feat: [NODE-1566] Build with hermetic cc toolchains

Cargo.Bazel.Fuzzing.json.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "68aa001ce9abfda2b276ee96f8a584a5fe878c7eef2f8817c1a4f6301cf09995",
+  "checksum": "29c7b37a159557860517fe0b7082300eddc8cdf865c029fd23664fec048d4423",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
@@ -6830,7 +6830,10 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Cstrip=none",
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -7620,7 +7623,10 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Cstrip=none",
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -7737,7 +7743,10 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Cstrip=none",
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -7884,7 +7893,10 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Cstrip=none",
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -11412,7 +11424,10 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Cstrip=none",
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -11762,7 +11777,13 @@
       "repository": {
         "Http": {
           "url": "https://static.crates.io/crates/cc/1.1.37/download",
-          "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf"
+          "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf",
+          "patch_args": [
+            "-p1"
+          ],
+          "patches": [
+            "@@//bazel:cc_rs.patch"
+          ]
         }
       },
       "targets": [
@@ -35019,7 +35040,10 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Cstrip=none",
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -42704,6 +42728,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "data": {
+          "common": [
+            "@openssl//:gen_dir"
+          ],
+          "selects": {}
+        },
         "data_glob": [
           "**"
         ],
@@ -42887,7 +42917,8 @@
         ],
         "crate_features": {
           "common": [
-            "libc"
+            "libc",
+            "static"
           ],
           "selects": {}
         },
@@ -49931,6 +49962,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "data": {
+          "common": [
+            "@openssl//:gen_dir"
+          ],
+          "selects": {}
+        },
         "data_glob": [
           "**"
         ],
@@ -49951,6 +49988,15 @@
           ],
           "selects": {}
         },
+        "build_script_env": {
+          "common": {
+            "OPENSSL_INCLUDE_DIR": "$(location @openssl//:gen_dir)/include",
+            "OPENSSL_LIB_DIR": "$(location @openssl//:gen_dir)/lib64",
+            "OPENSSL_NO_VENDOR": "1",
+            "OPENSSL_STATIC": "1"
+          },
+          "selects": {}
+        },
         "links": "openssl"
       },
       "license": "MIT",
@@ -87057,7 +87103,10 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Cstrip=none",
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },

Cargo.Bazel.json.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "0263b9a223c42fc2ecc48a3b8183818e33d79e8eb22e2726049e9d5495906a8c",
+  "checksum": "20b0704a5807a13511ee3df0a87cca12700e295b4ee17f61396575ec2dfe27e9",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
@@ -11658,7 +11658,13 @@
       "repository": {
         "Http": {
           "url": "https://static.crates.io/crates/cc/1.1.37/download",
-          "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf"
+          "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf",
+          "patch_args": [
+            "-p1"
+          ],
+          "patches": [
+            "@@//bazel:cc_rs.patch"
+          ]
         }
       },
       "targets": [
@@ -42538,6 +42544,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "data": {
+          "common": [
+            "@openssl//:gen_dir"
+          ],
+          "selects": {}
+        },
         "data_glob": [
           "**"
         ],
@@ -42721,7 +42733,8 @@
         ],
         "crate_features": {
           "common": [
-            "libc"
+            "libc",
+            "static"
           ],
           "selects": {}
         },
@@ -49771,6 +49784,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "data": {
+          "common": [
+            "@openssl//:gen_dir"
+          ],
+          "selects": {}
+        },
         "data_glob": [
           "**"
         ],
@@ -49791,6 +49810,15 @@
           ],
           "selects": {}
         },
+        "build_script_env": {
+          "common": {
+            "OPENSSL_INCLUDE_DIR": "$(location @openssl//:gen_dir)/include",
+            "OPENSSL_LIB_DIR": "$(location @openssl//:gen_dir)/lib64",
+            "OPENSSL_NO_VENDOR": "1",
+            "OPENSSL_STATIC": "1"
+          },
+          "selects": {}
+        },
         "links": "openssl"
       },
       "license": "MIT",

MODULE.bazel

@@ -7,13 +7,20 @@ module(
 )
 
 # General Bazel helpers
-
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "aspect_bazel_lib", version = "2.9.0")
 
 # CC dependencies (for C libs like miracl-core, etc)
 bazel_dep(name = "rules_cc", version = "0.0.13")
 bazel_dep(name = "platforms", version = "0.0.10")
+bazel_dep(name = "hermetic_cc_toolchain", version = "3.1.1")
+archive_override(
+    module_name = "hermetic_cc_toolchain",
+    integrity = "sha256-kHdFv5FVX3foI0wLlTNx5srFunFdHPEv9kFJbdG86dE=",
+    patch_strip = 1,
+    patches = ["//bazel:hermetic_cc_toolchain.patch"],
+    urls = ["https://github.com/uber/hermetic_cc_toolchain/releases/download/v3.1.1/hermetic_cc_toolchain-v3.1.1.tar.gz"],
+)
 
 # configure/make dependencies
 bazel_dep(name = "rules_foreign_cc", version = "0.12.0")
@@ -833,3 +840,28 @@ mainnet_icos_versions(
     name = "mainnet_icos_versions",
     path = "//:mainnet-icos-revisions.json",
 )
+
+# Set up hermetic cc toolchains for binaries and canisters
+toolchains = use_extension("@hermetic_cc_toolchain//toolchain:ext.bzl", "toolchains")
+
+# The use_hermetic_cc setting is added to each toolchain to allow us to opt out
+# in favor of system toolchains, when needed.
+toolchains.extra_settings(settings = ["//bazel:use_hermetic_cc"])
+use_repo(toolchains, "zig_sdk")
+
+register_toolchains(
+    # Linux toolchains
+    "@zig_sdk//toolchain:linux_amd64_gnu.2.28",
+
+    # macOS toolchains
+    # Do not use hermetic toolchains for macOS until we have had a chance to
+    # wrap the various system libraries.
+    # "@zig_sdk//toolchain:darwin_amd64",
+    # "@zig_sdk//toolchain:darwin_arm64",
+
+    # wasm toolchains
+    "@zig_sdk//toolchain:none_wasm",
+
+    # These toolchains are only registered locally.
+    dev_dependency = True,
+)

WORKSPACE.bazel

@@ -5,7 +5,9 @@ workspace(
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("//bazel:mainnet-canisters.bzl", "canisters")
 load("//third_party/jemalloc:repository.bzl", "jemalloc_repository")
+load("//third_party/libfuzzer:repository.bzl", "libfuzzer_repository")
 load("//third_party/lmdb:repository.bzl", "lmdb_repository")
+load("//third_party/openssl:repository.bzl", "openssl_repository")
 
 # We cannot derive the Bazel repository names (e.g. @mainnet_nns_registry_canister) directly
 # from the canister names because we use inconsistent repo names. Same goes for filenames.
@@ -172,6 +174,10 @@ lmdb_repository()
 
 jemalloc_repository()
 
+openssl_repository()
+
+libfuzzer_repository()
+
 http_archive(
     name = "buildifier_prebuilt",
     sha256 = "72b5bb0853aac597cce6482ee6c62513318e7f2c0050bc7c319d75d03d8a3875",
@@ -266,3 +272,29 @@ sns_quill(name = "sns_quill")
 load("//bazel:idl2json.bzl", "idl_to_json")
 
 idl_to_json(name = "idl2json")
+
+# Use libsystemd from the host environment
+# Ideally this is pulled hermetically, but as this is only used by infogetty
+# within IC images, we have less compatibility to worry about, and packaging it
+# this way is easier.
+new_local_repository(
+    name = "libsystemd",
+    build_file_content = """
+cc_import(
+    name = "libsystemd-internal",
+    hdrs = glob(["include/systemd/*.h"]),
+    interface_library = "lib/x86_64-linux-gnu/libsystemd.so",
+    system_provided = True,
+    visibility = ["//visibility:private"],
+)
+
+# Use an extra cc_library to hide the depth of the include folder
+cc_library(
+    name = "libsystemd",
+    includes = ["include"],
+    deps = ["libsystemd-internal"],
+    visibility = ["//visibility:public"],
+)
+""",
+    path = "/usr",
+)

bazel/BUILD.bazel

@@ -40,6 +40,20 @@ config_setting(
     },
 )
 
+# Allow targets to opt out of hermetic toolchains, in favor of the one provided
+# by the system
+bool_flag(
+    name = "hermetic_cc",
+    build_setting_default = True,
+)
+
+config_setting(
+    name = "use_hermetic_cc",
+    flag_values = {
+        ":hermetic_cc": "True",
+    },
+)
+
 string_flag(
     name = "timeout_value",
     build_setting_default = "10m",

bazel/cc_rs.patch

@@ -0,0 +1,23 @@
+# Adjust target naming to match what zig expects.
+#
+# zig does not plan to change their target naming: https://github.com/ziglang/zig/issues/4911
+# and cc-rs is waiting on a 1.0 release to support zig's scheme: https://github.com/rust-lang/cc-rs/pull/986
+# Other related links: https://github.com/bazelbuild/rules_rust/issues/2529
+#                      https://github.com/Asana/cc-rs
+diff --git a/src/lib.rs b/src/lib.rs
+index f75b951..8e770a7 100644
+--- a/src/lib.rs
++++ b/src/lib.rs
+@@ -2091,6 +2091,12 @@ impl Build {
+                         target.versioned_llvm_target(None)
+                     };
+
++                    let llvm_target = match llvm_target.clone() {
++                        std::borrow::Cow::Borrowed("x86_64-unknown-linux-gnu") => "x86_64-linux-gnu",
++                        std::borrow::Cow::Borrowed("wasm32-unknown-unknown") => "wasm32-freestanding-musl",
++                        _other => &llvm_target,
++                    };
++
+                     // Pass `--target` with the LLVM target to properly
+                     // configure Clang even when cross-compiling.
+                     cmd.push_cc_arg(format!("--target={llvm_target}").into());