From 1e14d4acdb0ed44798870b99e462bc85142d18a4 Mon Sep 17 00:00:00 2001 From: Nicolas Mattia Date: Tue, 3 Dec 2024 13:55:06 +0100 Subject: [PATCH 01/28] use hermetic toolchains --- MODULE.bazel | 19 ++++++++++++++++++- bazel/conf/.bazelrc.build | 5 ----- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index 92c2d0023ae0..350dcce64296 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -7,13 +7,13 @@ module( ) # General Bazel helpers - bazel_dep(name = "bazel_skylib", version = "1.7.1") bazel_dep(name = "aspect_bazel_lib", version = "2.9.0") # CC dependencies (for C libs like miracl-core, etc) bazel_dep(name = "rules_cc", version = "0.0.13") bazel_dep(name = "platforms", version = "0.0.10") +bazel_dep(name = "hermetic_cc_toolchain", version = "3.1.1") # configure/make dependencies bazel_dep(name = "rules_foreign_cc", version = "0.12.0") @@ -837,3 +837,20 @@ mainnet_icos_versions( os_info = use_repo_rule("//bazel:os_info.bzl", "os_info") os_info(name = "os_info") + +# ... + +toolchains = use_extension("@hermetic_cc_toolchain//toolchain:ext.bzl", "toolchains") +use_repo(toolchains, "zig_sdk") + +register_toolchains( + # if no `--platform` is specified, these toolchains will be used for + # (linux,darwin,windows)x(amd64,arm64) + "@zig_sdk//toolchain:linux_amd64_gnu.2.28", + + # wasm/wasi toolchains + "@zig_sdk//toolchain:wasip1_wasm", + + # These toolchains are only registered locally. + dev_dependency = True, +) diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build index 0c5fd0cc1854..373b06c03724 100644 --- a/bazel/conf/.bazelrc.build +++ b/bazel/conf/.bazelrc.build @@ -126,11 +126,6 @@ run:sandbox_fuzzing --run_under="ASAN_OPTIONS=detect_leaks=0:allow_user_segv_han query --ui_event_filters=-info,-debug --noshow_progress cquery --ui_event_filters=-info,-debug --noshow_progress -# The default value makes rules_rust pick a dummy toolchain that breaks -# our canister that depend on C deps -# https://github.com/bazelbuild/rules_rust/issues/2764 -common --noincompatible_enable_cc_toolchain_resolution - # This is disabled by default on bazel 7+ some of our targets choke # on this (not yet clear why) common --remote_download_all From f514ff0ffbc02ff1bd942a0772e98e3688e9908f Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Wed, 11 Dec 2024 19:11:07 +0000 Subject: [PATCH 02/28] Fix infogetty Wrap the dev container's libsystemd. This should be OK because infogetty is only used inside our images, which currently run a version that is equal to or more recent than that of the build container. --- WORKSPACE.bazel | 24 ++++++++++++++++++++++++ cpp/BUILD.bazel | 1 + 2 files changed, 25 insertions(+) diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel index c45fc0ef78ae..39f4549f05e5 100644 --- a/WORKSPACE.bazel +++ b/WORKSPACE.bazel @@ -269,3 +269,27 @@ mainnet_icos_images() load("//bazel:spawn_proto_library.bzl", "spawn_proto_library") spawn_proto_library(name = "spawn_proto_library") + +# Use libsystemd from the host environment +# Ideally this is pulled hermetically, but as this is only used by infogetty +# within IC images, we have less compatibility to worry about, and packaging it +# this way is easier. +new_local_repository( + name = "libsystemd", + build_file_content = """ +cc_import( + name = "libsystemd-internal", + hdrs = glob(["include/systemd/*.h"]), + interface_library = "lib/x86_64-linux-gnu/libsystemd.so", + system_provided = True, + visibility = ["//visibility:private"], +) +# Use an extra cc_library to hide the depth of the include folder +cc_library( + name = "libsystemd", + includes = ["include"], + deps = ["libsystemd-internal"], + visibility = ["//visibility:public"], +)""", + path = "/usr", +) diff --git a/cpp/BUILD.bazel b/cpp/BUILD.bazel index 6f0dad10bd30..d90f295ccb3f 100644 --- a/cpp/BUILD.bazel +++ b/cpp/BUILD.bazel @@ -14,6 +14,7 @@ cc_binary( target_compatible_with = [ "@platforms//os:linux", ], + deps = ["@libsystemd"], ) genrule( From 8899894336463f0eed3719e09e0ac50bf3ae12cb Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Fri, 17 Jan 2025 23:36:35 +0000 Subject: [PATCH 03/28] Fix wasm! Patch hermetic_cc_toolchain to support a freestanding wasm toolchain. --- MODULE.bazel | 12 +++-- bazel/cc_rs.patch | 18 ++++++++ bazel/conf/.bazelrc.build | 5 +++ bazel/external_crates.bzl | 4 ++ bazel/hermetic_cc_toolchain.patch | 73 +++++++++++++++++++++++++++++++ 5 files changed, 108 insertions(+), 4 deletions(-) create mode 100644 bazel/cc_rs.patch create mode 100644 bazel/hermetic_cc_toolchain.patch diff --git a/MODULE.bazel b/MODULE.bazel index 350dcce64296..e6e48e4a141c 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -14,6 +14,11 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.9.0") bazel_dep(name = "rules_cc", version = "0.0.13") bazel_dep(name = "platforms", version = "0.0.10") bazel_dep(name = "hermetic_cc_toolchain", version = "3.1.1") +single_version_override( + module_name = "hermetic_cc_toolchain", + patch_strip = 1, + patches = ["//bazel:hermetic_cc_toolchain.patch"], +) # configure/make dependencies bazel_dep(name = "rules_foreign_cc", version = "0.12.0") @@ -838,8 +843,7 @@ os_info = use_repo_rule("//bazel:os_info.bzl", "os_info") os_info(name = "os_info") -# ... - +# Set up hermetic cc toolchains for binaries and canisters toolchains = use_extension("@hermetic_cc_toolchain//toolchain:ext.bzl", "toolchains") use_repo(toolchains, "zig_sdk") @@ -848,8 +852,8 @@ register_toolchains( # (linux,darwin,windows)x(amd64,arm64) "@zig_sdk//toolchain:linux_amd64_gnu.2.28", - # wasm/wasi toolchains - "@zig_sdk//toolchain:wasip1_wasm", + # wasm toolchains + "@zig_sdk//toolchain:none_wasm", # These toolchains are only registered locally. dev_dependency = True, diff --git a/bazel/cc_rs.patch b/bazel/cc_rs.patch new file mode 100644 index 000000000000..b1a1c1bc192f --- /dev/null +++ b/bazel/cc_rs.patch @@ -0,0 +1,18 @@ +# Adjust target naming to match what zig expects. +diff --git a/src/lib.rs b/src/lib.rs +index f75b951..8e770a7 100644 +--- a/src/lib.rs ++++ b/src/lib.rs +@@ -2091,6 +2091,12 @@ impl Build { + target.versioned_llvm_target(None) + }; + ++ let llvm_target = match llvm_target.clone() { ++ std::borrow::Cow::Borrowed("x86_64-unknown-linux-gnu") => "x86_64-linux-gnu", ++ std::borrow::Cow::Borrowed("wasm32-unknown-unknown") => "wasm32-freestanding-musl", ++ _other => &llvm_target, ++ }; ++ + // Pass `--target` with the LLVM target to properly + // configure Clang even when cross-compiling. + cmd.push_cc_arg(format!("--target={llvm_target}").into()); diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build index 373b06c03724..4c2c4b10088a 100644 --- a/bazel/conf/.bazelrc.build +++ b/bazel/conf/.bazelrc.build @@ -141,3 +141,8 @@ test --test_env=CLICOLOR_FORCE=true # Give canceled actions some more time to cleanup common --local_termination_grace_seconds=90 + +# Always compile with zig cc +# https://github.com/uber/hermetic_cc_toolchain/tree/8e68b7221ca72c10268338eb1734530438e5ccb7?tab=readme-ov-file#use-case-always-compile-with-zig-cc +build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1 +build --sandbox_add_mount_pair=/tmp diff --git a/bazel/external_crates.bzl b/bazel/external_crates.bzl index 869980b8ca45..cb88b177463d 100644 --- a/bazel/external_crates.bzl +++ b/bazel/external_crates.bzl @@ -27,6 +27,10 @@ def external_crates_repository(name, cargo_lockfile, lockfile, sanitizers_enable "canbench": [crate.annotation( gen_binaries = True, )], + "cc": [crate.annotation( + patch_args = ["-p1"], + patches = ["@@//bazel:cc_rs.patch"], + )], "libssh2-sys": [crate.annotation( # Patch for determinism issues patch_args = ["-p1"], diff --git a/bazel/hermetic_cc_toolchain.patch b/bazel/hermetic_cc_toolchain.patch new file mode 100644 index 000000000000..afbed7c19d0c --- /dev/null +++ b/bazel/hermetic_cc_toolchain.patch @@ -0,0 +1,73 @@ +# Extend hermetic_cc_toolchain with a wasm target that does not use wasi. +diff --git a/MODULE.bazel b/MODULE.bazel +index 409d626..1265298 100644 +--- a/MODULE.bazel ++++ b/MODULE.bazel +@@ -49,6 +49,7 @@ register_toolchains( + "@zig_sdk//libc_aware/toolchain:linux_arm64_musl", + # wasm/wasi toolchains + "@zig_sdk//toolchain:wasip1_wasm", ++ "@zig_sdk//toolchain:none_wasm", + + # These toolchains are only registered locally. + dev_dependency = True, +diff --git a/toolchain/platform/defs.bzl b/toolchain/platform/defs.bzl +index d4a8344..faafc5b 100644 +--- a/toolchain/platform/defs.bzl ++++ b/toolchain/platform/defs.bzl +@@ -16,6 +16,7 @@ def declare_platforms(): + + # We can support GOARCH=wasm32 after https://github.com/golang/go/issues/63131 + declare_platform("wasm", "wasm32", "wasi", "wasip1") ++ declare_platform("wasm", "wasm32", "none", "none") + + def declare_libc_aware_platforms(): + # create @zig_sdk//{os}_{arch}_platform entries with zig and go conventions +diff --git a/toolchain/private/defs.bzl b/toolchain/private/defs.bzl +index 716a3a3..b88d082 100644 +--- a/toolchain/private/defs.bzl ++++ b/toolchain/private/defs.bzl +@@ -49,6 +49,7 @@ def target_structs(): + for glibc in _GLIBCS: + ret.append(_target_linux_gnu(gocpu, zigcpu, glibc)) + ret.append(_target_wasm()) ++ ret.append(_target_wasm_no_wasi()) + return ret + + def _target_macos(gocpu, zigcpu): +@@ -222,3 +223,22 @@ def _target_wasm(): + ld_zig_subcmd = "wasm-ld", + artifact_name_patterns = [], + ) ++ ++def _target_wasm_no_wasi(): ++ return struct( ++ gotarget = "none_wasm", ++ zigtarget = "wasm32-freestanding-musl", ++ includes = [] + _INCLUDE_TAIL, ++ linkopts = [], ++ dynamic_library_linkopts = [], ++ supports_dynamic_linker = False, ++ copts = [], ++ libc = "musl", ++ bazel_target_cpu = "wasm32", ++ constraint_values = [ ++ "@platforms//os:none", ++ "@platforms//cpu:wasm32", ++ ], ++ ld_zig_subcmd = "wasm-ld", ++ artifact_name_patterns = [], ++ ) +diff --git a/toolchain/zig-wrapper.zig b/toolchain/zig-wrapper.zig +index d1d59f9..5e2984b 100644 +--- a/toolchain/zig-wrapper.zig ++++ b/toolchain/zig-wrapper.zig +@@ -283,7 +283,7 @@ fn getRunMode(self_exe: []const u8, self_base_noexe: []const u8) error{BadParent + return error.BadParent; + + const got_os = it.next() orelse return error.BadParent; +- if (mem.indexOf(u8, "linux,macos,windows,wasi", got_os) == null) ++ if (mem.indexOf(u8, "linux,macos,windows,wasi,freestanding", got_os) == null) + return error.BadParent; + + // ABI triple is too much of a moving target From 318640d800b72fb5bb5878ae06d1ca0bf467e6d0 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Thu, 30 Jan 2025 23:50:22 +0000 Subject: [PATCH 04/28] Fix libfuzzer! Build libfuzzer ourselves to avoid a stdlib mismatch from the hermetic cc toolchains, and adjust to zig conventions. --- MODULE.bazel | 23 +++++++++++++++++++++++ bazel/fuzz_testing.bzl | 15 ++++++++------- 2 files changed, 31 insertions(+), 7 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index e6e48e4a141c..56848cc982f7 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -858,3 +858,26 @@ register_toolchains( # These toolchains are only registered locally. dev_dependency = True, ) + +# Build libfuzzer to ensure compatibility with our toolchain, and so that it +# can be optionally linked by the fuzzers. +http_archive( + name = "libfuzzer", + build_file_content = """ +load("@rules_cc//cc:defs.bzl", "cc_library") + +cc_library( + name = "fuzzer", + srcs = glob(["*.cpp"]), + hdrs = glob(["*.h"]), + additional_compiler_inputs = glob(["*.def"]), + cxxopts = ["-g", "-O2", "-fno-omit-frame-pointer", "-std=c++17"], + linkstatic = True, + visibility = ["//visibility:public"], +) + +""", + integrity = "sha256-CLw4JzN3fdo8liWeNzL/lsHfmNBHDE+FsWMnTq5of08=", + strip_prefix = "llvm-project-llvmorg-20.1.0/compiler-rt/lib/fuzzer", + urls = ["https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-20.1.0.tar.gz"], +) diff --git a/bazel/fuzz_testing.bzl b/bazel/fuzz_testing.bzl index 205dc5a3c65f..e83fbeba3407 100644 --- a/bazel/fuzz_testing.bzl +++ b/bazel/fuzz_testing.bzl @@ -32,6 +32,12 @@ DEFAULT_SANITIZERS = [ # This flag will be used by third party crates and internal rust_libraries during fuzzing DEFAULT_RUSTC_FLAGS_FOR_FUZZING = DEFAULT_RUSTC_FLAGS + DEFAULT_SANITIZERS +# zig doesn't like how rustc pushes the sanitizers, so do it ourselves. +ZIG_LINK_ARGS = [ + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a", +] + def rust_fuzz_test_binary(name, srcs, rustc_flags = [], sanitizers = [], crate_features = [], proc_macro_deps = [], deps = [], allow_main = False, **kwargs): """Wrapper for the rust_binary to compile a fuzzing rust_binary @@ -53,18 +59,12 @@ def rust_fuzz_test_binary(name, srcs, rustc_flags = [], sanitizers = [], crate_f # This would only work inside the devcontainer if allow_main: - FUZZER_LIB = [ - "-Clink-arg=/usr/lib/llvm-18/lib/clang/18/lib/linux/libclang_rt.fuzzer_no_main-x86_64.a", - ] TAGS = ["sandbox_libfuzzer"] else: # default - FUZZER_LIB = [ - "-Clink-arg=/usr/lib/llvm-18/lib/clang/18/lib/linux/libclang_rt.fuzzer-x86_64.a", - ] TAGS = [] - RUSTC_FLAGS_LIBFUZZER = DEFAULT_RUSTC_FLAGS + FUZZER_LIB + RUSTC_FLAGS_LIBFUZZER = DEFAULT_RUSTC_FLAGS + ZIG_LINK_ARGS + ["-Clink-arg=$(location @libfuzzer//:fuzzer)"] kwargs.setdefault("testonly", True) @@ -75,6 +75,7 @@ def rust_fuzz_test_binary(name, srcs, rustc_flags = [], sanitizers = [], crate_f crate_features = crate_features + ["fuzzing"], proc_macro_deps = proc_macro_deps, deps = deps, + compile_data = ["@libfuzzer//:fuzzer"], rustc_flags = rustc_flags + RUSTC_FLAGS_LIBFUZZER + sanitizers, tags = [ # Makes sure this target is not run in normal CI builds. It would fail due to non-nightly Rust toolchain. From 12f992854e0c1e3e3925f75bf5733ceed085d409 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Sat, 1 Feb 2025 20:41:17 +0000 Subject: [PATCH 05/28] Fix hs Add extra configuration settings to hermetic_cc_toolchains, to allow hs targets to opt out. GHC is very particular about the toolchains it uses, and does not support zig cc. --- MODULE.bazel | 1 + bazel/BUILD.bazel | 12 +++ bazel/conf/.bazelrc.build | 4 +- bazel/hermetic_cc_toolchain.patch | 139 +++++++++++++++++++++++++++++- hs/spec_compliance/BUILD.bazel | 60 ++++++++++++- hs/spec_compliance/defs.bzl | 36 ++++++++ 6 files changed, 247 insertions(+), 5 deletions(-) create mode 100644 hs/spec_compliance/defs.bzl diff --git a/MODULE.bazel b/MODULE.bazel index 56848cc982f7..83d3eaca7e1a 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -845,6 +845,7 @@ os_info(name = "os_info") # Set up hermetic cc toolchains for binaries and canisters toolchains = use_extension("@hermetic_cc_toolchain//toolchain:ext.bzl", "toolchains") +toolchains.extra_settings(settings = ["//bazel:use_hermetic_cc"]) use_repo(toolchains, "zig_sdk") register_toolchains( diff --git a/bazel/BUILD.bazel b/bazel/BUILD.bazel index 310f14c95098..49636ed54799 100644 --- a/bazel/BUILD.bazel +++ b/bazel/BUILD.bazel @@ -53,6 +53,18 @@ config_setting( }, ) +bool_flag( + name = "hermetic_cc", + build_setting_default = True, +) + +config_setting( + name = "use_hermetic_cc", + flag_values = { + ":hermetic_cc": "True", + }, +) + string_flag( name = "timeout_value", build_setting_default = "10m", diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build index 4c2c4b10088a..ea2c7b990c3b 100644 --- a/bazel/conf/.bazelrc.build +++ b/bazel/conf/.bazelrc.build @@ -142,7 +142,5 @@ test --test_env=CLICOLOR_FORCE=true # Give canceled actions some more time to cleanup common --local_termination_grace_seconds=90 -# Always compile with zig cc -# https://github.com/uber/hermetic_cc_toolchain/tree/8e68b7221ca72c10268338eb1734530438e5ccb7?tab=readme-ov-file#use-case-always-compile-with-zig-cc -build --action_env BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1 +# Speed up compilation with zig cc build --sandbox_add_mount_pair=/tmp diff --git a/bazel/hermetic_cc_toolchain.patch b/bazel/hermetic_cc_toolchain.patch index afbed7c19d0c..3c4fa0e02951 100644 --- a/bazel/hermetic_cc_toolchain.patch +++ b/bazel/hermetic_cc_toolchain.patch @@ -1,4 +1,5 @@ -# Extend hermetic_cc_toolchain with a wasm target that does not use wasi. +# Extend hermetic_cc_toolchain with a wasm target that does not use wasi, and +# add a path to put additional restrictions on the generated toolchains. diff --git a/MODULE.bazel b/MODULE.bazel index 409d626..1265298 100644 --- a/MODULE.bazel @@ -11,6 +12,87 @@ index 409d626..1265298 100644 # These toolchains are only registered locally. dev_dependency = True, +diff --git a/toolchain/defs.bzl b/toolchain/defs.bzl +index f6f613e..02d5597 100644 +--- a/toolchain/defs.bzl ++++ b/toolchain/defs.bzl +@@ -60,7 +60,8 @@ def toolchains( + version = VERSION, + url_formats = [], + host_platform_sha256 = HOST_PLATFORM_SHA256, +- host_platform_ext = _HOST_PLATFORM_EXT): ++ host_platform_ext = _HOST_PLATFORM_EXT, ++ extra_settings = []): + """ + Download zig toolchain and declare bazel toolchains. + The platforms are not registered automatically, that should be done by +@@ -83,6 +84,7 @@ def toolchains( + url_formats = url_formats, + host_platform_sha256 = host_platform_sha256, + host_platform_ext = host_platform_ext, ++ extra_settings = extra_settings + ) + + def _quote(s): +@@ -110,6 +112,8 @@ def _zig_repository_impl(repository_ctx): + "host_platform": host_platform, + } + ++ extra_settings = "[" + " ".join([_quote(str(setting)) for setting in repository_ctx.attr.extra_settings]) + "]" ++ + # Fetch Label dependencies before doing download/extract. + # The Bazel docs are not very clear about this behavior but see: + # https://bazel.build/extending/repo#when_is_the_implementation_function_executed +@@ -117,7 +121,6 @@ def _zig_repository_impl(repository_ctx): + # https://github.com/bazelbuild/bazel-gazelle/pull/1206 + for dest, src in { + "platform/BUILD": "//toolchain/platform:BUILD", +- "toolchain/BUILD": "//toolchain/toolchain:BUILD", + "libc/BUILD": "//toolchain/libc:BUILD", + "libc_aware/platform/BUILD": "//toolchain/libc_aware/platform:BUILD", + "libc_aware/toolchain/BUILD": "//toolchain/libc_aware/toolchain:BUILD", +@@ -126,6 +129,7 @@ def _zig_repository_impl(repository_ctx): + + for dest, src in { + "BUILD": "//toolchain:BUILD.sdk.bazel", ++ "toolchain/BUILD": "//toolchain/toolchain:BUILD", + }.items(): + repository_ctx.template( + dest, +@@ -134,6 +138,7 @@ def _zig_repository_impl(repository_ctx): + substitutions = { + "{zig_sdk_path}": _quote("external/zig_sdk"), + "{os}": _quote(os), ++ "{extra_settings}": extra_settings, + }, + ) + +@@ -230,6 +235,7 @@ zig_repository = repository_rule( + "host_platform_sha256": attr.string_dict(), + "url_formats": attr.string_list(allow_empty = False), + "host_platform_ext": attr.string_dict(), ++ "extra_settings": attr.label_list(), + }, + environ = ["HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX"], + implementation = _zig_repository_impl, +diff --git a/toolchain/ext.bzl b/toolchain/ext.bzl +index ebf0ff8..c2e8af3 100644 +--- a/toolchain/ext.bzl ++++ b/toolchain/ext.bzl +@@ -1,6 +1,11 @@ + load("@hermetic_cc_toolchain//toolchain:defs.bzl", zig_toolchains = "toolchains") + + def _toolchains_impl(ctx): +- zig_toolchains() ++ extra_settings = [] ++ for mod in ctx.modules: ++ for tag in mod.tags.extra_settings: ++ extra_settings += tag.settings + +-toolchains = module_extension(implementation = _toolchains_impl) ++ zig_toolchains(extra_settings = extra_settings) ++ ++toolchains = module_extension(implementation = _toolchains_impl, tag_classes = { "extra_settings": tag_class(attrs = { "settings": attr.label_list(doc = "Each setting is added to every toolchain to make them more restrictive.")})}) diff --git a/toolchain/platform/defs.bzl b/toolchain/platform/defs.bzl index d4a8344..faafc5b 100644 --- a/toolchain/platform/defs.bzl @@ -71,3 +153,58 @@ index d1d59f9..5e2984b 100644 return error.BadParent; // ABI triple is too much of a moving target +diff --git a/toolchain/toolchain/BUILD b/toolchain/toolchain/BUILD +index 552fcaa..8f7dba5 100644 +--- a/toolchain/toolchain/BUILD ++++ b/toolchain/toolchain/BUILD +@@ -4,4 +4,4 @@ package( + default_visibility = ["//visibility:public"], + ) + +-declare_toolchains() ++declare_toolchains(extra_settings = {extra_settings}) +diff --git a/toolchain/toolchain/defs.bzl b/toolchain/toolchain/defs.bzl +index 50cc881..0549c26 100644 +--- a/toolchain/toolchain/defs.bzl ++++ b/toolchain/toolchain/defs.bzl +@@ -1,6 +1,6 @@ + load("@hermetic_cc_toolchain//toolchain/private:defs.bzl", "target_structs") + +-def declare_toolchains(): ++def declare_toolchains(extra_settings = []): + for target_config in target_structs(): + gotarget = target_config.gotarget + zigtarget = target_config.zigtarget +@@ -12,7 +12,7 @@ def declare_toolchains(): + if hasattr(target_config, "libc_constraint"): + extra_constraints = ["@zig_sdk//libc:unconstrained"] + +- _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + extra_constraints) ++ _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + extra_constraints, extra_settings) + + def declare_libc_aware_toolchains(): + for target_config in target_structs(): +@@ -25,13 +25,14 @@ def declare_libc_aware_toolchains(): + if hasattr(target_config, "libc_constraint"): + _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + [target_config.libc_constraint]) + +-def _declare_toolchain(gotarget, zigtarget, target_compatible_with): ++def _declare_toolchain(gotarget, zigtarget, target_compatible_with, extra_settings): + # register two kinds of toolchain targets: Go and Zig conventions. + # Go convention: amd64/arm64, linux/darwin + native.toolchain( + name = gotarget, + exec_compatible_with = None, + target_compatible_with = target_compatible_with, ++ target_settings = extra_settings, + toolchain = "@zig_sdk//:%s_cc" % zigtarget, + toolchain_type = "@bazel_tools//tools/cpp:toolchain_type", + ) +@@ -41,6 +42,7 @@ def _declare_toolchain(gotarget, zigtarget, target_compatible_with): + name = zigtarget, + exec_compatible_with = None, + target_compatible_with = target_compatible_with, ++ target_settings = extra_settings, + toolchain = "@zig_sdk//:%s_cc" % zigtarget, + toolchain_type = "@bazel_tools//tools/cpp:toolchain_type", + ) diff --git a/hs/spec_compliance/BUILD.bazel b/hs/spec_compliance/BUILD.bazel index 7dd71a755810..539bc6e755ed 100644 --- a/hs/spec_compliance/BUILD.bazel +++ b/hs/spec_compliance/BUILD.bazel @@ -1,4 +1,5 @@ load("@rules_haskell//haskell:defs.bzl", "haskell_binary", "haskell_library") +load("defs.bzl", "disable_hermetic_cc_binary") STACK_DEPS = [ # Keep sorted. @@ -72,6 +73,12 @@ STACK_DEPS = [ "@stackage//:zlib", ] +disable_hermetic_cc_binary( + name = "ic-ref-test-wrapped", + binary = ":ic-ref-test", + visibility = ["//visibility:public"], +) + haskell_binary( name = "ic-ref-test", srcs = [ @@ -81,8 +88,8 @@ haskell_binary( "-threaded", # use the threaded Run Time System (RTS) "-rtsopts", # allow passing RTS options like: +RTS -N -RTS ], + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], - visibility = ["//visibility:public"], deps = STACK_DEPS + [ ":IC-CBOR-Parser", ":IC-CBOR-Patterns", @@ -142,6 +149,7 @@ haskell_library( name = "IC-Crypto-BLS", srcs = ["src/IC/Crypto/BLS.hsc"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -155,6 +163,7 @@ haskell_library( name = "IC-Id-Fresh", srcs = ["src/IC/Id/Fresh.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -168,6 +177,7 @@ haskell_library( name = "IC-Id-Forms", srcs = ["src/IC/Id/Forms.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Hash", @@ -180,6 +190,7 @@ haskell_library( name = "IC-Utils", srcs = ["src/IC/Utils.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Constants", @@ -194,6 +205,7 @@ haskell_library( name = "IC-Certificate", srcs = ["src/IC/Certificate.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HashTree", @@ -206,6 +218,7 @@ haskell_library( name = "IC-Management", srcs = ["src/IC/Management.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Types", @@ -218,6 +231,7 @@ haskell_library( name = "IC-Purify", srcs = ["src/IC/Purify.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -229,6 +243,7 @@ haskell_library( name = "IC-Crypto", srcs = ["src/IC/Crypto.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-BLS", @@ -247,6 +262,7 @@ haskell_library( name = "IC-HTTP-RequestId", srcs = ["src/IC/HTTP/RequestId.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HTTP-GenR", @@ -261,6 +277,7 @@ haskell_library( name = "IC-HTTP-CBOR", srcs = ["src/IC/HTTP/CBOR.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HTTP-GenR", @@ -273,6 +290,7 @@ haskell_library( name = "IC-HTTP-GenR", srcs = ["src/IC/HTTP/GenR.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -284,6 +302,7 @@ haskell_library( name = "IC-HTTP-GenR-Parse", srcs = ["src/IC/HTTP/GenR/Parse.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HTTP-GenR", @@ -296,6 +315,7 @@ haskell_library( name = "IC-Types", srcs = ["src/IC/Types.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -307,6 +327,7 @@ haskell_library( name = "IC-HashTree-CBOR", srcs = ["src/IC/HashTree/CBOR.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Patterns", @@ -320,6 +341,7 @@ haskell_library( name = "IC-HashTree", srcs = ["src/IC/HashTree.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -331,6 +353,7 @@ haskell_library( name = "IC-Constants", srcs = ["src/IC/Constants.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Types", @@ -343,6 +366,7 @@ haskell_library( name = "IC-Certificate-Value", srcs = ["src/IC/Certificate/Value.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Types", @@ -356,6 +380,7 @@ haskell_library( name = "IC-Certificate-Validate", srcs = ["src/IC/Certificate/Validate.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Certificate", @@ -372,6 +397,7 @@ haskell_library( name = "IC-Certificate-CBOR", srcs = ["src/IC/Certificate/CBOR.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Parser", @@ -388,6 +414,7 @@ haskell_library( name = "IC-Crypto-Secp256k1", srcs = ["src/IC/Crypto/Secp256k1.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -399,6 +426,7 @@ haskell_library( name = "IC-Crypto-Ed25519", srcs = ["src/IC/Crypto/Ed25519.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -410,6 +438,7 @@ haskell_library( name = "IC-Crypto-DER-Decode", srcs = ["src/IC/Crypto/DER/Decode.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -421,6 +450,7 @@ haskell_library( name = "IC-Crypto-DER", srcs = ["src/IC/Crypto/DER.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-DER-Decode", @@ -433,6 +463,7 @@ haskell_library( name = "IC-Crypto-DER_BLS", srcs = ["src/IC/Crypto/DER_BLS.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-BLS", @@ -446,6 +477,7 @@ haskell_library( name = "IC-Crypto-WebAuthn", srcs = ["src/IC/Crypto/WebAuthn.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Parser", @@ -463,6 +495,7 @@ haskell_library( name = "IC-Crypto-CanisterSig", srcs = ["src/IC/Crypto/CanisterSig.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Parser", @@ -483,6 +516,7 @@ haskell_library( name = "IC-Crypto-ECDSA", srcs = ["src/IC/Crypto/ECDSA.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -494,6 +528,7 @@ haskell_library( name = "IC-Version", srcs = ["src/IC/Version.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":SourceId", @@ -506,6 +541,7 @@ haskell_library( name = "IC-Hash", srcs = ["src/IC/Hash.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -517,6 +553,7 @@ haskell_library( name = "IC-CBOR-Utils", srcs = ["src/IC/CBOR/Utils.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HTTP-CBOR", @@ -531,6 +568,7 @@ haskell_library( name = "IC-CBOR-Parser", srcs = ["src/IC/CBOR/Parser.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Patterns", @@ -543,6 +581,7 @@ haskell_library( name = "IC-CBOR-Patterns", srcs = ["src/IC/CBOR/Patterns.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -554,6 +593,7 @@ haskell_library( name = "IC-DRun-Parse", srcs = ["src/IC/DRun/Parse.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -565,6 +605,7 @@ haskell_library( name = "IC-Test-Secp256k1", srcs = ["src/IC/Test/Secp256k1.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-Secp256k1", @@ -577,6 +618,7 @@ haskell_library( name = "IC-Test-Spec", srcs = ["src/IC/Test/Spec.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Certificate", @@ -610,6 +652,7 @@ haskell_library( name = "IC-Test-WebAuthn", srcs = ["src/IC/Test/WebAuthn.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-WebAuthn", @@ -622,6 +665,7 @@ haskell_library( name = "IC-Test-Spec-Utils", srcs = ["src/IC/Test/Spec/Utils.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto", @@ -643,6 +687,7 @@ haskell_library( name = "IC-Test-Spec-CanisterHistory", srcs = ["src/IC/Test/Spec/CanisterHistory.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Hash", @@ -663,6 +708,7 @@ haskell_library( name = "IC-Test-Spec-CanisterVersion", srcs = ["src/IC/Test/Spec/CanisterVersion.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Test-Agent", @@ -680,6 +726,7 @@ haskell_library( name = "IC-Test-Spec-Timer", srcs = ["src/IC/Test/Spec/Timer.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Management", @@ -696,6 +743,7 @@ haskell_library( name = "IC-Test-BLS", srcs = ["src/IC/Test/BLS.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-BLS", @@ -708,6 +756,7 @@ haskell_library( name = "IC-Test-ECDSA", srcs = ["src/IC/Test/ECDSA.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-ECDSA", @@ -720,6 +769,7 @@ haskell_library( name = "IC-Test-Agent", srcs = ["src/IC/Test/Agent.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Certificate", @@ -749,6 +799,7 @@ haskell_library( name = "IC-Test-HashTree", srcs = ["src/IC/Test/HashTree.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HashTree", @@ -762,6 +813,7 @@ haskell_library( name = "IC-Test-Universal", srcs = ["src/IC/Test/Universal.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -773,6 +825,7 @@ haskell_library( name = "IC-Test-Options", srcs = ["src/IC/Test/Options.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Constants", @@ -788,6 +841,7 @@ haskell_library( name = "IC-Test-Agent-UnsafeCalls", srcs = ["src/IC/Test/Agent/UnsafeCalls.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -805,6 +859,7 @@ haskell_library( name = "IC-Test-Agent-SafeCalls", srcs = ["src/IC/Test/Agent/SafeCalls.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -822,6 +877,7 @@ haskell_library( name = "IC-Test-Agent-Calls", srcs = ["src/IC/Test/Agent/Calls.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -836,6 +892,7 @@ haskell_library( name = "IC-Test-Agent-UserCalls", srcs = ["src/IC/Test/Agent/UserCalls.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -851,6 +908,7 @@ haskell_library( name = "SourceId", srcs = ["src/SourceId.hs"], src_strip_prefix = "src", + tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", diff --git a/hs/spec_compliance/defs.bzl b/hs/spec_compliance/defs.bzl new file mode 100644 index 000000000000..2eba1237365f --- /dev/null +++ b/hs/spec_compliance/defs.bzl @@ -0,0 +1,36 @@ +"""Create transition to disable hermetic_cc_toolchains for hs targets.""" + +def _disable_hermetic_cc_transition(_settings, _attr): + return { + "//bazel:hermetic_cc": False, + } + +disable_hermetic_cc_transition = transition( + implementation = _disable_hermetic_cc_transition, + inputs = [], + outputs = [ + "//bazel:hermetic_cc", + ], +) + +def _disable_hermetic_cc_impl(ctx): + bin = ctx.attr.binary[0] + info = bin[DefaultInfo] + + executable = ctx.actions.declare_file(ctx.label.name) + ctx.actions.symlink(output = executable, target_file = ctx.file.binary) + + return [ + DefaultInfo(files = info.files, runfiles = info.default_runfiles, executable = executable), + ] + +disable_hermetic_cc_binary = rule( + implementation = _disable_hermetic_cc_impl, + executable = True, + attrs = { + "_allowlist_function_transition": attr.label( + default = "@bazel_tools//tools/allowlists/function_transition_allowlist", + ), + "binary": attr.label(mandatory = True, cfg = disable_hermetic_cc_transition, allow_single_file = True), + }, +) From 6c21bc21f1d55421c8206583a9a3409339a1d10d Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Mon, 24 Feb 2025 21:59:51 +0000 Subject: [PATCH 06/28] Fix AFL fuzzers AFL requires a linker wrapper to instrument, and this does not integrate very cleanly with the zig hermetic_cc toolchains. Keep these builds on the existing path for now. --- bazel/conf/.bazelrc.build | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build index ea2c7b990c3b..6413f2bab7bd 100644 --- a/bazel/conf/.bazelrc.build +++ b/bazel/conf/.bazelrc.build @@ -46,6 +46,7 @@ common --flag_alias=s3_endpoint=//ci/src/artifacts:s3_endpoint common --flag_alias=s3_upload=//ci/src/artifacts:s3_upload common --flag_alias=k8s=//rs/tests:k8s common --flag_alias=timeout_value=//bazel:timeout_value +common --flag_alias=hermetic_cc=//bazel:hermetic_cc common:stamped --workspace_status_command='$(pwd)/bazel/workspace_status.sh --stamp' common:release --config=stamped --s3_upload=True @@ -113,6 +114,7 @@ build:afl --action_env="LD=afl-clang-lto++" build:afl --action_env="LLVM_CONFIG=llvm-config-18" build:afl --action_env="RANLIB=llvm-ranlib-18" build:afl --config=fuzzing +build:afl --hermetic_cc=false build:afl --build_tag_filters=afl run:afl --run_under="//bin/fuzzing:afl_wrapper" From a0450ec38ae909d0ad62df51167167bea395532f Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Fri, 7 Feb 2025 23:27:24 +0000 Subject: [PATCH 07/28] Fix openssl libs --- MODULE.bazel | 56 +++++++++++++++++++++++++++++++++++++++ bazel/external_crates.bzl | 17 ++++++++++++ 2 files changed, 73 insertions(+) diff --git a/MODULE.bazel b/MODULE.bazel index 83d3eaca7e1a..afd5dc00d9f8 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -882,3 +882,59 @@ cc_library( strip_prefix = "llvm-project-llvmorg-20.1.0/compiler-rt/lib/fuzzer", urls = ["https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-20.1.0.tar.gz"], ) + +# openssl-sys does not build with the vendored feature when using +# rules_rust, so we build it ourselves, here. +# https://github.com/bazelbuild/rules_rust/issues/1519 +http_archive( + name = "openssl", + build_file_content = """ +load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make") + +filegroup( + name = "all_srcs", + srcs = glob( + include = ["**"], + exclude = ["*.bazel"], + ), +) + +# https://wiki.openssl.org/index.php/Compilation_and_Installation +CONFIGURE_OPTIONS = [ + "no-comp", + "no-idea", + "no-weak-ssl-ciphers", + "no-shared", +] + +MAKE_TARGETS = [ + "build_libs", + "install_dev", +] + +configure_make( + name = "openssl", + args = ["-j12"], + configure_command = "config", + configure_in_place = True, + configure_options = CONFIGURE_OPTIONS, + lib_name = "openssl", + lib_source = ":all_srcs", + out_lib_dir = "lib64", + out_shared_libs = [], + out_static_libs = ["libssl.a"], + targets = MAKE_TARGETS, + visibility = ["//visibility:public"], +) + +filegroup( + name = "gen_dir", + srcs = [":openssl"], + output_group = "gen_dir", + visibility = ["//visibility:public"], +) +""", + integrity = "sha256-4V3agv4v6BOdwqwho21MoB1TE8dfmfRsTooncJtylL8=", + strip_prefix = "openssl-3.4.0", + urls = ["https://github.com/openssl/openssl/releases/download/openssl-3.4.0/openssl-3.4.0.tar.gz"], +) diff --git a/bazel/external_crates.bzl b/bazel/external_crates.bzl index cb88b177463d..202257125923 100644 --- a/bazel/external_crates.bzl +++ b/bazel/external_crates.bzl @@ -24,6 +24,17 @@ BUILD_INFO_REV = "701a696844fba5c87df162fbbc1ccef96f27c9d7" def external_crates_repository(name, cargo_lockfile, lockfile, sanitizers_enabled): CRATE_ANNOTATIONS = { + "openssl-sys": [crate.annotation( + build_script_data = [ + "@@_main~_repo_rules~openssl//:gen_dir", + ], + build_script_env = { + "OPENSSL_NO_VENDOR": "1", + "OPENSSL_LIB_DIR": "$(location @@_main~_repo_rules~openssl//:gen_dir)/lib64", + "OPENSSL_INCLUDE_DIR": "$(location @@_main~_repo_rules~openssl//:gen_dir)/include", + "OPENSSL_STATIC": "1", + }, + )], "canbench": [crate.annotation( gen_binaries = True, )], @@ -35,6 +46,12 @@ def external_crates_repository(name, cargo_lockfile, lockfile, sanitizers_enable # Patch for determinism issues patch_args = ["-p1"], patches = ["@@//bazel:libssh2-sys.patch"], + build_script_data = [ + "@@_main~_repo_rules~openssl//:gen_dir", + ], + )], + "libz-sys": [crate.annotation( + crate_features = ["static"], )], "curve25519-dalek": [crate.annotation( rustc_flags = [ From 9ffe26ae79196ed81c66aa4c6cd50b1b4e87f417 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Wed, 12 Feb 2025 18:48:43 +0000 Subject: [PATCH 08/28] Fix stripping zig handles requests to strip any symbols by stripping all symbols. rules_rust tries to strip debug symbols, so we must override the link args to disable stripping wherever symbols need to be preserved. --- bazel/fuzz_testing.bzl | 1 + cpp/BUILD.bazel | 9 ++++++++- publish/defs.bzl | 2 +- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/bazel/fuzz_testing.bzl b/bazel/fuzz_testing.bzl index e83fbeba3407..0869177f3f9a 100644 --- a/bazel/fuzz_testing.bzl +++ b/bazel/fuzz_testing.bzl @@ -21,6 +21,7 @@ DEFAULT_RUSTC_FLAGS = [ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", + "-Cstrip=none", # TODO(PSEC): Add configuration to enable only during profiling # "-Cinstrument-coverage", ] diff --git a/cpp/BUILD.bazel b/cpp/BUILD.bazel index d90f295ccb3f..e79d2ed0260f 100644 --- a/cpp/BUILD.bazel +++ b/cpp/BUILD.bazel @@ -1,3 +1,5 @@ +load("//publish:defs.bzl", "release_strip_binary") + package(default_visibility = ["//visibility:public"]) cc_binary( @@ -17,9 +19,14 @@ cc_binary( deps = ["@libsystemd"], ) +release_strip_binary( + name = "infogetty_stripped", + binary = "infogetty_bin", +) + genrule( name = "infogetty_cleaned", - srcs = ["infogetty_bin"], + srcs = ["infogetty_stripped"], outs = ["infogetty"], cmd = "objcopy -R .comment -R .note -R .note.gnu.build-id $< $@", executable = True, diff --git a/publish/defs.bzl b/publish/defs.bzl index 22430897e0d3..55572ede7c00 100644 --- a/publish/defs.bzl +++ b/publish/defs.bzl @@ -8,7 +8,7 @@ def _release_nostrip_transition(_settings, _attr): return { "//command_line_option:compilation_mode": "opt", "//command_line_option:strip": "never", - "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off"], + "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off", "-Cstrip=none"], } release_nostrip_transition = transition( From 4c7d73f7d66afd44312711bada1c19b9ac9d44e8 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Fri, 7 Mar 2025 21:21:24 +0000 Subject: [PATCH 09/28] Remove ZIG_LINK_ARGS --- bazel/fuzz_testing.bzl | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/bazel/fuzz_testing.bzl b/bazel/fuzz_testing.bzl index 0869177f3f9a..cead960e5a29 100644 --- a/bazel/fuzz_testing.bzl +++ b/bazel/fuzz_testing.bzl @@ -28,17 +28,14 @@ DEFAULT_RUSTC_FLAGS = [ DEFAULT_SANITIZERS = [ "-Zsanitizer=address", + # zig doesn't like how rustc pushes the sanitizers, so do it ourselves. + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a", ] # This flag will be used by third party crates and internal rust_libraries during fuzzing DEFAULT_RUSTC_FLAGS_FOR_FUZZING = DEFAULT_RUSTC_FLAGS + DEFAULT_SANITIZERS -# zig doesn't like how rustc pushes the sanitizers, so do it ourselves. -ZIG_LINK_ARGS = [ - "-Zexternal-clangrt", - "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a", -] - def rust_fuzz_test_binary(name, srcs, rustc_flags = [], sanitizers = [], crate_features = [], proc_macro_deps = [], deps = [], allow_main = False, **kwargs): """Wrapper for the rust_binary to compile a fuzzing rust_binary @@ -65,7 +62,7 @@ def rust_fuzz_test_binary(name, srcs, rustc_flags = [], sanitizers = [], crate_f # default TAGS = [] - RUSTC_FLAGS_LIBFUZZER = DEFAULT_RUSTC_FLAGS + ZIG_LINK_ARGS + ["-Clink-arg=$(location @libfuzzer//:fuzzer)"] + RUSTC_FLAGS_LIBFUZZER = DEFAULT_RUSTC_FLAGS + ["-Clink-arg=$(location @libfuzzer//:fuzzer)"] kwargs.setdefault("testonly", True) From daa2a30eff802cdcc53a4fec254cbb5712c2d9fc Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Fri, 7 Mar 2025 22:17:56 +0000 Subject: [PATCH 10/28] Small cleanups and comments --- MODULE.bazel | 1 - WORKSPACE.bazel | 4 +++- publish/defs.bzl | 4 ++++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index afd5dc00d9f8..428bdad721c4 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -876,7 +876,6 @@ cc_library( linkstatic = True, visibility = ["//visibility:public"], ) - """, integrity = "sha256-CLw4JzN3fdo8liWeNzL/lsHfmNBHDE+FsWMnTq5of08=", strip_prefix = "llvm-project-llvmorg-20.1.0/compiler-rt/lib/fuzzer", diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel index 39f4549f05e5..be99c25a0494 100644 --- a/WORKSPACE.bazel +++ b/WORKSPACE.bazel @@ -284,12 +284,14 @@ cc_import( system_provided = True, visibility = ["//visibility:private"], ) + # Use an extra cc_library to hide the depth of the include folder cc_library( name = "libsystemd", includes = ["include"], deps = ["libsystemd-internal"], visibility = ["//visibility:public"], -)""", +) +""", path = "/usr", ) diff --git a/publish/defs.bzl b/publish/defs.bzl index 55572ede7c00..bcac2b391b5b 100644 --- a/publish/defs.bzl +++ b/publish/defs.bzl @@ -8,6 +8,10 @@ def _release_nostrip_transition(_settings, _attr): return { "//command_line_option:compilation_mode": "opt", "//command_line_option:strip": "never", + # opt mode will have rules_rust strip debug symbols, regardless of the + # strip setting. Unfortunately zig cc (from hermetic_cc_toolchain) + # strips as "all or nothing", so we lose all symbols, unless we also + # override the strip setting here. "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off", "-Cstrip=none"], } From 7bf6a09f938f6622b2454c01d6216f2985bb95eb Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Fri, 7 Mar 2025 23:36:21 +0000 Subject: [PATCH 11/28] Simplify openssl references --- bazel/external_crates.bzl | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/bazel/external_crates.bzl b/bazel/external_crates.bzl index 202257125923..9e981506a3a1 100644 --- a/bazel/external_crates.bzl +++ b/bazel/external_crates.bzl @@ -26,12 +26,12 @@ def external_crates_repository(name, cargo_lockfile, lockfile, sanitizers_enable CRATE_ANNOTATIONS = { "openssl-sys": [crate.annotation( build_script_data = [ - "@@_main~_repo_rules~openssl//:gen_dir", + "@openssl//:gen_dir", ], build_script_env = { "OPENSSL_NO_VENDOR": "1", - "OPENSSL_LIB_DIR": "$(location @@_main~_repo_rules~openssl//:gen_dir)/lib64", - "OPENSSL_INCLUDE_DIR": "$(location @@_main~_repo_rules~openssl//:gen_dir)/include", + "OPENSSL_LIB_DIR": "$(location @openssl//:gen_dir)/lib64", + "OPENSSL_INCLUDE_DIR": "$(location @openssl//:gen_dir)/include", "OPENSSL_STATIC": "1", }, )], @@ -47,7 +47,7 @@ def external_crates_repository(name, cargo_lockfile, lockfile, sanitizers_enable patch_args = ["-p1"], patches = ["@@//bazel:libssh2-sys.patch"], build_script_data = [ - "@@_main~_repo_rules~openssl//:gen_dir", + "@openssl//:gen_dir", ], )], "libz-sys": [crate.annotation( From 5bf5183cb146ec355ac4886e6bc84d4be2f49e0a Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Tue, 11 Mar 2025 22:00:19 +0000 Subject: [PATCH 12/28] Switch to `archive_override` --- MODULE.bazel | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/MODULE.bazel b/MODULE.bazel index 428bdad721c4..32f3aebe7610 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -14,10 +14,12 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.9.0") bazel_dep(name = "rules_cc", version = "0.0.13") bazel_dep(name = "platforms", version = "0.0.10") bazel_dep(name = "hermetic_cc_toolchain", version = "3.1.1") -single_version_override( +archive_override( module_name = "hermetic_cc_toolchain", + integrity = "sha256-kHdFv5FVX3foI0wLlTNx5srFunFdHPEv9kFJbdG86dE=", patch_strip = 1, patches = ["//bazel:hermetic_cc_toolchain.patch"], + urls = ["https://github.com/uber/hermetic_cc_toolchain/releases/download/v3.1.1/hermetic_cc_toolchain-v3.1.1.tar.gz"], ) # configure/make dependencies From b63d6209e7086b366cb95b8b8b0918724a26330d Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Tue, 11 Mar 2025 22:12:02 +0000 Subject: [PATCH 13/28] Add macOS toolchains --- MODULE.bazel | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index 32f3aebe7610..c0faeba13e4e 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -851,10 +851,13 @@ toolchains.extra_settings(settings = ["//bazel:use_hermetic_cc"]) use_repo(toolchains, "zig_sdk") register_toolchains( - # if no `--platform` is specified, these toolchains will be used for - # (linux,darwin,windows)x(amd64,arm64) + # Linux toolchains "@zig_sdk//toolchain:linux_amd64_gnu.2.28", + # macOS toolchains + "@zig_sdk//toolchain:darwin_amd64", + "@zig_sdk//toolchain:darwin_arm64", + # wasm toolchains "@zig_sdk//toolchain:none_wasm", From b71822cc0952a1cdb47afa2dd9623942192ab14d Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Fri, 14 Mar 2025 21:01:25 +0000 Subject: [PATCH 14/28] Strip binary within target --- cpp/BUILD.bazel | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/cpp/BUILD.bazel b/cpp/BUILD.bazel index e79d2ed0260f..e9ede47c7e08 100644 --- a/cpp/BUILD.bazel +++ b/cpp/BUILD.bazel @@ -1,5 +1,3 @@ -load("//publish:defs.bzl", "release_strip_binary") - package(default_visibility = ["//visibility:public"]) cc_binary( @@ -9,9 +7,9 @@ cc_binary( "infogetty-cpp/network_info.cc", "infogetty-cpp/network_info.h", ], - copts = ["-std=c++17"], - linkopts = [ - "-lsystemd", + copts = [ + "-std=c++17", + "-Wl,--strip-debug", ], target_compatible_with = [ "@platforms//os:linux", @@ -19,14 +17,9 @@ cc_binary( deps = ["@libsystemd"], ) -release_strip_binary( - name = "infogetty_stripped", - binary = "infogetty_bin", -) - genrule( name = "infogetty_cleaned", - srcs = ["infogetty_stripped"], + srcs = ["infogetty_bin"], outs = ["infogetty"], cmd = "objcopy -R .comment -R .note -R .note.gnu.build-id $< $@", executable = True, From 807897bcaba10fd0f9e99f87161075670c094c4e Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Fri, 14 Mar 2025 21:05:36 +0000 Subject: [PATCH 15/28] Rename hs targets --- hs/spec_compliance/BUILD.bazel | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hs/spec_compliance/BUILD.bazel b/hs/spec_compliance/BUILD.bazel index 539bc6e755ed..f18b3bf93f1a 100644 --- a/hs/spec_compliance/BUILD.bazel +++ b/hs/spec_compliance/BUILD.bazel @@ -74,13 +74,13 @@ STACK_DEPS = [ ] disable_hermetic_cc_binary( - name = "ic-ref-test-wrapped", + name = "ic-ref-test", binary = ":ic-ref-test", visibility = ["//visibility:public"], ) haskell_binary( - name = "ic-ref-test", + name = "ic-ref-test-inner", srcs = [ "bin/ic-ref-test.hs", ], From e55a5339689c4007506564f02165daf5b5c94082 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Sun, 23 Mar 2025 21:29:12 +0000 Subject: [PATCH 16/28] Organize external libs into third_party --- MODULE.bazel | 78 ---------------------------- WORKSPACE.bazel | 6 +++ third_party/libfuzzer/BUILD.bazel | 0 third_party/libfuzzer/repository.bzl | 29 +++++++++++ third_party/openssl/BUILD.bazel | 0 third_party/openssl/repository.bzl | 63 ++++++++++++++++++++++ 6 files changed, 98 insertions(+), 78 deletions(-) create mode 100644 third_party/libfuzzer/BUILD.bazel create mode 100644 third_party/libfuzzer/repository.bzl create mode 100644 third_party/openssl/BUILD.bazel create mode 100644 third_party/openssl/repository.bzl diff --git a/MODULE.bazel b/MODULE.bazel index c0faeba13e4e..b5675150053e 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -864,81 +864,3 @@ register_toolchains( # These toolchains are only registered locally. dev_dependency = True, ) - -# Build libfuzzer to ensure compatibility with our toolchain, and so that it -# can be optionally linked by the fuzzers. -http_archive( - name = "libfuzzer", - build_file_content = """ -load("@rules_cc//cc:defs.bzl", "cc_library") - -cc_library( - name = "fuzzer", - srcs = glob(["*.cpp"]), - hdrs = glob(["*.h"]), - additional_compiler_inputs = glob(["*.def"]), - cxxopts = ["-g", "-O2", "-fno-omit-frame-pointer", "-std=c++17"], - linkstatic = True, - visibility = ["//visibility:public"], -) -""", - integrity = "sha256-CLw4JzN3fdo8liWeNzL/lsHfmNBHDE+FsWMnTq5of08=", - strip_prefix = "llvm-project-llvmorg-20.1.0/compiler-rt/lib/fuzzer", - urls = ["https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-20.1.0.tar.gz"], -) - -# openssl-sys does not build with the vendored feature when using -# rules_rust, so we build it ourselves, here. -# https://github.com/bazelbuild/rules_rust/issues/1519 -http_archive( - name = "openssl", - build_file_content = """ -load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make") - -filegroup( - name = "all_srcs", - srcs = glob( - include = ["**"], - exclude = ["*.bazel"], - ), -) - -# https://wiki.openssl.org/index.php/Compilation_and_Installation -CONFIGURE_OPTIONS = [ - "no-comp", - "no-idea", - "no-weak-ssl-ciphers", - "no-shared", -] - -MAKE_TARGETS = [ - "build_libs", - "install_dev", -] - -configure_make( - name = "openssl", - args = ["-j12"], - configure_command = "config", - configure_in_place = True, - configure_options = CONFIGURE_OPTIONS, - lib_name = "openssl", - lib_source = ":all_srcs", - out_lib_dir = "lib64", - out_shared_libs = [], - out_static_libs = ["libssl.a"], - targets = MAKE_TARGETS, - visibility = ["//visibility:public"], -) - -filegroup( - name = "gen_dir", - srcs = [":openssl"], - output_group = "gen_dir", - visibility = ["//visibility:public"], -) -""", - integrity = "sha256-4V3agv4v6BOdwqwho21MoB1TE8dfmfRsTooncJtylL8=", - strip_prefix = "openssl-3.4.0", - urls = ["https://github.com/openssl/openssl/releases/download/openssl-3.4.0/openssl-3.4.0.tar.gz"], -) diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel index be99c25a0494..97193c70db43 100644 --- a/WORKSPACE.bazel +++ b/WORKSPACE.bazel @@ -7,6 +7,8 @@ load("//bazel:mainnet-canisters.bzl", "canisters") load("//bazel:mainnet-icos-images.bzl", "mainnet_icos_images") load("//third_party/jemalloc:repository.bzl", "jemalloc_repository") load("//third_party/lmdb:repository.bzl", "lmdb_repository") +load("//third_party/openssl:repository.bzl", "openssl_repository") +load("//third_party/libfuzzer:repository.bzl", "libfuzzer_repository") # We cannot derive the Bazel repository names (e.g. @mainnet_nns_registry_canister) directly # from the canister names because we use inconsistent repo names. Same goes for filenames. @@ -169,6 +171,10 @@ lmdb_repository() jemalloc_repository() +openssl_repository() + +libfuzzer_repository() + http_archive( name = "buildifier_prebuilt", sha256 = "72b5bb0853aac597cce6482ee6c62513318e7f2c0050bc7c319d75d03d8a3875", diff --git a/third_party/libfuzzer/BUILD.bazel b/third_party/libfuzzer/BUILD.bazel new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/third_party/libfuzzer/repository.bzl b/third_party/libfuzzer/repository.bzl new file mode 100644 index 000000000000..bf9164e27633 --- /dev/null +++ b/third_party/libfuzzer/repository.bzl @@ -0,0 +1,29 @@ +""" +Build libfuzzer to ensure compatibility with our toolchain, and so that it can +be optionally linked by the fuzzers. +""" + +load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") +load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe") + +def libfuzzer_repository(): + maybe( + http_archive, + name = "libfuzzer", + build_file_content = """ +load("@rules_cc//cc:defs.bzl", "cc_library") + +cc_library( + name = "fuzzer", + srcs = glob(["*.cpp"]), + hdrs = glob(["*.h"]), + additional_compiler_inputs = glob(["*.def"]), + cxxopts = ["-g", "-O2", "-fno-omit-frame-pointer", "-std=c++17"], + linkstatic = True, + visibility = ["//visibility:public"], +) +""", + integrity = "sha256-CLw4JzN3fdo8liWeNzL/lsHfmNBHDE+FsWMnTq5of08=", + strip_prefix = "llvm-project-llvmorg-20.1.0/compiler-rt/lib/fuzzer", + urls = ["https://github.com/llvm/llvm-project/archive/refs/tags/llvmorg-20.1.0.tar.gz"], + ) diff --git a/third_party/openssl/BUILD.bazel b/third_party/openssl/BUILD.bazel new file mode 100644 index 000000000000..e69de29bb2d1 diff --git a/third_party/openssl/repository.bzl b/third_party/openssl/repository.bzl new file mode 100644 index 000000000000..9f8ab1daffb4 --- /dev/null +++ b/third_party/openssl/repository.bzl @@ -0,0 +1,63 @@ +""" +openssl-sys does not build with the vendored feature when using rules_rust, so +we build it ourselves, here. +https://github.com/bazelbuild/rules_rust/issues/1519 +""" + +load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") +load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe") + +def openssl_repository(): + maybe( + http_archive, + name = "openssl", + build_file_content = """ +load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make") + +filegroup( + name = "all_srcs", + srcs = glob( + include = ["**"], + exclude = ["*.bazel"], + ), +) + +# https://wiki.openssl.org/index.php/Compilation_and_Installation +CONFIGURE_OPTIONS = [ + "no-comp", + "no-idea", + "no-weak-ssl-ciphers", + "no-shared", +] + +MAKE_TARGETS = [ + "build_libs", + "install_dev", +] + +configure_make( + name = "openssl", + args = ["-j12"], + configure_command = "config", + configure_in_place = True, + configure_options = CONFIGURE_OPTIONS, + lib_name = "openssl", + lib_source = ":all_srcs", + out_lib_dir = "lib64", + out_shared_libs = [], + out_static_libs = ["libssl.a"], + targets = MAKE_TARGETS, + visibility = ["//visibility:public"], +) + +filegroup( + name = "gen_dir", + srcs = [":openssl"], + output_group = "gen_dir", + visibility = ["//visibility:public"], +) +""", + integrity = "sha256-4V3agv4v6BOdwqwho21MoB1TE8dfmfRsTooncJtylL8=", + strip_prefix = "openssl-3.4.0", + urls = ["https://github.com/openssl/openssl/releases/download/openssl-3.4.0/openssl-3.4.0.tar.gz"], + ) From 11a5224315dccc2a7875c22d8fd31e363cf307d5 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Sun, 23 Mar 2025 21:30:00 +0000 Subject: [PATCH 17/28] Update various comments --- MODULE.bazel | 2 ++ bazel/BUILD.bazel | 2 ++ bazel/cc_rs.patch | 5 +++++ bazel/conf/.bazelrc.build | 4 ++++ bazel/hermetic_cc_toolchain.patch | 7 +++++-- third_party/openssl/repository.bzl | 6 ++++-- 6 files changed, 22 insertions(+), 4 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index b5675150053e..b0863618935f 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -847,6 +847,8 @@ os_info(name = "os_info") # Set up hermetic cc toolchains for binaries and canisters toolchains = use_extension("@hermetic_cc_toolchain//toolchain:ext.bzl", "toolchains") +# The use_hermetic_cc setting is added to each toolchain to allow us to opt out +# in favor of system toolchains, when needed. toolchains.extra_settings(settings = ["//bazel:use_hermetic_cc"]) use_repo(toolchains, "zig_sdk") diff --git a/bazel/BUILD.bazel b/bazel/BUILD.bazel index 49636ed54799..943cedfa0af4 100644 --- a/bazel/BUILD.bazel +++ b/bazel/BUILD.bazel @@ -53,6 +53,8 @@ config_setting( }, ) +# Allow targets to opt out of hermetic toolchains, in favor of the one provided +# by the system bool_flag( name = "hermetic_cc", build_setting_default = True, diff --git a/bazel/cc_rs.patch b/bazel/cc_rs.patch index b1a1c1bc192f..7a5f01a33845 100644 --- a/bazel/cc_rs.patch +++ b/bazel/cc_rs.patch @@ -1,4 +1,9 @@ # Adjust target naming to match what zig expects. +# +# zig does not plan to change their target naming: https://github.com/ziglang/zig/issues/4911 +# and cc-rs is waiting on a 1.0 release to support zig's scheme: https://github.com/rust-lang/cc-rs/pull/986 +# Other related links: https://github.com/bazelbuild/rules_rust/issues/2529 +# https://github.com/Asana/cc-rs diff --git a/src/lib.rs b/src/lib.rs index f75b951..8e770a7 100644 --- a/src/lib.rs diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build index 6413f2bab7bd..603c543a0a22 100644 --- a/bazel/conf/.bazelrc.build +++ b/bazel/conf/.bazelrc.build @@ -114,6 +114,10 @@ build:afl --action_env="LD=afl-clang-lto++" build:afl --action_env="LLVM_CONFIG=llvm-config-18" build:afl --action_env="RANLIB=llvm-ranlib-18" build:afl --config=fuzzing +# Note: Instrumenting with AFL is done by overriding the above variables, but +# these are not respected by the hermetic toolchains. Instead, we use +# toolchains from the host system. +# For more context see: https://github.com/dfinity/ic/pull/3508 build:afl --hermetic_cc=false build:afl --build_tag_filters=afl run:afl --run_under="//bin/fuzzing:afl_wrapper" diff --git a/bazel/hermetic_cc_toolchain.patch b/bazel/hermetic_cc_toolchain.patch index 3c4fa0e02951..b9660d75486b 100644 --- a/bazel/hermetic_cc_toolchain.patch +++ b/bazel/hermetic_cc_toolchain.patch @@ -1,5 +1,8 @@ -# Extend hermetic_cc_toolchain with a wasm target that does not use wasi, and -# add a path to put additional restrictions on the generated toolchains. +# Extend hermetic_cc_toolchain with a wasm target that does not use wasi +# (https://github.com/uber/hermetic_cc_toolchain/pull/214), and add a path to +# put additional restrictions on the generated toolchains so that we can +# restrict which targets pick up the toolchains +# (https://github.com/uber/hermetic_cc_toolchain/pull/213). diff --git a/MODULE.bazel b/MODULE.bazel index 409d626..1265298 100644 --- a/MODULE.bazel diff --git a/third_party/openssl/repository.bzl b/third_party/openssl/repository.bzl index 9f8ab1daffb4..6317b80a71b8 100644 --- a/third_party/openssl/repository.bzl +++ b/third_party/openssl/repository.bzl @@ -1,7 +1,9 @@ """ -openssl-sys does not build with the vendored feature when using rules_rust, so -we build it ourselves, here. +With hermetic toolchains, we would like to not depend on the openssl from the +build enviornment. Normally the vendored feature would build the library from +source alongside the crate, but this does not work when using rules_rust: https://github.com/bazelbuild/rules_rust/issues/1519 +Instead, we build it ourselves, here. """ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") From eb0638f2d674e47641b6ad17b299e4c9992ef2eb Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Mon, 24 Mar 2025 10:03:18 +0000 Subject: [PATCH 18/28] Buildifier --- MODULE.bazel | 1 + WORKSPACE.bazel | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/MODULE.bazel b/MODULE.bazel index b0863618935f..6e4ac0836bcf 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -847,6 +847,7 @@ os_info(name = "os_info") # Set up hermetic cc toolchains for binaries and canisters toolchains = use_extension("@hermetic_cc_toolchain//toolchain:ext.bzl", "toolchains") + # The use_hermetic_cc setting is added to each toolchain to allow us to opt out # in favor of system toolchains, when needed. toolchains.extra_settings(settings = ["//bazel:use_hermetic_cc"]) diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel index 97193c70db43..24bd584207f7 100644 --- a/WORKSPACE.bazel +++ b/WORKSPACE.bazel @@ -6,9 +6,9 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") load("//bazel:mainnet-canisters.bzl", "canisters") load("//bazel:mainnet-icos-images.bzl", "mainnet_icos_images") load("//third_party/jemalloc:repository.bzl", "jemalloc_repository") +load("//third_party/libfuzzer:repository.bzl", "libfuzzer_repository") load("//third_party/lmdb:repository.bzl", "lmdb_repository") load("//third_party/openssl:repository.bzl", "openssl_repository") -load("//third_party/libfuzzer:repository.bzl", "libfuzzer_repository") # We cannot derive the Bazel repository names (e.g. @mainnet_nns_registry_canister) directly # from the canister names because we use inconsistent repo names. Same goes for filenames. From b71822931ab6bfa78c5e3dacecb510ca86c2f94a Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Mon, 24 Mar 2025 13:40:58 +0000 Subject: [PATCH 19/28] Disable hermetic toolchains for macOS --- MODULE.bazel | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index 6e4ac0836bcf..b8375073373d 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -858,8 +858,10 @@ register_toolchains( "@zig_sdk//toolchain:linux_amd64_gnu.2.28", # macOS toolchains - "@zig_sdk//toolchain:darwin_amd64", - "@zig_sdk//toolchain:darwin_arm64", + # Do not use hermetic toolchains for macOS until we have had a chance to + # wrap the various system libraries. + # "@zig_sdk//toolchain:darwin_amd64", + # "@zig_sdk//toolchain:darwin_arm64", # wasm toolchains "@zig_sdk//toolchain:none_wasm", From 3bbf7e7ddbc36c2ba0c22cb62dfad4bff833c8df Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Mon, 24 Mar 2025 15:23:51 +0000 Subject: [PATCH 20/28] Disable tmp speedup for zig --- bazel/conf/.bazelrc.build | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build index 603c543a0a22..1ccf6fddb271 100644 --- a/bazel/conf/.bazelrc.build +++ b/bazel/conf/.bazelrc.build @@ -149,4 +149,6 @@ test --test_env=CLICOLOR_FORCE=true common --local_termination_grace_seconds=90 # Speed up compilation with zig cc -build --sandbox_add_mount_pair=/tmp +# Currently this is disabled as it breaks pocket-ic tests as the port files +# collide across tests. +# build --sandbox_add_mount_pair=/tmp From 9bb789f86970e1280dbf0454f6b328a4f0ff5e11 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Mon, 24 Mar 2025 15:31:45 +0000 Subject: [PATCH 21/28] Wrap rules_haskell defs at a lower level --- hs/spec_compliance/BUILD.bazel | 64 ++-------------------------------- hs/spec_compliance/defs.bzl | 40 +++++++++++++++++++++ 2 files changed, 43 insertions(+), 61 deletions(-) diff --git a/hs/spec_compliance/BUILD.bazel b/hs/spec_compliance/BUILD.bazel index f18b3bf93f1a..d0e65acb6d25 100644 --- a/hs/spec_compliance/BUILD.bazel +++ b/hs/spec_compliance/BUILD.bazel @@ -1,5 +1,4 @@ -load("@rules_haskell//haskell:defs.bzl", "haskell_binary", "haskell_library") -load("defs.bzl", "disable_hermetic_cc_binary") +load("defs.bzl", "haskell_binary", "haskell_library") STACK_DEPS = [ # Keep sorted. @@ -73,14 +72,8 @@ STACK_DEPS = [ "@stackage//:zlib", ] -disable_hermetic_cc_binary( - name = "ic-ref-test", - binary = ":ic-ref-test", - visibility = ["//visibility:public"], -) - haskell_binary( - name = "ic-ref-test-inner", + name = "ic-ref-test", srcs = [ "bin/ic-ref-test.hs", ], @@ -88,8 +81,8 @@ haskell_binary( "-threaded", # use the threaded Run Time System (RTS) "-rtsopts", # allow passing RTS options like: +RTS -N -RTS ], - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], + visibility = ["//visibility:public"], deps = STACK_DEPS + [ ":IC-CBOR-Parser", ":IC-CBOR-Patterns", @@ -149,7 +142,6 @@ haskell_library( name = "IC-Crypto-BLS", srcs = ["src/IC/Crypto/BLS.hsc"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -163,7 +155,6 @@ haskell_library( name = "IC-Id-Fresh", srcs = ["src/IC/Id/Fresh.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -177,7 +168,6 @@ haskell_library( name = "IC-Id-Forms", srcs = ["src/IC/Id/Forms.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Hash", @@ -190,7 +180,6 @@ haskell_library( name = "IC-Utils", srcs = ["src/IC/Utils.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Constants", @@ -205,7 +194,6 @@ haskell_library( name = "IC-Certificate", srcs = ["src/IC/Certificate.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HashTree", @@ -218,7 +206,6 @@ haskell_library( name = "IC-Management", srcs = ["src/IC/Management.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Types", @@ -231,7 +218,6 @@ haskell_library( name = "IC-Purify", srcs = ["src/IC/Purify.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -243,7 +229,6 @@ haskell_library( name = "IC-Crypto", srcs = ["src/IC/Crypto.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-BLS", @@ -262,7 +247,6 @@ haskell_library( name = "IC-HTTP-RequestId", srcs = ["src/IC/HTTP/RequestId.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HTTP-GenR", @@ -277,7 +261,6 @@ haskell_library( name = "IC-HTTP-CBOR", srcs = ["src/IC/HTTP/CBOR.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HTTP-GenR", @@ -290,7 +273,6 @@ haskell_library( name = "IC-HTTP-GenR", srcs = ["src/IC/HTTP/GenR.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -302,7 +284,6 @@ haskell_library( name = "IC-HTTP-GenR-Parse", srcs = ["src/IC/HTTP/GenR/Parse.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HTTP-GenR", @@ -315,7 +296,6 @@ haskell_library( name = "IC-Types", srcs = ["src/IC/Types.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -327,7 +307,6 @@ haskell_library( name = "IC-HashTree-CBOR", srcs = ["src/IC/HashTree/CBOR.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Patterns", @@ -341,7 +320,6 @@ haskell_library( name = "IC-HashTree", srcs = ["src/IC/HashTree.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -353,7 +331,6 @@ haskell_library( name = "IC-Constants", srcs = ["src/IC/Constants.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Types", @@ -366,7 +343,6 @@ haskell_library( name = "IC-Certificate-Value", srcs = ["src/IC/Certificate/Value.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Types", @@ -380,7 +356,6 @@ haskell_library( name = "IC-Certificate-Validate", srcs = ["src/IC/Certificate/Validate.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Certificate", @@ -397,7 +372,6 @@ haskell_library( name = "IC-Certificate-CBOR", srcs = ["src/IC/Certificate/CBOR.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Parser", @@ -414,7 +388,6 @@ haskell_library( name = "IC-Crypto-Secp256k1", srcs = ["src/IC/Crypto/Secp256k1.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -426,7 +399,6 @@ haskell_library( name = "IC-Crypto-Ed25519", srcs = ["src/IC/Crypto/Ed25519.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -438,7 +410,6 @@ haskell_library( name = "IC-Crypto-DER-Decode", srcs = ["src/IC/Crypto/DER/Decode.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -450,7 +421,6 @@ haskell_library( name = "IC-Crypto-DER", srcs = ["src/IC/Crypto/DER.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-DER-Decode", @@ -463,7 +433,6 @@ haskell_library( name = "IC-Crypto-DER_BLS", srcs = ["src/IC/Crypto/DER_BLS.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-BLS", @@ -477,7 +446,6 @@ haskell_library( name = "IC-Crypto-WebAuthn", srcs = ["src/IC/Crypto/WebAuthn.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Parser", @@ -495,7 +463,6 @@ haskell_library( name = "IC-Crypto-CanisterSig", srcs = ["src/IC/Crypto/CanisterSig.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Parser", @@ -516,7 +483,6 @@ haskell_library( name = "IC-Crypto-ECDSA", srcs = ["src/IC/Crypto/ECDSA.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -528,7 +494,6 @@ haskell_library( name = "IC-Version", srcs = ["src/IC/Version.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":SourceId", @@ -541,7 +506,6 @@ haskell_library( name = "IC-Hash", srcs = ["src/IC/Hash.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -553,7 +517,6 @@ haskell_library( name = "IC-CBOR-Utils", srcs = ["src/IC/CBOR/Utils.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HTTP-CBOR", @@ -568,7 +531,6 @@ haskell_library( name = "IC-CBOR-Parser", srcs = ["src/IC/CBOR/Parser.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-CBOR-Patterns", @@ -581,7 +543,6 @@ haskell_library( name = "IC-CBOR-Patterns", srcs = ["src/IC/CBOR/Patterns.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -593,7 +554,6 @@ haskell_library( name = "IC-DRun-Parse", srcs = ["src/IC/DRun/Parse.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -605,7 +565,6 @@ haskell_library( name = "IC-Test-Secp256k1", srcs = ["src/IC/Test/Secp256k1.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-Secp256k1", @@ -618,7 +577,6 @@ haskell_library( name = "IC-Test-Spec", srcs = ["src/IC/Test/Spec.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Certificate", @@ -652,7 +610,6 @@ haskell_library( name = "IC-Test-WebAuthn", srcs = ["src/IC/Test/WebAuthn.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-WebAuthn", @@ -665,7 +622,6 @@ haskell_library( name = "IC-Test-Spec-Utils", srcs = ["src/IC/Test/Spec/Utils.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto", @@ -687,7 +643,6 @@ haskell_library( name = "IC-Test-Spec-CanisterHistory", srcs = ["src/IC/Test/Spec/CanisterHistory.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Hash", @@ -708,7 +663,6 @@ haskell_library( name = "IC-Test-Spec-CanisterVersion", srcs = ["src/IC/Test/Spec/CanisterVersion.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Test-Agent", @@ -726,7 +680,6 @@ haskell_library( name = "IC-Test-Spec-Timer", srcs = ["src/IC/Test/Spec/Timer.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Management", @@ -743,7 +696,6 @@ haskell_library( name = "IC-Test-BLS", srcs = ["src/IC/Test/BLS.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-BLS", @@ -756,7 +708,6 @@ haskell_library( name = "IC-Test-ECDSA", srcs = ["src/IC/Test/ECDSA.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Crypto-ECDSA", @@ -769,7 +720,6 @@ haskell_library( name = "IC-Test-Agent", srcs = ["src/IC/Test/Agent.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Certificate", @@ -799,7 +749,6 @@ haskell_library( name = "IC-Test-HashTree", srcs = ["src/IC/Test/HashTree.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-HashTree", @@ -813,7 +762,6 @@ haskell_library( name = "IC-Test-Universal", srcs = ["src/IC/Test/Universal.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", @@ -825,7 +773,6 @@ haskell_library( name = "IC-Test-Options", srcs = ["src/IC/Test/Options.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Constants", @@ -841,7 +788,6 @@ haskell_library( name = "IC-Test-Agent-UnsafeCalls", srcs = ["src/IC/Test/Agent/UnsafeCalls.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -859,7 +805,6 @@ haskell_library( name = "IC-Test-Agent-SafeCalls", srcs = ["src/IC/Test/Agent/SafeCalls.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -877,7 +822,6 @@ haskell_library( name = "IC-Test-Agent-Calls", srcs = ["src/IC/Test/Agent/Calls.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -892,7 +836,6 @@ haskell_library( name = "IC-Test-Agent-UserCalls", srcs = ["src/IC/Test/Agent/UserCalls.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ ":IC-Id-Forms", @@ -908,7 +851,6 @@ haskell_library( name = "SourceId", srcs = ["src/SourceId.hs"], src_strip_prefix = "src", - tags = ["manual"], target_compatible_with = ["@platforms//os:linux"], deps = STACK_DEPS + [ "@haskell-candid//:candid", diff --git a/hs/spec_compliance/defs.bzl b/hs/spec_compliance/defs.bzl index 2eba1237365f..ad6084660b14 100644 --- a/hs/spec_compliance/defs.bzl +++ b/hs/spec_compliance/defs.bzl @@ -1,5 +1,7 @@ """Create transition to disable hermetic_cc_toolchains for hs targets.""" +load("@rules_haskell//haskell:defs.bzl", haskell_binary_inner = "haskell_binary", haskell_library_inner = "haskell_library") + def _disable_hermetic_cc_transition(_settings, _attr): return { "//bazel:hermetic_cc": False, @@ -34,3 +36,41 @@ disable_hermetic_cc_binary = rule( "binary": attr.label(mandatory = True, cfg = disable_hermetic_cc_transition, allow_single_file = True), }, ) + +def haskell_binary(name, **kwargs): + """ + Wrap the rules_haskell haskell_binary with a transition that disables hermetic toolchains. + + These are not supported together, because ghc will not work with the zig compiler. + + Args: + name: Name for the generated filegroup. + **kwargs: Pass through args to the inner haskell_binary. + """ + + tags = kwargs.pop("tags", []) + tags.append("manual") + new_name = name + "_inner" + label = ":" + new_name + + haskell_binary_inner(new_name, tags = tags, **kwargs) + + disable_hermetic_cc_binary( + name = name, + binary = label, + visibility = ["//visibility:public"], + ) + +def haskell_library(**kwargs): + """ + Wrap the rules_haskell haskell_library with a transition that disables hermetic toolchains. + + These are not supported together, because ghc will not work with the zig compiler. + + Args: + **kwargs: Pass through args to the inner haskell_library. + """ + tags = kwargs.pop("tags", []) + tags.append("manual") + + haskell_library_inner(tags = tags, **kwargs) From 01064827b636fbe8044121db5293a6b447c661b7 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Wed, 26 Mar 2025 14:34:08 +0000 Subject: [PATCH 22/28] Fix release stripping --- publish/defs.bzl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/publish/defs.bzl b/publish/defs.bzl index bcac2b391b5b..b965e66890b4 100644 --- a/publish/defs.bzl +++ b/publish/defs.bzl @@ -10,9 +10,9 @@ def _release_nostrip_transition(_settings, _attr): "//command_line_option:strip": "never", # opt mode will have rules_rust strip debug symbols, regardless of the # strip setting. Unfortunately zig cc (from hermetic_cc_toolchain) - # strips as "all or nothing", so we lose all symbols, unless we also - # override the strip setting here. - "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off", "-Cstrip=none"], + # strips as "all or nothing", so we lose all symbols in opt mode. + # Instead, we have the compiler strip nothing, then strip debug in linking. + "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off", "-Cstrip=none", "-Clink-args=-Wl,--strip-debug"], } release_nostrip_transition = transition( From c4f3b2959fae896daaab4a0697e2aea0173c1147 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Wed, 26 Mar 2025 15:51:17 +0000 Subject: [PATCH 23/28] Fix release stripping for macOS --- publish/defs.bzl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/publish/defs.bzl b/publish/defs.bzl index b965e66890b4..ee71cab669d7 100644 --- a/publish/defs.bzl +++ b/publish/defs.bzl @@ -12,7 +12,7 @@ def _release_nostrip_transition(_settings, _attr): # strip setting. Unfortunately zig cc (from hermetic_cc_toolchain) # strips as "all or nothing", so we lose all symbols in opt mode. # Instead, we have the compiler strip nothing, then strip debug in linking. - "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off", "-Cstrip=none", "-Clink-args=-Wl,--strip-debug"], + "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off", "-Cstrip=none", "-Clink-args=-Wl,-S"], } release_nostrip_transition = transition( From dd17358768eec4e36827c0508f025cb2a6c23bde Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Wed, 16 Apr 2025 23:09:22 +0000 Subject: [PATCH 24/28] Add shared zig-cache in /tmp/zig-cache --- .github/actions/bazel/bin/bazel | 2 ++ bazel/conf/.bazelrc.build | 12 +++++++++--- ci/container/container-run.sh | 1 + 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/actions/bazel/bin/bazel b/.github/actions/bazel/bin/bazel index bda6361d7153..025f38a0d2cf 100755 --- a/.github/actions/bazel/bin/bazel +++ b/.github/actions/bazel/bin/bazel @@ -46,6 +46,8 @@ bazel_args=( "$@" ) # stored here again for easy access bazel_command="$1" +# Setup zig-cache +mkdir -p /tmp/zig-cache # Unless explicitly provided, we set a default --repository_cache to a volume mounted inside our runners # Only for Linux builds since there `/cache` is mounted to host local storage. diff --git a/bazel/conf/.bazelrc.build b/bazel/conf/.bazelrc.build index 1ccf6fddb271..9a062f2a6c63 100644 --- a/bazel/conf/.bazelrc.build +++ b/bazel/conf/.bazelrc.build @@ -149,6 +149,12 @@ test --test_env=CLICOLOR_FORCE=true common --local_termination_grace_seconds=90 # Speed up compilation with zig cc -# Currently this is disabled as it breaks pocket-ic tests as the port files -# collide across tests. -# build --sandbox_add_mount_pair=/tmp +# zig cc compiles the standard library on demand, so a shared cache makes a big +# difference by cutting out duplicated work. + +# Set the cache path for all environments +build --repo_env=HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX=/tmp/zig-cache +# Share /tmp/zig-cache across targets +build --sandbox_add_mount_pair=/tmp/zig-cache +# Allow writes to the shared cache +build --sandbox_writable_path=/tmp/zig-cache diff --git a/ci/container/container-run.sh b/ci/container/container-run.sh index 305106bb6b91..c0583317359a 100755 --- a/ci/container/container-run.sh +++ b/ci/container/container-run.sh @@ -116,6 +116,7 @@ PODMAN_RUN_ARGS+=( --mount type=bind,source="${HOME}/.aws",target="${CTR_HOME}/.aws" --mount type=bind,source="/var/lib/containers",target="/var/lib/containers" --mount type=bind,source="/tmp",target="/tmp" + --mount type=volume,chown=true,destination=/tmp/zig-cache --mount type=tmpfs,destination=/var/sysimage ) From 80f68ab2abca5ecce16e4dcdb914b0256201ea5b Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Wed, 16 Apr 2025 21:38:37 +0000 Subject: [PATCH 25/28] Remove previous stripping changes --- bazel/fuzz_testing.bzl | 1 - cpp/BUILD.bazel | 5 +---- publish/defs.bzl | 6 +----- 3 files changed, 2 insertions(+), 10 deletions(-) diff --git a/bazel/fuzz_testing.bzl b/bazel/fuzz_testing.bzl index cead960e5a29..93b66461ff14 100644 --- a/bazel/fuzz_testing.bzl +++ b/bazel/fuzz_testing.bzl @@ -21,7 +21,6 @@ DEFAULT_RUSTC_FLAGS = [ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", - "-Cstrip=none", # TODO(PSEC): Add configuration to enable only during profiling # "-Cinstrument-coverage", ] diff --git a/cpp/BUILD.bazel b/cpp/BUILD.bazel index e9ede47c7e08..18fec01adff3 100644 --- a/cpp/BUILD.bazel +++ b/cpp/BUILD.bazel @@ -7,10 +7,7 @@ cc_binary( "infogetty-cpp/network_info.cc", "infogetty-cpp/network_info.h", ], - copts = [ - "-std=c++17", - "-Wl,--strip-debug", - ], + copts = ["-std=c++17"], target_compatible_with = [ "@platforms//os:linux", ], diff --git a/publish/defs.bzl b/publish/defs.bzl index ee71cab669d7..22430897e0d3 100644 --- a/publish/defs.bzl +++ b/publish/defs.bzl @@ -8,11 +8,7 @@ def _release_nostrip_transition(_settings, _attr): return { "//command_line_option:compilation_mode": "opt", "//command_line_option:strip": "never", - # opt mode will have rules_rust strip debug symbols, regardless of the - # strip setting. Unfortunately zig cc (from hermetic_cc_toolchain) - # strips as "all or nothing", so we lose all symbols in opt mode. - # Instead, we have the compiler strip nothing, then strip debug in linking. - "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off", "-Cstrip=none", "-Clink-args=-Wl,-S"], + "@rules_rust//:extra_rustc_flags": ["-Cdebug-assertions=off"], } release_nostrip_transition = transition( From 31d882269a8ef72b4da2af6919311c2e1e0be6a4 Mon Sep 17 00:00:00 2001 From: Eero Kelly Date: Mon, 5 May 2025 19:33:41 +0000 Subject: [PATCH 26/28] Strip debug_info from zig_wrapper --- WORKSPACE.bazel | 7 ++ bazel/hermetic_cc_toolchain.patch | 71 ++++++++++++++++ bazel/rules_rust.patch | 134 ++++++++++++++++++++++++++++++ 3 files changed, 212 insertions(+) create mode 100644 bazel/rules_rust.patch diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel index 24bd584207f7..030d3b26e6df 100644 --- a/WORKSPACE.bazel +++ b/WORKSPACE.bazel @@ -110,6 +110,8 @@ sol_register_toolchains( http_archive( name = "rules_rust", integrity = "sha256-8TBqrAsli3kN8BrZq8arsN8LZUFsdLTvJ/Sqsph4CmQ=", + patch_args = ["-p1"], + patches = ["//bazel:rules_rust.patch"], urls = ["https://github.com/bazelbuild/rules_rust/releases/download/0.56.0/rules_rust-0.56.0.tar.gz"], ) @@ -122,6 +124,11 @@ rust_analyzer_dependencies() rust_register_toolchains( edition = "2021", + strip_level = {"x86_64-unknown-linux-gnu": { + "dbg": "none", + "fastbuild": "none", + "opt": "none", + }}, # The nightly version is required to compile fuzz tests from Bazel. # The version below is chosen so that it is in sync with the non-nightly version. versions = [ diff --git a/bazel/hermetic_cc_toolchain.patch b/bazel/hermetic_cc_toolchain.patch index b9660d75486b..107049e68ac4 100644 --- a/bazel/hermetic_cc_toolchain.patch +++ b/bazel/hermetic_cc_toolchain.patch @@ -3,6 +3,8 @@ # put additional restrictions on the generated toolchains so that we can # restrict which targets pick up the toolchains # (https://github.com/uber/hermetic_cc_toolchain/pull/213). +# Strip debug_info off every target for determinism +# (https://github.com/ziglang/zig/issues/23821, https://github.com/ziglang/zig/issues/23823). diff --git a/MODULE.bazel b/MODULE.bazel index 409d626..1265298 100644 --- a/MODULE.bazel @@ -211,3 +213,72 @@ index 50cc881..0549c26 100644 toolchain = "@zig_sdk//:%s_cc" % zigtarget, toolchain_type = "@bazel_tools//tools/cpp:toolchain_type", ) +diff --git a/toolchain/zig-wrapper.zig b/toolchain/zig-wrapper.zig +index d1d59f9..f7ba2cd 100644 +--- a/toolchain/zig-wrapper.zig ++++ b/toolchain/zig-wrapper.zig +@@ -132,7 +132,7 @@ pub fn main() u8 { + if (builtin.os.tag == .windows) + return spawnWindows(arena, params) + else +- return execUnix(arena, params); ++ return spawnAndStripUnix(arena, params); + }, + } + } +@@ -161,6 +161,55 @@ fn execUnix(arena: mem.Allocator, params: ExecParams) u8 { + return 1; + } + ++fn spawnAndStripUnix(arena: mem.Allocator, params: ExecParams) u8 { ++ // Build a strip command ++ const strip_cmd = blk: { ++ var list = ArrayListUnmanaged([]const u8){}; ++ list.appendSlice(arena, &[_][]const u8{ "strip", "-S" }) catch |err| { ++ return fatal("error building strip cmd: {s}\n", .{@errorName(err)}); ++ }; ++ ++ // Find any output targets ++ var next = false; ++ for (params.args.items) |param| { ++ if (mem.eql(u8, param, "-o")) { ++ next = true; ++ } else if (next) { ++ list.append(arena, param) catch |err| { ++ return fatal("error adding output target: {s}\n", .{@errorName(err)}); ++ }; ++ break; ++ } ++ } ++ break :blk list; ++ }; ++ ++ // Run the intended zig process ++ var proc = ChildProcess.init(params.args.items, arena); ++ proc.env_map = ¶ms.env; ++ ++ const ret = proc.spawnAndWait() catch |err| { ++ return fatal("error spawning {s}: {s}\n", .{ params.args.items[0], @errorName(err) }); ++ }; ++ ++ const code = switch (ret) { ++ .Exited => |code| code, ++ else => |other| return fatal("abnormal exit: {any}\n", .{other}), ++ }; ++ ++ // Run strip command, ignore output ++ var strip_proc = ChildProcess.init(strip_cmd.items, arena); ++ strip_proc.env_map = ¶ms.env; ++ strip_proc.stdout_behavior = .Ignore; ++ strip_proc.stderr_behavior = .Ignore; ++ ++ _ = strip_proc.spawnAndWait() catch |err| { ++ return fatal("running strip: {s}\n", .{@errorName(err)}); ++ }; ++ ++ return code; ++} ++ + // argv_it is an object that has such method: + // fn next(self: *Self) ?[]const u8 + // in non-testing code it is *process.ArgIterator. diff --git a/bazel/rules_rust.patch b/bazel/rules_rust.patch new file mode 100644 index 000000000000..d9c905308d14 --- /dev/null +++ b/bazel/rules_rust.patch @@ -0,0 +1,134 @@ +# Expose strip_level configuration at the top level, so we can disable the +# default stripping of opt (https://github.com/bazelbuild/rules_rust/pull/3434). +diff --git a/rust/private/repository_utils.bzl b/rust/private/repository_utils.bzl +index bc62a7ef..072396c5 100644 +--- a/rust/private/repository_utils.bzl ++++ b/rust/private/repository_utils.bzl +@@ -268,6 +268,7 @@ rust_toolchain( + extra_rustc_flags = {extra_rustc_flags}, + extra_exec_rustc_flags = {extra_exec_rustc_flags}, + opt_level = {opt_level}, ++ strip_level = {strip_level}, + tags = ["rust_version={version}"], + ) + """ +@@ -285,7 +286,8 @@ def BUILD_for_rust_toolchain( + stdlib_linkflags = None, + extra_rustc_flags = None, + extra_exec_rustc_flags = None, +- opt_level = None): ++ opt_level = None, ++ strip_level = None): + """Emits a toolchain declaration to match an existing compiler and stdlib. + + Args: +@@ -306,6 +308,7 @@ def BUILD_for_rust_toolchain( + extra_rustc_flags (list, optional): Extra flags to pass to rustc in non-exec configuration. + extra_exec_rustc_flags (list, optional): Extra flags to pass to rustc in exec configuration. + opt_level (dict, optional): Optimization level config for this toolchain. ++ strip_level (dict, optional): Strip level config for this toolchain. + + Returns: + str: A rendered template of a `rust_toolchain` declaration +@@ -345,6 +348,7 @@ def BUILD_for_rust_toolchain( + extra_rustc_flags = extra_rustc_flags, + extra_exec_rustc_flags = extra_exec_rustc_flags, + opt_level = opt_level, ++ strip_level = strip_level, + version = version, + ) + +diff --git a/rust/repositories.bzl b/rust/repositories.bzl +index 06de237d..0b22ddca 100644 +--- a/rust/repositories.bzl ++++ b/rust/repositories.bzl +@@ -148,6 +148,7 @@ def rust_register_toolchains( + extra_target_triples = DEFAULT_EXTRA_TARGET_TRIPLES, + extra_rustc_flags = None, + extra_exec_rustc_flags = None, ++ strip_level = None, + urls = DEFAULT_STATIC_RUST_URL_TEMPLATES, + versions = _RUST_TOOLCHAIN_VERSIONS, + aliases = {}, +@@ -186,6 +187,7 @@ def rust_register_toolchains( + extra_target_triples (list, optional): Additional rust-style targets that rust toolchains should support. + extra_rustc_flags (dict, list, optional): Dictionary of target triples to list of extra flags to pass to rustc in non-exec configuration. + extra_exec_rustc_flags (list, optional): Extra flags to pass to rustc in exec configuration. ++ strip_level (dict, dict, optional): Dictionary of target triples to strip config. + urls (list, optional): A list of mirror urls containing the tools from the Rust-lang static file server. These must contain the '{}' used to substitute the tool being fetched (using .format). + versions (list, optional): A list of toolchain versions to download. This parameter only accepts one versions + per channel. E.g. `["1.65.0", "nightly/2022-11-02", "beta/2020-12-30"]`. +@@ -263,6 +265,7 @@ def rust_register_toolchains( + rustfmt_version = rustfmt_version, + extra_rustc_flags = extra_rustc_flags, + extra_exec_rustc_flags = extra_exec_rustc_flags, ++ strip_level = strip_level, + sha256s = sha256s, + urls = urls, + versions = versions, +@@ -389,6 +392,9 @@ _RUST_TOOLCHAIN_REPOSITORY_ATTRS = { + "opt_level": attr.string_dict( + doc = "Rustc optimization levels. For more details see the documentation for `rust_toolchain.opt_level`.", + ), ++ "strip_level": attr.string_dict( ++ doc = "Rustc strip levels. For more details see the documentation for `rust_toolchain.strip_level`.", ++ ), + "rustfmt_version": attr.string( + doc = "The version of the tool among \"nightly\", \"beta\", or an exact version.", + ), +@@ -509,6 +515,7 @@ def _rust_toolchain_tools_repository_impl(ctx): + extra_rustc_flags = ctx.attr.extra_rustc_flags, + extra_exec_rustc_flags = ctx.attr.extra_exec_rustc_flags, + opt_level = ctx.attr.opt_level if ctx.attr.opt_level else None, ++ strip_level = ctx.attr.strip_level if ctx.attr.strip_level else None, + version = ctx.attr.version, + )) + +@@ -608,6 +615,7 @@ def rust_toolchain_repository( + extra_rustc_flags = None, + extra_exec_rustc_flags = None, + opt_level = None, ++ strip_level = None, + sha256s = None, + urls = DEFAULT_STATIC_RUST_URL_TEMPLATES, + auth = None, +@@ -635,6 +643,7 @@ def rust_toolchain_repository( + extra_rustc_flags (list, optional): Extra flags to pass to rustc in non-exec configuration. + extra_exec_rustc_flags (list, optional): Extra flags to pass to rustc in exec configuration. + opt_level (dict, optional): Optimization level config for this toolchain. ++ strip_level (dict, optional): Strip level config for this toolchain. + sha256s (str, optional): A dict associating tool subdirectories to sha256 hashes. See + [rust_register_toolchains](#rust_register_toolchains) for more details. + urls (list, optional): A list of mirror urls containing the tools from the Rust-lang static file server. These must contain the '{}' used to substitute the tool being fetched (using .format). Defaults to ['https://static.rust-lang.org/dist/{}.tar.xz'] +@@ -667,6 +676,7 @@ def rust_toolchain_repository( + extra_rustc_flags = extra_rustc_flags, + extra_exec_rustc_flags = extra_exec_rustc_flags, + opt_level = opt_level, ++ strip_level = strip_level, + sha256s = sha256s, + urls = urls, + auth = auth, +@@ -1109,6 +1119,7 @@ def rust_repository_set( + extra_rustc_flags = None, + extra_exec_rustc_flags = None, + opt_level = None, ++ strip_level = None, + sha256s = None, + urls = DEFAULT_STATIC_RUST_URL_TEMPLATES, + auth = None, +@@ -1142,6 +1153,7 @@ def rust_repository_set( + extra_rustc_flags (dict, list, optional): Dictionary of target triples to list of extra flags to pass to rustc in non-exec configuration. + extra_exec_rustc_flags (list, optional): Extra flags to pass to rustc in exec configuration. + opt_level (dict, dict, optional): Dictionary of target triples to optimiztion config. ++ strip_level (dict, dict, optional): Dictionary of target triples to strip config. + sha256s (str, optional): A dict associating tool subdirectories to sha256 hashes. See + [rust_register_toolchains](#rust_register_toolchains) for more details. + urls (list, optional): A list of mirror urls containing the tools from the Rust-lang static file server. These +@@ -1197,6 +1209,7 @@ def rust_repository_set( + extra_exec_rustc_flags = extra_exec_rustc_flags, + extra_rustc_flags = toolchain_extra_rustc_flags, + opt_level = opt_level.get(toolchain.target_triple) if opt_level != None else None, ++ strip_level = strip_level.get(toolchain.target_triple) if strip_level != None else None, + target_settings = target_settings, + rustfmt_version = rustfmt_version, + sha256s = sha256s, From ee8c39d31150e1b063b298b4e71c2c3da3a2d077 Mon Sep 17 00:00:00 2001 From: IDX GitHub Automation Date: Tue, 6 May 2025 22:02:22 +0000 Subject: [PATCH 27/28] Automatically updated Cargo*.lock --- Cargo.Bazel.Fuzzing.json.lock | 62 +++++++++++++++++++++++++++++------ Cargo.Bazel.json.lock | 34 +++++++++++++++++-- 2 files changed, 83 insertions(+), 13 deletions(-) diff --git a/Cargo.Bazel.Fuzzing.json.lock b/Cargo.Bazel.Fuzzing.json.lock index 751ec610058c..3252926b25bd 100644 --- a/Cargo.Bazel.Fuzzing.json.lock +++ b/Cargo.Bazel.Fuzzing.json.lock @@ -1,5 +1,5 @@ { - "checksum": "6ed0a3b315f93d138d06898f445b7c59aa56266e7093b98a3f5f5e9a58ec7a4f", + "checksum": "1d8a39676065bfc3914f59f8d11649c6b77f485d5c797be06e2dfb21750591d2", "crates": { "abnf 0.12.0": { "name": "abnf", @@ -6901,7 +6901,9 @@ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", - "-Zsanitizer=address" + "-Zsanitizer=address", + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a" ], "selects": {} }, @@ -7691,7 +7693,9 @@ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", - "-Zsanitizer=address" + "-Zsanitizer=address", + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a" ], "selects": {} }, @@ -7808,7 +7812,9 @@ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", - "-Zsanitizer=address" + "-Zsanitizer=address", + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a" ], "selects": {} }, @@ -7955,7 +7961,9 @@ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", - "-Zsanitizer=address" + "-Zsanitizer=address", + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a" ], "selects": {} }, @@ -11483,7 +11491,9 @@ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", - "-Zsanitizer=address" + "-Zsanitizer=address", + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a" ], "selects": {} }, @@ -11833,7 +11843,13 @@ "repository": { "Http": { "url": "https://static.crates.io/crates/cc/1.1.37/download", - "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf" + "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf", + "patch_args": [ + "-p1" + ], + "patches": [ + "@@//bazel:cc_rs.patch" + ] } }, "targets": [ @@ -35164,7 +35180,9 @@ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", - "-Zsanitizer=address" + "-Zsanitizer=address", + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a" ], "selects": {} }, @@ -42846,6 +42864,12 @@ "compile_data_glob": [ "**" ], + "data": { + "common": [ + "@openssl//:gen_dir" + ], + "selects": {} + }, "data_glob": [ "**" ], @@ -43029,7 +43053,8 @@ ], "crate_features": { "common": [ - "libc" + "libc", + "static" ], "selects": {} }, @@ -50073,6 +50098,12 @@ "compile_data_glob": [ "**" ], + "data": { + "common": [ + "@openssl//:gen_dir" + ], + "selects": {} + }, "data_glob": [ "**" ], @@ -50093,6 +50124,15 @@ ], "selects": {} }, + "build_script_env": { + "common": { + "OPENSSL_INCLUDE_DIR": "$(location @openssl//:gen_dir)/include", + "OPENSSL_LIB_DIR": "$(location @openssl//:gen_dir)/lib64", + "OPENSSL_NO_VENDOR": "1", + "OPENSSL_STATIC": "1" + }, + "selects": {} + }, "links": "openssl" }, "license": "MIT", @@ -87463,7 +87503,9 @@ "-Ccodegen-units=1", "-Zextra-const-ub-checks", "-Zstrict-init-checks", - "-Zsanitizer=address" + "-Zsanitizer=address", + "-Zexternal-clangrt", + "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a" ], "selects": {} }, diff --git a/Cargo.Bazel.json.lock b/Cargo.Bazel.json.lock index 5c99fc91b445..4e4e18f9a981 100644 --- a/Cargo.Bazel.json.lock +++ b/Cargo.Bazel.json.lock @@ -1,5 +1,5 @@ { - "checksum": "ee482aabb6f65a21627acc2d50a194116634bd83478fddead5a652a044409537", + "checksum": "f21a969738442acdb79945ba5a0c0168a7300da015673db62050b060c92fe66b", "crates": { "abnf 0.12.0": { "name": "abnf", @@ -11729,7 +11729,13 @@ "repository": { "Http": { "url": "https://static.crates.io/crates/cc/1.1.37/download", - "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf" + "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf", + "patch_args": [ + "-p1" + ], + "patches": [ + "@@//bazel:cc_rs.patch" + ] } }, "targets": [ @@ -42680,6 +42686,12 @@ "compile_data_glob": [ "**" ], + "data": { + "common": [ + "@openssl//:gen_dir" + ], + "selects": {} + }, "data_glob": [ "**" ], @@ -42863,7 +42875,8 @@ ], "crate_features": { "common": [ - "libc" + "libc", + "static" ], "selects": {} }, @@ -49913,6 +49926,12 @@ "compile_data_glob": [ "**" ], + "data": { + "common": [ + "@openssl//:gen_dir" + ], + "selects": {} + }, "data_glob": [ "**" ], @@ -49933,6 +49952,15 @@ ], "selects": {} }, + "build_script_env": { + "common": { + "OPENSSL_INCLUDE_DIR": "$(location @openssl//:gen_dir)/include", + "OPENSSL_LIB_DIR": "$(location @openssl//:gen_dir)/lib64", + "OPENSSL_NO_VENDOR": "1", + "OPENSSL_STATIC": "1" + }, + "selects": {} + }, "links": "openssl" }, "license": "MIT", From 5f9c979693f05ab7ab6180808a6eab39d1d030ab Mon Sep 17 00:00:00 2001 From: IDX GitHub Automation Date: Wed, 7 May 2025 22:44:00 +0000 Subject: [PATCH 28/28] Automatically updated Cargo*.lock --- Cargo.Bazel.Fuzzing.json.lock | 2 +- Cargo.Bazel.json.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.Bazel.Fuzzing.json.lock b/Cargo.Bazel.Fuzzing.json.lock index cf5a7d44aaeb..dd5f47075a13 100644 --- a/Cargo.Bazel.Fuzzing.json.lock +++ b/Cargo.Bazel.Fuzzing.json.lock @@ -1,5 +1,5 @@ { - "checksum": "af50e58f56e3c46042059111c35babb892203a6f2eaa9a5616ff1100f879acbf", + "checksum": "30e48d4f5cbffd33a7daafeb0b6b3d2dd80242acbdcd9c49960bbf8534cd0ed7", "crates": { "abnf 0.12.0": { "name": "abnf", diff --git a/Cargo.Bazel.json.lock b/Cargo.Bazel.json.lock index db3d64623fe8..adec9d13e623 100644 --- a/Cargo.Bazel.json.lock +++ b/Cargo.Bazel.json.lock @@ -1,5 +1,5 @@ { - "checksum": "7b9bdc00e460dc4fdc5a4b7b9b56ffa17383599a71f63df278b7621689f6f049", + "checksum": "b908b96e4913cfc202890880cec00b55f6fda2f3a2a3f1440da7df3bd665ee24", "crates": { "abnf 0.12.0": { "name": "abnf",