feat: [NODE-1566] Build with hermetic cc toolchains (again)

.github/actions/bazel/bin/bazel

@@ -46,6 +46,8 @@ bazel_args=( "$@" )
 # stored here again for easy access
 bazel_command="$1"
 
+# Setup zig-cache
+mkdir -p /tmp/zig-cache
 
 # Unless explicitly provided, we set a default --repository_cache to a volume mounted inside our runners
 # Only for Linux builds since there `/cache` is mounted to host local storage.

Cargo.Bazel.Fuzzing.json.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "af50e58f56e3c46042059111c35babb892203a6f2eaa9a5616ff1100f879acbf",
+  "checksum": "30e48d4f5cbffd33a7daafeb0b6b3d2dd80242acbdcd9c49960bbf8534cd0ed7",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
@@ -6901,7 +6901,9 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -7691,7 +7693,9 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -7808,7 +7812,9 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -7955,7 +7961,9 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -11483,7 +11491,9 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -11833,7 +11843,13 @@
       "repository": {
         "Http": {
           "url": "https://static.crates.io/crates/cc/1.1.37/download",
-          "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf"
+          "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf",
+          "patch_args": [
+            "-p1"
+          ],
+          "patches": [
+            "@@//bazel:cc_rs.patch"
+          ]
         }
       },
       "targets": [
@@ -35208,7 +35224,9 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },
@@ -42946,6 +42964,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "data": {
+          "common": [
+            "@openssl//:gen_dir"
+          ],
+          "selects": {}
+        },
         "data_glob": [
           "**"
         ],
@@ -43129,7 +43153,8 @@
         ],
         "crate_features": {
           "common": [
-            "libc"
+            "libc",
+            "static"
           ],
           "selects": {}
         },
@@ -50249,6 +50274,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "data": {
+          "common": [
+            "@openssl//:gen_dir"
+          ],
+          "selects": {}
+        },
         "data_glob": [
           "**"
         ],
@@ -50269,6 +50300,15 @@
           ],
           "selects": {}
         },
+        "build_script_env": {
+          "common": {
+            "OPENSSL_INCLUDE_DIR": "$(location @openssl//:gen_dir)/include",
+            "OPENSSL_LIB_DIR": "$(location @openssl//:gen_dir)/lib64",
+            "OPENSSL_NO_VENDOR": "1",
+            "OPENSSL_STATIC": "1"
+          },
+          "selects": {}
+        },
         "links": "openssl"
       },
       "license": "MIT",
@@ -87656,7 +87696,9 @@
             "-Ccodegen-units=1",
             "-Zextra-const-ub-checks",
             "-Zstrict-init-checks",
-            "-Zsanitizer=address"
+            "-Zsanitizer=address",
+            "-Zexternal-clangrt",
+            "-Clink-arg=bazel-out/k8-opt/bin/external/rust_linux_x86_64__x86_64-unknown-linux-gnu__nightly_tools/rust_toolchain/lib/rustlib/x86_64-unknown-linux-gnu/lib/librustc-nightly_rt.asan.a"
           ],
           "selects": {}
         },

Cargo.Bazel.json.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "7b9bdc00e460dc4fdc5a4b7b9b56ffa17383599a71f63df278b7621689f6f049",
+  "checksum": "b908b96e4913cfc202890880cec00b55f6fda2f3a2a3f1440da7df3bd665ee24",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
@@ -11729,7 +11729,13 @@
       "repository": {
         "Http": {
           "url": "https://static.crates.io/crates/cc/1.1.37/download",
-          "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf"
+          "sha256": "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf",
+          "patch_args": [
+            "-p1"
+          ],
+          "patches": [
+            "@@//bazel:cc_rs.patch"
+          ]
         }
       },
       "targets": [
@@ -42780,6 +42786,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "data": {
+          "common": [
+            "@openssl//:gen_dir"
+          ],
+          "selects": {}
+        },
         "data_glob": [
           "**"
         ],
@@ -42963,7 +42975,8 @@
         ],
         "crate_features": {
           "common": [
-            "libc"
+            "libc",
+            "static"
           ],
           "selects": {}
         },
@@ -50089,6 +50102,12 @@
         "compile_data_glob": [
           "**"
         ],
+        "data": {
+          "common": [
+            "@openssl//:gen_dir"
+          ],
+          "selects": {}
+        },
         "data_glob": [
           "**"
         ],
@@ -50109,6 +50128,15 @@
           ],
           "selects": {}
         },
+        "build_script_env": {
+          "common": {
+            "OPENSSL_INCLUDE_DIR": "$(location @openssl//:gen_dir)/include",
+            "OPENSSL_LIB_DIR": "$(location @openssl//:gen_dir)/lib64",
+            "OPENSSL_NO_VENDOR": "1",
+            "OPENSSL_STATIC": "1"
+          },
+          "selects": {}
+        },
         "links": "openssl"
       },
       "license": "MIT",

MODULE.bazel

@@ -7,13 +7,20 @@ module(
 )
 
 # General Bazel helpers
-
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "aspect_bazel_lib", version = "2.9.0")
 
 # CC dependencies (for C libs like miracl-core, etc)
 bazel_dep(name = "rules_cc", version = "0.0.13")
 bazel_dep(name = "platforms", version = "0.0.10")
+bazel_dep(name = "hermetic_cc_toolchain", version = "3.1.1")
+archive_override(
+    module_name = "hermetic_cc_toolchain",
+    integrity = "sha256-kHdFv5FVX3foI0wLlTNx5srFunFdHPEv9kFJbdG86dE=",
+    patch_strip = 1,
+    patches = ["//bazel:hermetic_cc_toolchain.patch"],
+    urls = ["https://github.com/uber/hermetic_cc_toolchain/releases/download/v3.1.1/hermetic_cc_toolchain-v3.1.1.tar.gz"],
+)
 
 # configure/make dependencies
 bazel_dep(name = "rules_foreign_cc", version = "0.12.0")
@@ -837,3 +844,28 @@ mainnet_icos_versions(
 os_info = use_repo_rule("//bazel:os_info.bzl", "os_info")
 
 os_info(name = "os_info")
+
+# Set up hermetic cc toolchains for binaries and canisters
+toolchains = use_extension("@hermetic_cc_toolchain//toolchain:ext.bzl", "toolchains")
+
+# The use_hermetic_cc setting is added to each toolchain to allow us to opt out
+# in favor of system toolchains, when needed.
+toolchains.extra_settings(settings = ["//bazel:use_hermetic_cc"])
+use_repo(toolchains, "zig_sdk")
+
+register_toolchains(
+    # Linux toolchains
+    "@zig_sdk//toolchain:linux_amd64_gnu.2.28",
+
+    # macOS toolchains
+    # Do not use hermetic toolchains for macOS until we have had a chance to
+    # wrap the various system libraries.
+    # "@zig_sdk//toolchain:darwin_amd64",
+    # "@zig_sdk//toolchain:darwin_arm64",
+
+    # wasm toolchains
+    "@zig_sdk//toolchain:none_wasm",
+
+    # These toolchains are only registered locally.
+    dev_dependency = True,
+)

WORKSPACE.bazel

@@ -6,7 +6,9 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("//bazel:mainnet-canisters.bzl", "canisters")
 load("//bazel:mainnet-icos-images.bzl", "mainnet_icos_images")
 load("//third_party/jemalloc:repository.bzl", "jemalloc_repository")
+load("//third_party/libfuzzer:repository.bzl", "libfuzzer_repository")
 load("//third_party/lmdb:repository.bzl", "lmdb_repository")
+load("//third_party/openssl:repository.bzl", "openssl_repository")
 
 # We cannot derive the Bazel repository names (e.g. @mainnet_nns_registry_canister) directly
 # from the canister names because we use inconsistent repo names. Same goes for filenames.
@@ -108,6 +110,8 @@ sol_register_toolchains(
 http_archive(
     name = "rules_rust",
     integrity = "sha256-8TBqrAsli3kN8BrZq8arsN8LZUFsdLTvJ/Sqsph4CmQ=",
+    patch_args = ["-p1"],
+    patches = ["//bazel:rules_rust.patch"],
     urls = ["https://github.com/bazelbuild/rules_rust/releases/download/0.56.0/rules_rust-0.56.0.tar.gz"],
 )
 
@@ -120,6 +124,11 @@ rust_analyzer_dependencies()
 
 rust_register_toolchains(
     edition = "2021",
+    strip_level = {"x86_64-unknown-linux-gnu": {
+        "dbg": "none",
+        "fastbuild": "none",
+        "opt": "none",
+    }},
     # The nightly version is required to compile fuzz tests from Bazel.
     # The version below is chosen so that it is in sync with the non-nightly version.
     versions = [
@@ -169,6 +178,10 @@ lmdb_repository()
 
 jemalloc_repository()
 
+openssl_repository()
+
+libfuzzer_repository()
+
 http_archive(
     name = "buildifier_prebuilt",
     sha256 = "72b5bb0853aac597cce6482ee6c62513318e7f2c0050bc7c319d75d03d8a3875",
@@ -269,3 +282,29 @@ mainnet_icos_images()
 load("//bazel:spawn_proto_library.bzl", "spawn_proto_library")
 
 spawn_proto_library(name = "spawn_proto_library")
+
+# Use libsystemd from the host environment
+# Ideally this is pulled hermetically, but as this is only used by infogetty
+# within IC images, we have less compatibility to worry about, and packaging it
+# this way is easier.
+new_local_repository(
+    name = "libsystemd",
+    build_file_content = """
+cc_import(
+    name = "libsystemd-internal",
+    hdrs = glob(["include/systemd/*.h"]),
+    interface_library = "lib/x86_64-linux-gnu/libsystemd.so",
+    system_provided = True,
+    visibility = ["//visibility:private"],
+)
+
+# Use an extra cc_library to hide the depth of the include folder
+cc_library(
+    name = "libsystemd",
+    includes = ["include"],
+    deps = ["libsystemd-internal"],
+    visibility = ["//visibility:public"],
+)
+""",
+    path = "/usr",
+)

bazel/BUILD.bazel

@@ -53,6 +53,20 @@ config_setting(
     },
 )
 
+# Allow targets to opt out of hermetic toolchains, in favor of the one provided
+# by the system
+bool_flag(
+    name = "hermetic_cc",
+    build_setting_default = True,
+)
+
+config_setting(
+    name = "use_hermetic_cc",
+    flag_values = {
+        ":hermetic_cc": "True",
+    },
+)
+
 string_flag(
     name = "timeout_value",
     build_setting_default = "10m",