabbitmq/rabbitmq:${{ steps.compute-tags.outputs.TAG_1 }}
-            pivotalrabbitmq/rabbitmq:${{ steps.compute-tags.outputs.TAG_2 }}
-          build-args: |
-            SKIP_PGP_VERIFY=true
-            PGP_KEYSERVER=pgpkeys.eu
-            OTP_VERSION=${{ steps.load-info.outputs.otp }}
-            SKIP_OTP_VERIFY=true
-            RABBITMQ_BUILD=rabbitmq_server-${{ github.event.pull_request.head.sha || github.sha }}
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache-new
-
-      # Temp fix
-      # https://github.com/docker/build-push-action/issues/252
-      # https://github.com/moby/buildkit/issues/1896
-      - name: Move cache
-        run: |
-          rm -rf /tmp/.buildx-cache
-          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
-
   build-publish-dev-bazel:
     runs-on: ubuntu-20.04
     strategy:
diff --git a/MODULE.bazel b/MODULE.bazel
index a7317ee263..9552f4355f 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -31,7 +31,7 @@ bazel_dep(
 
 bazel_dep(
     name = "rules_erlang",
-    version = "3.9.9",
+    version = "3.9.11",
 )
 
 erlang_config = use_extension(
@@ -259,6 +259,13 @@ sed -i"_orig" -E '/VERSION/ s/[0-9]+\\.[0-9]+\\.[0-9]+/'${VERSION}'/' BUILD.baze
 )
 
 erlang_package.hex_package(
+    name = "parallel_stream",
+    build_file = "@rabbitmq-server//bazel:BUILD.parallel_stream",
+    sha256 = "639b2e8749e11b87b9eb42f2ad325d161c170b39b288ac8d04c4f31f8f0823eb",
+    version = "1.0.6",
+)
+
+erlang_package.hex_package(
     name = "prometheus",
     build_file = "@rabbitmq-server//bazel:BUILD.prometheus",
     sha256 = "2a99bb6dce85e238c7236fde6b0064f9834dc420ddbd962aac4ea2a3c3d59384",
@@ -352,6 +359,7 @@ use_repo(
     "jsx",
     "observer_cli",
     "osiris",
+    "parallel_stream",
     "prometheus",
     "ra",
     "ranch",
@@ -369,12 +377,26 @@ erlang_dev_package = use_extension(
     "erlang_package",
 )
 
+erlang_dev_package.hex_package(
+    name = "amqp",
+    build_file = "@rabbitmq-server//bazel:BUILD.amqp",
+    sha256 = "b6d926770e4508e30e3e9e476c57b6c8aeda44f7715663bdc38935620ce5be6f",
+    version = "2.1.1",
+)
+
 erlang_dev_package.git_package(
-    commit = "478aa272708ed4ad282ca02bed41a5320330e8af",
+    branch = "master",
     build_file = "@//:bazel/BUILD.ct_helper",
     repository = "ninenines/ct_helper",
 )
 
+erlang_dev_package.hex_package(
+    name = "dialyxir",
+    build_file = "@rabbitmq-server//bazel:BUILD.dialyxir",
+    sha256 = "6c32a70ed5d452c6650916555b1f96c79af5fc4bf286997f8b15f213de786f73",
+    version = "0.5.1",
+)
+
 erlang_dev_package.git_package(
     name = "emqtt",
     build_file = "@rabbitmq-server//bazel:BUILD.emqtt",
@@ -401,13 +423,31 @@ erlang_dev_package.git_package(
     repository = "manopapad/proper",
 )
 
+erlang_dev_package.hex_package(
+    name = "temp",
+    build_file = "@rabbitmq-server//bazel:BUILD.temp",
+    sha256 = "6af19e7d6a85a427478be1021574d1ae2a1e1b90882586f06bde76c63cd03e0d",
+    version = "0.4.7",
+)
+
+erlang_dev_package.hex_package(
+    name = "x509",
+    build_file = "@rabbitmq-server//bazel:BUILD.x509",
+    sha256 = "5ff9c79e77d64a62ccffd90aaeb23e8f5b6e47844ef7bc8fed931ecf238662e0",
+    version = "0.7.0",
+)
+
 use_repo(
     erlang_dev_package,
+    "amqp",
     "ct_helper",
+    "dialyxir",
     "emqtt",
     "inet_tcp_proxy_dist",
     "meck",
     "proper",
+    "temp",
+    "x509",
 )
 
 rbe = use_extension(
@@ -435,3 +475,13 @@ use_repo(
     secondary_umbrella,
     "rabbitmq-server-generic-unix-3.9",
 )
+
+hex = use_extension(
+    "//bazel/bzlmod:extensions.bzl",
+    "hex",
+)
+
+use_repo(
+    hex,
+    "hex",
+)
diff --git a/WORKSPACE b/WORKSPACE
index e1330377ec..d98df48a04 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -6,7 +6,7 @@ load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository", "new_git_r
 git_repository(
     name = "rules_erlang",
     remote = "https://github.com/rabbitmq/rules_erlang.git",
-    tag = "3.9.9",
+    tag = "3.9.11",
 )
 
 load("@rules_erlang//:internal_deps.bzl", "rules_erlang_internal_deps")
diff --git a/bazel/BUILD.amqp b/bazel/BUILD.amqp
new file mode 100644
index 0000000000..ad2e97bb0b
--- /dev/null
+++ b/bazel/BUILD.amqp
@@ -0,0 +1,10 @@
+filegroup(
+    name = "sources",
+    srcs = [
+        "mix.exs",
+    ] + glob([
+        "LICENSE*",
+        "lib/**/*",
+    ]),
+    visibility = ["//visibility:public"],
+)
diff --git a/bazel/BUILD.ct_helper b/bazel/BUILD.ct_helper
index a2d897798c..e0040c36f8 100644
--- a/bazel/BUILD.ct_helper
+++ b/bazel/BUILD.ct_helper
@@ -20,13 +20,11 @@ erlang_bytecode(
     testonly = True,
     srcs = [
         "src/ct_helper.erl",
-        "src/ct_helper_error_h.erl",
-        "src/erl_make_certs.erl",
+        "src/ct_helper_error_h.erl"
     ],
     outs = [
         "ebin/ct_helper.beam",
-        "ebin/ct_helper_error_h.beam",
-        "ebin/erl_make_certs.beam",
+        "ebin/ct_helper_error_h.beam"
     ],
     app_name = "ct_helper",
     erlc_opts = "//:erlc_opts",
@@ -44,8 +42,7 @@ filegroup(
     srcs = [
         "src/ct_helper.app.src",
         "src/ct_helper.erl",
-        "src/ct_helper_error_h.erl",
-        "src/erl_make_certs.erl",
+        "src/ct_helper_error_h.erl"
     ],
 )
 
diff --git a/bazel/BUILD.dialyxir b/bazel/BUILD.dialyxir
new file mode 100644
index 0000000000..ad2e97bb0b
--- /dev/null
+++ b/bazel/BUILD.dialyxir
@@ -0,0 +1,10 @@
+filegroup(
+    name = "sources",
+    srcs = [
+        "mix.exs",
+    ] + glob([
+        "LICENSE*",
+        "lib/**/*",
+    ]),
+    visibility = ["//visibility:public"],
+)
diff --git a/bazel/BUILD.ex_doc b/bazel/BUILD.ex_doc
new file mode 100644
index 0000000000..ad2e97bb0b
--- /dev/null
+++ b/bazel/BUILD.ex_doc
@@ -0,0 +1,10 @@
+filegroup(
+    name = "sources",
+    srcs = [
+        "mix.exs",
+    ] + glob([
+        "LICENSE*",
+        "lib/**/*",
+    ]),
+    visibility = ["//visibility:public"],
+)
diff --git a/bazel/BUILD.parallel_stream b/bazel/BUILD.parallel_stream
new file mode 100644
index 0000000000..ad2e97bb0b
--- /dev/null
+++ b/bazel/BUILD.parallel_stream
@@ -0,0 +1,10 @@
+filegroup(
+    name = "sources",
+    srcs = [
+        "mix.exs",
+    ] + glob([
+        "LICENSE*",
+        "lib/**/*",
+    ]),
+    visibility = ["//visibility:public"],
+)
diff --git a/bazel/BUILD.temp b/bazel/BUILD.temp
new file mode 100644
index 0000000000..ad2e97bb0b
--- /dev/null
+++ b/bazel/BUILD.temp
@@ -0,0 +1,10 @@
+filegroup(
+    name = "sources",
+    srcs = [
+        "mix.exs",
+    ] + glob([
+        "LICENSE*",
+        "lib/**/*",
+    ]),
+    visibility = ["//visibility:public"],
+)
diff --git a/bazel/BUILD.x509 b/bazel/BUILD.x509
new file mode 100644
index 0000000000..ad2e97bb0b
--- /dev/null
+++ b/bazel/BUILD.x509
@@ -0,0 +1,10 @@
+filegroup(
+    name = "sources",
+    srcs = [
+        "mix.exs",
+    ] + glob([
+        "LICENSE*",
+        "lib/**/*",
+    ]),
+    visibility = ["//visibility:public"],
+)
diff --git a/bazel/bzlmod/extensions.bzl b/bazel/bzlmod/extensions.bzl
index ddc10c8ef8..bb87dc9cde 100644
--- a/bazel/bzlmod/extensions.bzl
+++ b/bazel/bzlmod/extensions.bzl
@@ -1,3 +1,4 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
 load(
     ":secondary_umbrella.bzl",
@@ -137,3 +138,32 @@ def _secondary_umbrella(ctx):
 secondary_umbrella = module_extension(
     implementation = _secondary_umbrella,
 )
+
+def _hex(ctx):
+    http_archive(
+        name = "hex",
+        sha256 = "0e3e3290d0fcbdc6bb0526b73ca174d68dcff4d53ee86015c49ad0493e39ee65",
+        strip_prefix = "hex-2.0.5",
+        urls = ["https://github.com/hexpm/hex/archive/refs/tags/v2.0.5.zip"],
+        build_file_content = """\
+load(
+    "@rabbitmq-server//bazel/elixir:mix_archive_build.bzl",
+    "mix_archive_build",
+)
+
+mix_archive_build(
+    name = "archive",
+    srcs = [
+        "mix.exs",
+    ] + glob([
+        "lib/**/*",
+    ]),
+    out = "hex.ez",
+    visibility = ["//visibility:public"],
+)
+""",
+    )
+
+hex = module_extension(
+    implementation = _hex,
+)
diff --git a/bazel/elixir/mix_archive_build.bzl b/bazel/elixir/mix_archive_build.bzl
new file mode 100644
index 0000000000..9652e0f1de
--- /dev/null
+++ b/bazel/elixir/mix_archive_build.bzl
@@ -0,0 +1,118 @@
+load(
+    "@rules_erlang//:util.bzl",
+    "path_join",
+)
+load(
+    "@rules_erlang//private:util.bzl",
+    "additional_file_dest_relative_path",
+)
+load(
+    "//bazel/elixir:elixir_toolchain.bzl",
+    "elixir_dirs",
+    "erlang_dirs",
+    "maybe_install_erlang",
+)
+
+def _impl(ctx):
+    (erlang_home, _, erlang_runfiles) = erlang_dirs(ctx)
+    (elixir_home, elixir_runfiles) = elixir_dirs(ctx)
+
+    out = ctx.actions.declare_file(ctx.attr.out.name)
+    mix_invocation_dir = ctx.actions.declare_directory("{}_mix".format(ctx.label.name))
+
+    package_dir = path_join(
+        ctx.label.workspace_root,
+        ctx.label.package,
+    )
+
+    copy_srcs_commands = []
+    for src in ctx.files.srcs:
+        dest = additional_file_dest_relative_path(ctx.label, src)
+        copy_srcs_commands.extend([
+            'mkdir -p "$(dirname ${{MIX_INVOCATION_DIR}}/{dest})"'.format(
+                dest = dest,
+            ),
+            'cp {flags}"{src}" "${{MIX_INVOCATION_DIR}}/{dest}"'.format(
+                flags = "-r " if src.is_directory else "",
+                src = src.path,
+                dest = dest,
+            ),
+        ])
+
+    script = """set -euo pipefail
+
+{maybe_install_erlang}
+
+if [[ "{elixir_home}" == /* ]]; then
+    ABS_ELIXIR_HOME="{elixir_home}"
+else
+    ABS_ELIXIR_HOME=$PWD/{elixir_home}
+fi
+
+ABS_OUT_PATH="$PWD/{out}"
+
+export PATH="$ABS_ELIXIR_HOME"/bin:"{erlang_home}"/bin:${{PATH}}
+
+export LANG="en_US.UTF-8"
+export LC_ALL="en_US.UTF-8"
+
+MIX_INVOCATION_DIR="{mix_invocation_dir}"
+
+{copy_srcs_commands}
+
+cd "${{MIX_INVOCATION_DIR}}"
+export HOME="${{PWD}}"
+export MIX_ENV=prod
+export ERL_COMPILER_OPTIONS=deterministic
+"${{ABS_ELIXIR_HOME}}"/bin/mix archive.build -o "${{ABS_OUT_PATH}}"
+
+# remove symlinks from the _build directory since it
+# is an unused output, and bazel does not allow them
+find . -type l -delete
+""".format(
+        maybe_install_erlang = maybe_install_erlang(ctx),
+        erlang_home = erlang_home,
+        elixir_home = elixir_home,
+        mix_invocation_dir = mix_invocation_dir.path,
+        copy_srcs_commands = "\n".join(copy_srcs_commands),
+        package_dir = package_dir,
+        out = out.path,
+    )
+
+    inputs = depset(
+        direct = ctx.files.srcs,
+        transitive = [
+            erlang_runfiles.files,
+            elixir_runfiles.files,
+        ],
+    )
+
+    ctx.actions.run_shell(
+        inputs = inputs,
+        outputs = [
+            out,
+            mix_invocation_dir,
+        ],
+        command = script,
+        mnemonic = "MIX",
+    )
+
+    return [
+        DefaultInfo(
+            files = depset([out]),
+        ),
+    ]
+
+mix_archive_build = rule(
+    implementation = _impl,
+    attrs = {
+        "srcs": attr.label_list(
+            mandatory = True,
+            allow_files = True,
+        ),
+        "out": attr.output(),
+    },
+    toolchains = [
+        ":toolchain_type",
+    ],
+)
diff --git a/deps/rabbitmq_cli/BUILD.bazel b/deps/rabbitmq_cli/BUILD.bazel
index 2578d5cdcd..bcb244f441 100644
--- a/deps/rabbitmq_cli/BUILD.bazel
+++ b/deps/rabbitmq_cli/BUILD.bazel
@@ -1,4 +1,3 @@
-load("@bazel_skylib//rules:select_file.bzl", "select_file")
 load("@rules_erlang//:dialyze.bzl", "dialyze", "plt")
 load(":rabbitmqctl.bzl", "rabbitmqctl")
 load(":rabbitmqctl_check_formatted.bzl", "rabbitmqctl_check_formatted_test")
@@ -23,19 +22,16 @@ rabbitmqctl(
         "@observer_cli//:erlang_app",
         "@stdout_formatter//:erlang_app",
     ],
+    archives = [
+        "@hex//:archive",
+    ],
     source_deps = {
         "@csv//:sources": "csv",
         "@json//:sources": "json",
+        "@parallel_stream//:sources": "parallel_stream", # transitive dep of csv 2.x
     },
 )
 
-select_file(
-    name = "fetched_srcs",
-    srcs = ":rabbitmqctl",
-    subpath = "deps.tar",
-    visibility = ["//visibility:public"],
-)
-
 rabbitmq_home(
     name = "broker-for-cli-tests-home",
     testonly = True,
@@ -128,9 +124,17 @@ rabbitmqctl_test(
         "@observer_cli//:erlang_app",
         "@stdout_formatter//:erlang_app",
     ],
+    archives = [
+        "@hex//:archive",
+    ],
     source_deps = {
+        "@amqp//:sources": "amqp",
         "@csv//:sources": "csv",
+        "@dialyxir//:sources": "dialyxir",
         "@json//:sources": "json",
+        "@parallel_stream//:sources": "parallel_stream", # transitive dep of csv 2.x
+        "@temp//:sources": "temp",
+        "@x509//:sources": "x509",
     },
 )
 
diff --git a/deps/rabbitmq_cli/Makefile b/deps/rabbitmq_cli/Makefile
index 19c77e350c..567589bb9d 100644
--- a/deps/rabbitmq_cli/Makefile
+++ b/deps/rabbitmq_cli/Makefile
@@ -1,11 +1,16 @@
 PROJECT = rabbitmq_cli
 
 BUILD_DEPS = rabbit_common
-DEPS = csv json observer_cli stdout_formatter
-TEST_DEPS = amqp_client rabbit
+DEPS = csv json observer_cli parallel_stream stdout_formatter
+TEST_DEPS = amqp amqp_client dialyxir temp x509 rabbit
 
+dep_amqp = hex 2.1.1
 dep_csv = hex 2.4.1
+dep_dialyxir = hex 0.5.1
+dep_parallel_stream = hex 1.0.6
 dep_json = hex 1.4.1
+dep_temp = hex 0.4.7
+dep_x509 = hex 0.7.0
 
 DEP_EARLY_PLUGINS = rabbit_common/mk/rabbitmq-early-plugin.mk
 DEP_PLUGINS = rabbit_common/mk/rabbitmq-plugin.mk
diff --git a/deps/rabbitmq_cli/mix.exs b/deps/rabbitmq_cli/mix.exs
index 90771703cb..b3ee4891d9 100644
--- a/deps/rabbitmq_cli/mix.exs
+++ b/deps/rabbitmq_cli/mix.exs
@@ -15,7 +15,7 @@ defmodule RabbitMQCtl.MixfileBase do
       build_embedded: Mix.env() == :prod,
       start_permanent: Mix.env() == :prod,
       escript: [main_module: RabbitMQCtl, emu_args: "-hidden", path: "escript/rabbitmqctl"],
-      deps: deps(),
+      deps: deps(Mix.env()),
       aliases: aliases(),
       xref: [
         exclude: [
@@ -123,7 +123,7 @@ defmodule RabbitMQCtl.MixfileBase do
   # from Hex.pm in RabbitMQ source archive (the source archive must be
   # self-contained and RabbitMQ must be buildable offline). However, we
   # don't have the equivalent for other methods.
-  defp deps() do
+  defp deps(env) do
     deps_dir = System.get_env("DEPS_DIR", "deps")
 
     # Mix is confused by any `rebar.{config,lock}` we might have left in
@@ -148,6 +148,10 @@ defmodule RabbitMQCtl.MixfileBase do
         path: Path.join(deps_dir, "csv")
       },
       {
+        :parallel_stream,
+        path: Path.join(deps_dir, "parallel_stream"), override: true
+      },
+      {
         :stdout_formatter,
         path: Path.join(deps_dir, "stdout_formatter"),
         compile: if(is_bazel, do: false, else: make_cmd)
@@ -157,24 +161,43 @@ defmodule RabbitMQCtl.MixfileBase do
         path: Path.join(deps_dir, "observer_cli"),
         compile: if(is_bazel, do: false, else: make_cmd)
       },
-      {:amqp, "~> 2.1.0", only: :test},
-      {:dialyxir, "~> 0.5", only: :test, runtime: false},
-      {:temp, "~> 0.4", only: :test},
-      {:x509, "~> 0.7", only: :test},
       {
         :rabbit_common,
         path: Path.join(deps_dir, "rabbit_common"),
         compile: if(is_bazel, do: false, else: make_cmd),
         override: true
-      },
-      {
-        :amqp_client,
-        path: Path.join(deps_dir, "amqp_client"),
-        compile: if(is_bazel, do: false, else: make_cmd),
-        override: true,
-        only: :test
       }
-    ]
+    ] ++
+      case env do
+        :test ->
+          [
+            {
+              :amqp,
+              path: Path.join(deps_dir, "amqp")
+            },
+            {
+              :dialyxir,
+              path: Path.join(deps_dir, "dialyxir"), runtime: false
+            },
+            {
+              :temp,
+              path: Path.join(deps_dir, "temp")
+            },
+            {
+              :x509,
+              path: Path.join(deps_dir, "x509")
+            },
+            {
+              :amqp_client,
+              path: Path.join(deps_dir, "amqp_client"),
+              compile: if(is_bazel, do: false, else: make_cmd),
+              override: true
+            }
+          ]
+
+        _ ->
+          []
+      end
   end
 
   defp aliases do
diff --git a/deps/rabbitmq_cli/rabbitmqctl.bzl b/deps/rabbitmq_cli/rabbitmqctl.bzl
index 4af414666b..ab0b4e8e65 100644
--- a/deps/rabbitmq_cli/rabbitmqctl.bzl
+++ b/deps/rabbitmq_cli/rabbitmqctl.bzl
@@ -1,3 +1,4 @@
+load("@bazel_skylib//lib:shell.bzl", "shell")
 load(
     "@rules_erlang//:erlang_app_info.bzl",
     "ErlangAppInfo",
@@ -49,7 +50,7 @@ def deps_dir_contents(ctx, deps, dir):
                     output = f,
                     target_file = src,
                 )
-                files.append(f)
+                files.extend([src, f])
     return files
 
 def _impl(ctx):
@@ -60,7 +61,6 @@ def _impl(ctx):
     ebin = ctx.actions.declare_directory("ebin")
     consolidated = ctx.actions.declare_directory("consolidated")
     mix_invocation_dir = ctx.actions.declare_directory("{}_mix".format(ctx.label.name))
-    fetched_srcs = ctx.actions.declare_file("deps.tar")
 
     deps = flat_deps(ctx.attr.deps)
 
@@ -100,7 +100,6 @@ fi
 ABS_EBIN_DIR=$PWD/{ebin_dir}
 ABS_CONSOLIDATED_DIR=$PWD/{consolidated_dir}
 ABS_ESCRIPT_PATH=$PWD/{escript_path}
-ABS_FETCHED_SRCS=$PWD/{fetched_srcs}
 
 export PATH="$ABS_ELIXIR_HOME"/bin:"{erlang_home}"/bin:${{PATH}}
 
@@ -113,17 +112,18 @@ cp -r {package_dir}/config ${{MIX_INVOCATION_DIR}}/config
 cp -r {package_dir}/lib ${{MIX_INVOCATION_DIR}}/lib
 cp    {package_dir}/mix.exs ${{MIX_INVOCATION_DIR}}/mix.exs
 
+ORIGINAL_DIR=$PWD
 cd ${{MIX_INVOCATION_DIR}}
 export IS_BAZEL=true
 export HOME=${{PWD}}
 export DEPS_DIR=$(dirname $ABS_EBIN_DIR)/{deps_dir}
 export MIX_ENV=prod
 export ERL_COMPILER_OPTIONS=deterministic
-"${{ABS_ELIXIR_HOME}}"/bin/mix local.hex --force
-"${{ABS_ELIXIR_HOME}}"/bin/mix local.rebar --force
-"${{ABS_ELIXIR_HOME}}"/bin/mix deps.get --only prod
+for archive in {archives}; do
+    "${{ABS_ELIXIR_HOME}}"/bin/mix archive.install --force $ORIGINAL_DIR/$archive
+done
 for d in {precompiled_deps}; do
-    mkdir _build/${{MIX_ENV}}/lib/$d
+    mkdir -p _build/${{MIX_ENV}}/lib/$d
     ln -s ${{DEPS_DIR}}/$d/ebin _build/${{MIX_ENV}}/lib/$d
     ln -s ${{DEPS_DIR}}/$d/include _build/${{MIX_ENV}}/lib/$d
 done
@@ -136,9 +136,6 @@ cp escript/rabbitmqctl ${{ABS_ESCRIPT_PATH}}
 cp _build/${{MIX_ENV}}/lib/rabbitmqctl/ebin/* ${{ABS_EBIN_DIR}}
 cp _build/${{MIX_ENV}}/lib/rabbitmqctl/consolidated/* ${{ABS_CONSOLIDATED_DIR}}
 
-tar --file ${{ABS_FETCHED_SRCS}} \\
-    --create deps
-
 # remove symlinks from the _build directory since it
 # is not used, and bazel does not allow them
 find . -type l -delete
@@ -152,7 +149,7 @@ find . -type l -delete
         escript_path = escript.path,
         ebin_dir = ebin.path,
         consolidated_dir = consolidated.path,
-        fetched_srcs = fetched_srcs.path,
+        archives = "".join([shell.quote(a.path) for a in ctx.files.archives]),
         precompiled_deps = " ".join([
             dep[ErlangAppInfo].app_name
             for dep in ctx.attr.deps
@@ -164,6 +161,7 @@ find . -type l -delete
         transitive = [
             erlang_runfiles.files,
             elixir_runfiles.files,
+            depset(ctx.files.archives),
             depset(deps_dir_files),
         ],
     )
@@ -175,7 +173,6 @@ find . -type l -delete
             ebin,
             consolidated,
             mix_invocation_dir,
-            fetched_srcs,
         ],
         command = script,
         mnemonic = "MIX",
@@ -192,7 +189,7 @@ find . -type l -delete
     return [
         DefaultInfo(
             executable = escript,
-            files = depset([ebin, consolidated, fetched_srcs]),
+            files = depset([ebin, consolidated]),
             runfiles = runfiles,
         ),
         ElixirAppInfo(
@@ -224,6 +221,9 @@ rabbitmqctl_private = rule(
         "deps": attr.label_list(
             providers = [ErlangAppInfo],
         ),
+        "archives": attr.label_list(
+            allow_files = [".ez"],
+        ),
         "source_deps": attr.label_keyed_string_dict(),
     },
     toolchains = [
diff --git a/deps/rabbitmq_cli/rabbitmqctl_test.bzl b/deps/rabbitmq_cli/rabbitmqctl_test.bzl
index 138bd3d766..f3ef9f5169 100644
--- a/deps/rabbitmq_cli/rabbitmqctl_test.bzl
+++ b/deps/rabbitmq_cli/rabbitmqctl_test.bzl
@@ -1,3 +1,4 @@
+load("@bazel_skylib//lib:shell.bzl", "shell")
 load(
     "@rules_erlang//:erlang_app_info.bzl",
     "ErlangAppInfo",
@@ -96,11 +97,11 @@ export HOME=${{PWD}}
 export DEPS_DIR=$TEST_SRCDIR/$TEST_WORKSPACE/{package_dir}/{deps_dir}
 export MIX_ENV=test
 export ERL_COMPILER_OPTIONS=deterministic
-"${{ABS_ELIXIR_HOME}}"/bin/mix local.hex --force
-"${{ABS_ELIXIR_HOME}}"/bin/mix local.rebar --force
-"${{ABS_ELIXIR_HOME}}"/bin/mix deps.get
+for archive in {archives}; do
+    "${{ABS_ELIXIR_HOME}}"/bin/mix archive.install --force $INITIAL_DIR/$archive
+done
 for d in {precompiled_deps}; do
-    mkdir _build/${{MIX_ENV}}/lib/$d
+    mkdir -p _build/${{MIX_ENV}}/lib/$d
     ln -s ${{DEPS_DIR}}/$d/ebin _build/${{MIX_ENV}}/lib/$d
     ln -s ${{DEPS_DIR}}/$d/include _build/${{MIX_ENV}}/lib/$d
 done
@@ -138,6 +139,7 @@ set -x
             elixir_home = elixir_home,
             package_dir = package_dir,
             deps_dir = deps_dir,
+            archives = "".join([shell.quote(a.short_path) for a in ctx.files.archives]),
             precompiled_deps = precompiled_deps,
             rabbitmq_run_cmd = ctx.attr.rabbitmq_run[DefaultInfo].files_to_run.executable.short_path,
         )
@@ -167,9 +169,11 @@ set DEPS_DIR=%TEST_SRCDIR%/%TEST_WORKSPACE%/{package_dir}/{deps_dir}
 set DEPS_DIR=%DEPS_DIR:/=\\%
 set ERL_COMPILER_OPTIONS=deterministic
 set MIX_ENV=test
-echo y | "{elixir_home}\\bin\\mix" local.hex --force || goto :error
-echo y | "{elixir_home}\\bin\\mix" local.rebar --force || goto :error
-"{elixir_home}\\bin\\mix" deps.get || goto :error
+for %%a in ({archives}) do (
+    set ARCH=%TEST_SRCDIR%/%TEST_WORKSPACE%/%%a
+    set ARCH=%ARCH:/=\\%
+    "{elixir_home}\\bin\\mix" archive.install --force %ARCH% || goto :error
+)
 for %%d in ({precompiled_deps}) do (
     mkdir _build\\%MIX_ENV%\\lib\\%%d
     robocopy %DEPS_DIR%\\%%d\\ebin _build\\%MIX_ENV%\\lib\\%%d /E /NFL /NDL /NJH /NJS /nc /ns /np
@@ -192,6 +196,7 @@ exit /b 1
             elixir_home = windows_path(elixir_home),
             package_dir = windows_path(ctx.label.package),
             deps_dir = deps_dir,
+            archives = "".join([shell.quote(a.short_path) for a in ctx.files.archives]),
             precompiled_deps = precompiled_deps,
             rabbitmq_run_cmd = ctx.attr.rabbitmq_run[DefaultInfo].files_to_run.executable.short_path,
         )
@@ -202,7 +207,7 @@ exit /b 1
     )
 
     runfiles = ctx.runfiles(
-        files = ctx.files.srcs + ctx.files.data,
+        files = ctx.files.srcs + ctx.files.data + ctx.files.archives,
         transitive_files = depset(deps_dir_files),
     ).merge_all([
         erlang_runfiles,
@@ -222,6 +227,9 @@ rabbitmqctl_private_test = rule(
         "srcs": attr.label_list(allow_files = [".ex", ".exs"]),
         "data": attr.label_list(allow_files = True),
         "deps": attr.label_list(providers = [ErlangAppInfo]),
+        "archives": attr.label_list(
+            allow_files = [".ez"],
+        ),
         "source_deps": attr.label_keyed_string_dict(),
         "rabbitmq_run": attr.label(
             executable = True,
diff --git a/deps/rabbitmq_event_exchange/README.md b/deps/rabbitmq_event_exchange/README.md
index d9a58f70d0..1380a4d30f 100644
--- a/deps/rabbitmq_event_exchange/README.md
+++ b/deps/rabbitmq_event_exchange/README.md
@@ -11,8 +11,8 @@ the management plugin for stats.
 
 ## How it Works
 
-It declares a topic exchange called 'amq.rabbitmq.event' in the default
-virtual host. All events are published to this exchange with routing
+It declares a topic exchange called `amq.rabbitmq.event` **in the default
+virtual host**. All events are published to this exchange with routing
 keys like 'exchange.created', 'binding.deleted' etc, so you can
 subscribe to only the events you're interested in.
 
@@ -23,26 +23,11 @@ gets published, don't allow them access.
 
 ## Installation
 
-### With RabbitMQ 3.6.0 or Later
-
-Most recent RabbitMQ version ships with this plugin.
-As of RabbitMQ `3.6.0` this plugin is included into the RabbitMQ distribution.
-
-Enable it with the following command:
-
-```bash
-rabbitmq-plugins enable rabbitmq_event_exchange
-```
-
-### With RabbitMQ 3.5.x
-
-You can download a pre-built binary of this plugin from
-the [RabbitMQ Community Plugins](https://www.rabbitmq.com/community-plugins.html) page.
-
-Then run the following command:
+This plugin ships with RabbitMQ. Like with all other plugins, it must be
+enabled before it can be used:
 
 ```bash
-rabbitmq-plugins enable rabbitmq_event_exchange
+[sudo] rabbitmq-plugins enable rabbitmq_event_exchange
 ```
 
 ## Event format
diff --git a/deps/rabbitmq_jms_topic_exchange/README.md b/deps/rabbitmq_jms_topic_exchange/README.md
index a1c81823a8..5cb2ff9305 100644
--- a/deps/rabbitmq_jms_topic_exchange/README.md
+++ b/deps/rabbitmq_jms_topic_exchange/README.md
@@ -17,28 +17,28 @@ Some related projects (e.g. a compliance test suite) and documentation are yet t
 
 ## Supported RabbitMQ Versions
 
-This plugin targets RabbitMQ `3.6.0` and later versions.
+This plugin ships with RabbitMQ.
 
 ## Installation
 
-This plugin ships with RabbitMQ starting with `3.6.3`. Enable it with
+Like all other plugins, this plugin must be enabled before it can be used.
+Enable it with
 
 ```
 [sudo] rabbitmq-plugins enable rabbitmq_jms_topic_exchange
 ```
 
-
 ## Design
 
 The plugin this generates is a user-written exchange type for RabbitMQ
-client use. The exchange type name is "`x_jms_topic`" but this is _not_
+client use. The exchange type name is "`x-jms-topic`" but this is _not_
 a topic exchange. Instead it works together with a standard topic
 exchange to provide the JMS topic selection function.
 
 When JMS Selectors are used on a Topic Destination consumer, the
-destination (queue) is bound to an exchange of type `x_jms_topic`, with
+destination (queue) is bound to an exchange of type `x-jms-topic`, with
 arguments that indicate what the selection criteria are. The
-`x_jms_topic` exchange is, in turn, bound to the standard Topic Exchange
+`x-jms-topic` exchange is, in turn, bound to the standard Topic Exchange
 used by JMS messaging (this uses the RabbitMQ exchange-to-exchange
 binding extension to the AMQP 0-9-1 protocol).
 
@@ -46,19 +46,9 @@ In this way, normal topic routing can occur, with the overhead of
 selection only applying when selection is used, and _after_ the routing
 and filtering implied by the topic name.
 
-## Building From Source
-
-Building is no different from [building other RabbitMQ plugins](https://www.rabbitmq.com/plugin-development.html).
-
-TL;DR:
-
-    git clone https://github.com/rabbitmq/rabbitmq-jms-topic-exchange.git
-    cd rabbitmq-jms-topic-exchange
-    make -j dist
-    ls plugins/*
     
 ## Copyright and License
 
-(c) 2007-2020 VMware, Inc. or its affiliates.
+(c) 2007-2023 VMware, Inc. or its affiliates.
 
 See [LICENSE](./LICENSE) for license information.
diff --git a/deps/rabbitmq_management/priv/www/js/tmpl/layout.ejs b/deps/rabbitmq_management/priv/www/js/tmpl/layout.ejs
index d29aab432d..47ee17c315 100644
--- a/deps/rabbitmq_management/priv/www/js/tmpl/layout.ejs
+++ b/deps/rabbitmq_management/priv/www/js/tmpl/layout.ejs
@@ -42,13 +42,15 @@
 <div id="footer">
   <ul>
     <li><a rel="noopener noreferrer" href="api/" target="_blank">HTTP API</a></li>
-    <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/admin-guide.html" target="_blank">Server Docs</a></li>
+    <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/documentation.html" target="_blank">Documentation</a></li>
     <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/getstarted.html" target="_blank">Tutorials</a></li>
-    <li><a rel="noopener noreferrer" href="https://groups.google.com/forum/#!forum/rabbitmq-users" target="_blank">Community Support</a></li>
-    <li><a rel="noopener noreferrer" href="https://rabbitmq-slack.herokuapp.com/" target="_blank">Community Slack</a></li>
-    <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/services.html" target="_blank">Commercial Support</a></li>
+    <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/changelog.html" target="_blank">New releases</a></li>
+    <li><a rel="noopener noreferrer" href="https://www.vmware.com/products/rabbitmq.html" target="_blank">Commercial edition</a></li>
+    <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/services.html" target="_blank">Commercial support</a></li>
+    <li><a rel="noopener noreferrer" href="https://groups.google.com/forum/#!forum/rabbitmq-users" target="_blank">Google Group</a></li>
+    <li><a rel="noopener noreferrer" href="https://rabbitmq.com/discord/" target="_blank">Discord</a></li>
+    <li><a rel="noopener noreferrer" href="https://rabbitmq.com/slack/" target="_blank">Slack</a></li>
     <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/plugins.html" target="_blank">Plugins</a></li>
     <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/github.html" target="_blank">GitHub</a></li>
-    <li><a rel="noopener noreferrer" href="https://www.rabbitmq.com/changelog.html" target="_blank">Changelog</a></li>
   </ul>
-</div>
+</div>
\ No newline at end of file
diff --git a/deps/rabbitmq_random_exchange/README.md b/deps/rabbitmq_random_exchange/README.md
index 3f6f2662de..00dce95b1f 100644
--- a/deps/rabbitmq_random_exchange/README.md
+++ b/deps/rabbitmq_random_exchange/README.md
@@ -11,31 +11,13 @@ interested.
 
 ## Installation
 
-Install the corresponding .ez files from our
-[GitHub releases](https://github.com/rabbitmq/rabbitmq-random-exchange/releases) or [Community Plugins page](https://www.rabbitmq.com/community-plugins.html).
-
-Then run the following command:
+This plugin ships with RabbitMQ. Like all other plugins, it must be enabled
+before it can be used:
 
 ```bash
-rabbitmq-plugins enable rabbitmq_random_exchange
+[sudo] rabbitmq-plugins enable rabbitmq_random_exchange
 ```
 
-## Building from Source
-
-Please see [RabbitMQ Plugin Development guide](https://www.rabbitmq.com/plugin-development.html).
-
-To build the plugin:
-
-    git clone git://github.com/rabbitmq/rabbitmq-random-exchange.git
-    cd rabbitmq-random-exchange
-    make
-
-Then copy all the `*.ez` files inside the `plugins` folder to the [RabbitMQ plugins directory](https://www.rabbitmq.com/relocate.html)
-and enable the plugin:
-
-    [sudo] rabbitmq-plugins enable rabbitmq_random_exchange
-
-
 ## Usage
 
 To create a _random_, just declare an exchange providing the type `"x-random"`.
diff --git a/deps/rabbitmq_recent_history_exchange/README.md b/deps/rabbitmq_recent_history_exchange/README.md
index c22391ad7a..27cfd8945b 100644
--- a/deps/rabbitmq_recent_history_exchange/README.md
+++ b/deps/rabbitmq_recent_history_exchange/README.md
@@ -2,49 +2,21 @@
 
 Keeps track of the last 20 messages that passed through the exchange. Every time a queue is bound to the exchange it delivers that last 20 messages to them. This is useful for implementing a very simple __Chat History__ where clients that join the conversation can get the latest messages.
 
-Exchange Type: `x-recent-history`
+Exchange yype: `x-recent-history`.
 
 ## Installation ##
 
-### RabbitMQ 3.6.0 or later
+This plugin ships with RabbitMQ. 
 
-As of RabbitMQ `3.6.0` this plugin is included into the RabbitMQ distribution.
-
-Enable it with the following command:
-
-```bash
-rabbitmq-plugins enable rabbitmq_recent_history_exchange
-```
-
-### With Earlier Versions
-
-Install the corresponding .ez files from our
-[Community Plugins archive](https://www.rabbitmq.com/community-plugins/)..
-
-Then run the following command:
+Like all other plugins, it must be enabled before it can be used:
 
 ```bash
-rabbitmq-plugins enable rabbitmq_recent_history_exchange
+[sudo] rabbitmq-plugins enable rabbitmq_recent_history_exchange
 ```
 
-## Building from Source
-
-Please see [RabbitMQ Plugin Development guide](https://www.rabbitmq.com/plugin-development.html).
-
-To build the plugin:
-
-    git clone git://github.com/rabbitmq/rabbitmq-recent-history-exchange.git
-    cd rabbitmq-recent-history-exchange
-    make
-
-Then copy all the `*.ez` files inside the `plugins` folder to the [RabbitMQ plugins directory](https://www.rabbitmq.com/relocate.html)
-and enable the plugin:
-
-    [sudo] rabbitmq-plugins enable rabbitmq_recent_history_exchange
-
 ## Usage ##
 
-### Creating an exchange  ###
+### Creating an exchange
 
 To create a _recent history exchange_, just declare an exchange providing the type `"x-recent-history"`.
 
@@ -52,7 +24,7 @@ To create a _recent history exchange_, just declare an exchange providing the ty
 channel.exchangeDeclare("logs", "x-recent-history");
 ```
 
-### Providing a custom history length ###
+### Providing a custom history length
 
 Typically this exchange will store the latest 20 messages sent over
 the exchange. If you want to set a different cache length, then you
@@ -67,13 +39,13 @@ args.put("x-recent-history-length", 60);
 channel.exchangeDeclare("rh", "x-recent-history", false, false, args);
 ```
 
-### Preventing some messages from being stored ###
+### Preventing some messages from being stored
 
 In case you would like to not store certain messages, just
 add the header `"x-recent-history-no-store"` with the value `true` to
 the message.
 
-## Disabling the Plugin ##
+## Disabling the Plugin
 
 A future version of RabbitMQ will allow users to disable plugins. When
 you disable this plugin, it will delete all the cached messages.
diff --git a/deps/rabbitmq_trust_store/test/system_SUITE.erl b/deps/rabbitmq_trust_store/test/system_SUITE.erl
index 66607f73e4..f8a3f4d136 100644
--- a/deps/rabbitmq_trust_store/test/system_SUITE.erl
+++ b/deps/rabbitmq_trust_store/test/system_SUITE.erl
@@ -201,9 +201,9 @@ validation_success_for_AMQP_client1(Config) ->
     %% Note that when this test is executed together with the HTTP provider group
     %% it runs into unexpected interference and fails, even if TLS app PEM cache is force
     %% cleared. That's why originally each group was made to use a separate node.
-    AuthorityInfo = {Root, _AuthorityKey} = erl_make_certs:make_cert([]),
-    {Certificate, Key} = chain(AuthorityInfo),
-    {Certificate2, Key2} = chain(AuthorityInfo),
+    RootCert = #{cert := Root} = public_key:pkix_test_root_cert("RootCA", []),
+    {Certificate, Key} = chain(RootCert),
+    {Certificate2, Key2} = chain(RootCert),
     Port = port(Config),
     Host = rabbit_ct_helpers:get_config(Config, rmq_hostname),
     %% When: Rabbit accepts just this one authority's certificate
@@ -293,7 +293,7 @@ validate_chain1(Config) ->
     Port = port(Config),
     Host = rabbit_ct_helpers:get_config(Config, rmq_hostname),
 
-    ok = whitelist(Config, "alice", CertTrusted,  KeyTrusted),
+    ok = whitelist(Config, "alice", CertTrusted),
     rabbit_trust_store:refresh(),
 
     catch rabbit_networking:stop_tcp_listener(Port),
@@ -326,18 +326,30 @@ validate_longer_chain1(Config) ->
     %% AND a certificate `CertUntrusted` that is not whitelisted with the same root as `CertTrusted`
     %% AND `CertInter` intermediate CA
     %% AND `RootTrusted` CA
-    AuthorityInfo = {RootCA, _AuthorityKey} = erl_make_certs:make_cert([]),
-    Inter = {CertInter, {KindInter, KeyDataInter, _}} = erl_make_certs:make_cert([{issuer, AuthorityInfo}]),
-    KeyInter = {KindInter, KeyDataInter},
-    {CertUntrusted, {KindUntrusted, KeyDataUntrusted, _}} = erl_make_certs:make_cert([{issuer, Inter}]),
-    KeyUntrusted = {KindUntrusted, KeyDataUntrusted},
-    {CertTrusted, {Kind, KeyData, _}} = erl_make_certs:make_cert([{issuer, Inter}]),
-    KeyTrusted = {Kind, KeyData},
+
+    KeyInterDec = public_key:generate_key({rsa, 2048, 17}),
+    KeyInter = {'RSAPrivateKey', public_key:der_encode('RSAPrivateKey', KeyInterDec)},
+
+    TestDataTrusted = public_key:pkix_test_data(#{
+        root => [],
+        intermediates => [[{key, KeyInterDec}]],
+        peer => []
+    }),
+    CertTrusted = proplists:get_value(cert, TestDataTrusted),
+    KeyTrusted = proplists:get_value(key, TestDataTrusted),
+    [RootCA, CertInter, RootCA] = proplists:get_value(cacerts, TestDataTrusted),
+
+    TestDataUntrusted = public_key:pkix_test_data(#{
+        root => #{cert => CertInter, key => KeyInterDec},
+        peer => []
+    }),
+    CertUntrusted = proplists:get_value(cert, TestDataUntrusted),
+    KeyUntrusted = proplists:get_value(key, TestDataUntrusted),
 
     Port = port(Config),
     Host = rabbit_ct_helpers:get_config(Config, rmq_hostname),
 
-    ok = whitelist(Config, "alice", CertTrusted,  KeyTrusted),
+    ok = whitelist(Config, "alice", CertTrusted),
     rabbit_trust_store:refresh(),
 
     catch rabbit_networking:stop_tcp_listener(Port),
@@ -486,7 +498,7 @@ whitelisted_certificate_accepted_from_AMQP_client_regardless_of_validation_to_ro
     Port = port(Config),
     Host = rabbit_ct_helpers:get_config(Config, rmq_hostname),
 
-    ok = whitelist(Config, "alice", CertTrusted,  KeyTrusted),
+    ok = whitelist(Config, "alice", CertTrusted),
     rabbit_trust_store:refresh(),
 
     %% When: Rabbit validates paths with a different root `R` than
@@ -520,7 +532,7 @@ removed_certificate_denied_from_AMQP_client1(Config) ->
 
     Port = port(Config),
     Host = rabbit_ct_helpers:get_config(Config, rmq_hostname),
-    ok = whitelist(Config, "bob", CertOther,  KeyOther),
+    ok = whitelist(Config, "bob", CertOther),
     rabbit_trust_store:refresh(),
 
     %% When: we wait for at least one second (the accuracy of the
@@ -584,7 +596,7 @@ installed_certificate_accepted_from_AMQP_client1(Config) ->
                                                       {key, Key} | cfg()], 1, 1),
 
     wait_for_file_system_time(),
-    ok = whitelist(Config, "charlie", CertOther,  KeyOther),
+    ok = whitelist(Config, "charlie", CertOther),
     wait_for_trust_store_refresh(),
 
     %% Then: a client presenting the whitelisted certificate `CertOther`
@@ -618,8 +630,8 @@ whitelist_directory_DELTA1(Config) ->
     {_,  CertRevoked, KeyRevoked} = ct_helper:make_certs(),
     {_,  CertListed2, KeyListed2} = ct_helper:make_certs(),
 
-    ok = whitelist(Config, "foo", CertListed1,  KeyListed1),
-    ok = whitelist(Config, "bar", CertRevoked,  KeyRevoked),
+    ok = whitelist(Config, "foo", CertListed1),
+    ok = whitelist(Config, "bar", CertRevoked),
     rabbit_trust_store:refresh(),
 
     %% When: we wait for at least one second (the accuracy
@@ -633,7 +645,7 @@ whitelist_directory_DELTA1(Config) ->
 
     wait_for_file_system_time(),
     ok = delete("bar.pem", Config),
-    ok = whitelist(Config, "baz", CertListed2,  KeyListed2),
+    ok = whitelist(Config, "baz", CertListed2),
     wait_for_trust_store_refresh(),
 
     %% Then: connectivity to Rabbit is as it should be.
@@ -695,7 +707,7 @@ replaced_whitelisted_certificate_should_be_accepted1(Config) ->
                                                     {cert, Cert},
                                                     {key, Key} | cfg()], 1, 1),
     %% And: the first certificate has been whitelisted
-    ok = whitelist(Config, "bart", CertFirst,  KeyFirst),
+    ok = whitelist(Config, "bart", CertFirst),
     rabbit_trust_store:refresh(),
 
     wait_for_trust_store_refresh(),
@@ -732,7 +744,7 @@ replaced_whitelisted_certificate_should_be_accepted1(Config) ->
     ok = amqp_connection:close(Con),
 
     %% When: a whitelisted certicate is replaced with one with the same name
-    ok = whitelist(Config, "bart", CertUpdated,  KeyUpdated),
+    ok = whitelist(Config, "bart", CertUpdated),
 
     wait_for_trust_store_refresh(),
 
@@ -797,10 +809,10 @@ ignore_corrupt_cert1(Config) ->
     {_,  CertTrusted, KeyTrusted} = ct_helper:make_certs(),
 
     rabbit_trust_store:refresh(),
-    ok = whitelist(Config, "alice", CertTrusted,  KeyTrusted),
+    ok = whitelist(Config, "alice", CertTrusted),
 
     %% When: Rabbit tries to whitelist the corrupt certificate.
-    ok = whitelist(Config, "corrupt", <<48>>,  KeyTrusted),
+    ok = whitelist(Config, "corrupt", <<48>>),
     rabbit_trust_store:refresh(),
 
     catch rabbit_networking:stop_tcp_listener(Port),
@@ -835,9 +847,9 @@ ignore_same_cert_with_different_name1(Config) ->
     {_,  CertTrusted, KeyTrusted} = ct_helper:make_certs(),
 
     rabbit_trust_store:refresh(),
-    ok = whitelist(Config, "alice", CertTrusted,  KeyTrusted),
+    ok = whitelist(Config, "alice", CertTrusted),
     %% When: Rabbit tries to insert the duplicate certificate
-    ok = whitelist(Config, "malice", CertTrusted,  KeyTrusted),
+    ok = whitelist(Config, "malice", CertTrusted),
     rabbit_trust_store:refresh(),
 
     catch rabbit_networking:stop_tcp_listener(Port),
@@ -872,8 +884,8 @@ list(Config) ->
     ok = rabbit_ct_broker_helpers:rpc(Config, 0, rabbit_trust_store, refresh, []),
     timer:sleep(2000),
 
-    {_Root,  Cert, Key}    = ct_helper:make_certs(),
-    ok = whitelist(Config, "alice", Cert,  Key),
+    {_Root,  Cert, _Key}    = ct_helper:make_certs(),
+    ok = whitelist(Config, "alice", Cert),
     % wait_for_trust_store_refresh(),
     ok = rabbit_ct_broker_helpers:rpc(Config, 0, rabbit_trust_store, refresh, []),
     Certs = rabbit_ct_broker_helpers:rpc(Config, 0,
@@ -882,8 +894,8 @@ list(Config) ->
     {match, _} = re:run(Certs, ".*alice\.pem.*").
 
 disabled_provider_removes_certificates(Config) ->
-    {_Root,  Cert, Key}    = ct_helper:make_certs(),
-    ok = whitelist(Config, "alice", Cert,  Key),
+    {_Root,  Cert, _Key}    = ct_helper:make_certs(),
+    ok = whitelist(Config, "alice", Cert),
     ok = rabbit_ct_broker_helpers:rpc(Config, 0, rabbit_trust_store, refresh, []),
 
     %% Certificate is there
@@ -902,8 +914,8 @@ disabled_provider_removes_certificates(Config) ->
     nomatch = re:run(CertsAfterDelete, ".*alice\.pem.*").
 
 enabled_provider_adds_cerificates(Config) ->
-    {_Root,  Cert, Key}    = ct_helper:make_certs(),
-    ok = whitelist(Config, "alice", Cert,  Key),
+    {_Root,  Cert, _Key}    = ct_helper:make_certs(),
+    ok = whitelist(Config, "alice", Cert),
     ok = rabbit_ct_broker_helpers:rpc(Config, 0,
            ?MODULE,  change_configuration,
            [rabbitmq_trust_store, [{directory, whitelist_dir(Config)},
@@ -949,9 +961,9 @@ cfg() ->
 %% Ancillary
 
 chain(Issuer) ->
-    %% Theses are DER encoded.
-    {Certificate, {Kind, Key, _}} = erl_make_certs:make_cert([{issuer, Issuer}]),
-    {Certificate, {Kind, Key}}.
+    %% These are DER encoded.
+    TestData = public_key:pkix_test_data(#{root => Issuer, peer => [{key, {rsa, 2048, 17}}]}),
+    {proplists:get_value(cert, TestData), proplists:get_value(key, TestData)}.
 
 change_configuration(App, Props) ->
     ok = application:stop(App),
@@ -964,10 +976,10 @@ change_cfg(App, [{Name,Value}|Rest]) ->
     ok = application:set_env(App, Name, Value),
     change_cfg(App, Rest).
 
-whitelist(Config, Filename, Certificate, {A, B} = _Key) ->
+whitelist(Config, Filename, Certificate) ->
     Path = whitelist_dir(Config),
-    ok = erl_make_certs:write_pem(Path, Filename, {Certificate, {A, B, not_encrypted}}),
-    [file:delete(filename:join(Path, K)) || K <- filelib:wildcard("*_key.pem", Path)],
+    ok = file:write_file(filename:join(Path, Filename ++ ".pem"),
+                         public_key:pem_encode([{'Certificate', Certificate, not_encrypted}])),
     ok.
 
 delete(Name, Config) ->
diff --git a/dist.bzl b/dist.bzl
index eb7f3a45f7..335e0303b8 100644
--- a/dist.bzl
+++ b/dist.bzl
@@ -344,6 +344,15 @@ def source_archive(
         prefix = "deps/csv",
     )
 
+    pkg_files(
+        name = "parallel_stream-files",
+        srcs = [
+            "@parallel_stream//:sources",
+        ],
+        strip_prefix = "",
+        prefix = "deps/parallel_stream",
+    )
+
     pkg_tar(
         name = name,
         extension = "tar.xz",
@@ -351,6 +360,7 @@ def source_archive(
             ":deps-files",
             ":json-files",
             ":csv-files",
+            ":parallel_stream-files",
             Label("@rabbitmq-server//:root-licenses"),
         ],
         visibility = ["//visibility:public"],
diff --git a/moduleindex.yaml b/moduleindex.yaml
index 2101b32a15..2cabc5c6a5 100755
--- a/moduleindex.yaml
+++ b/moduleindex.yaml
@@ -69,7 +69,6 @@ credentials_obfuscation:
 ct_helper:
 - ct_helper
 - ct_helper_error_h
-- erl_make_certs
 cuttlefish:
 - conf_parse
 - cuttlefish