feat: Wrap components as prep for container upgrade

bazel/hermetic_cc_toolchain.patch

@@ -6,19 +6,37 @@
 # Strip debug_info off every target for determinism
 # (https://github.com/ziglang/zig/issues/23821, https://github.com/ziglang/zig/issues/23823).
 diff --git a/MODULE.bazel b/MODULE.bazel
-index 409d626..1265298 100644
+index 409d626..15b70b3 100644
 --- a/MODULE.bazel
 +++ b/MODULE.bazel
-@@ -49,6 +49,7 @@ register_toolchains(
+@@ -49,7 +49,25 @@ register_toolchains(
      "@zig_sdk//libc_aware/toolchain:linux_arm64_musl",
      # wasm/wasi toolchains
      "@zig_sdk//toolchain:wasip1_wasm",
 +    "@zig_sdk//toolchain:none_wasm",
-
+ 
      # These toolchains are only registered locally.
      dev_dependency = True,
+ )
++
++bazel_dep(name = "bazel_skylib", version = "1.7.1")
++
++new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")
++new_local_repository(
++    name = "strip",
++    build_file_content = """
++load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
++
++native_binary(
++name = "strip_bin",
++src = ":strip",
++visibility = ["//visibility:public"],
++)
++""",
++    path = "/usr/bin",
++)
 diff --git a/toolchain/defs.bzl b/toolchain/defs.bzl
-index f6f613e..3f45d85 100644
+index f6f613e..4b36565 100644
 --- a/toolchain/defs.bzl
 +++ b/toolchain/defs.bzl
 @@ -60,7 +60,8 @@ def toolchains(
@@ -37,12 +55,12 @@ index f6f613e..3f45d85 100644
          host_platform_ext = host_platform_ext,
 +        extra_settings = extra_settings
      )
-
+ 
  def _quote(s):
 @@ -110,6 +112,8 @@ def _zig_repository_impl(repository_ctx):
          "host_platform": host_platform,
      }
-
+ 
 +    extra_settings = "[" + " ".join([_quote(str(setting)) for setting in repository_ctx.attr.extra_settings]) + "]"
 +
      # Fetch Label dependencies before doing download/extract.
@@ -57,7 +75,7 @@ index f6f613e..3f45d85 100644
          "libc_aware/platform/BUILD": "//toolchain/libc_aware/platform:BUILD",
          "libc_aware/toolchain/BUILD": "//toolchain/libc_aware/toolchain:BUILD",
 @@ -126,6 +129,7 @@ def _zig_repository_impl(repository_ctx):
-
+ 
      for dest, src in {
          "BUILD": "//toolchain:BUILD.sdk.bazel",
 +        "toolchain/BUILD": "//toolchain/toolchain:BUILD",
@@ -71,7 +89,7 @@ index f6f613e..3f45d85 100644
 +                "{extra_settings}": extra_settings,
              },
          )
-
+ 
 @@ -148,7 +153,7 @@ def _zig_repository_impl(repository_ctx):
      cache_prefix = repository_ctx.os.environ.get("HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX", "")
      if cache_prefix == "":
@@ -84,7 +102,7 @@ index f6f613e..3f45d85 100644
 @@ -156,6 +161,10 @@ def _zig_repository_impl(repository_ctx):
          else:
              fail("unknown os: {}".format(os))
-
+ 
 +    # use the catchall config to ensure all builds use a `zig-cache/config-FOO/`
 +    # subdirectory, including the zig-wrapper itself
 +    cache_prefix = cache_prefix + "/config-catchall"
@@ -100,20 +118,36 @@ index f6f613e..3f45d85 100644
      },
      environ = ["HERMETIC_CC_TOOLCHAIN_CACHE_PREFIX"],
      implementation = _zig_repository_impl,
+@@ -272,6 +282,7 @@ def declare_files(os):
+                 ":zig",
+                 ":{}_includes".format(target_config.zigtarget),
+                 cxx_tool_label,
++                "@strip//:strip_bin",
+             ],
+         )
+
+@@ -281,6 +292,7 @@ def declare_files(os):
+                 ":zig",
+                 ":{}_includes".format(target_config.zigtarget),
+                 cxx_tool_label,
++                "@strip//:strip_bin",
+             ] + native.glob([
+                 "lib/libc/{}/**".format(target_config.libc),
+                 "lib/libcxx/**",
 diff --git a/toolchain/ext.bzl b/toolchain/ext.bzl
 index ebf0ff8..c2e8af3 100644
 --- a/toolchain/ext.bzl
 +++ b/toolchain/ext.bzl
 @@ -1,6 +1,11 @@
  load("@hermetic_cc_toolchain//toolchain:defs.bzl", zig_toolchains = "toolchains")
-
+ 
  def _toolchains_impl(ctx):
 -    zig_toolchains()
 +    extra_settings = []
 +    for mod in ctx.modules:
 +        for tag in mod.tags.extra_settings:
 +            extra_settings += tag.settings
-
+ 
 -toolchains = module_extension(implementation = _toolchains_impl)
 +    zig_toolchains(extra_settings = extra_settings)
 +
@@ -123,11 +157,11 @@ index d4a8344..faafc5b 100644
 --- a/toolchain/platform/defs.bzl
 +++ b/toolchain/platform/defs.bzl
 @@ -16,6 +16,7 @@ def declare_platforms():
-
+ 
      # We can support GOARCH=wasm32 after https://github.com/golang/go/issues/63131
      declare_platform("wasm", "wasm32", "wasi", "wasip1")
 +    declare_platform("wasm", "wasm32", "none", "none")
-
+ 
  def declare_libc_aware_platforms():
      # create @zig_sdk//{os}_{arch}_platform entries with zig and go conventions
 diff --git a/toolchain/private/defs.bzl b/toolchain/private/defs.bzl
@@ -140,7 +174,7 @@ index 716a3a3..b88d082 100644
      ret.append(_target_wasm())
 +    ret.append(_target_wasm_no_wasi())
      return ret
-
+ 
  def _target_macos(gocpu, zigcpu):
 @@ -222,3 +223,22 @@ def _target_wasm():
          ld_zig_subcmd = "wasm-ld",
@@ -172,7 +206,7 @@ index 552fcaa..8f7dba5 100644
 @@ -4,4 +4,4 @@ package(
      default_visibility = ["//visibility:public"],
  )
-
+ 
 -declare_toolchains()
 +declare_toolchains(extra_settings = {extra_settings})
 diff --git a/toolchain/toolchain/defs.bzl b/toolchain/toolchain/defs.bzl
@@ -181,7 +215,7 @@ index 50cc881..0549c26 100644
 +++ b/toolchain/toolchain/defs.bzl
 @@ -1,6 +1,6 @@
  load("@hermetic_cc_toolchain//toolchain/private:defs.bzl", "target_structs")
-
+ 
 -def declare_toolchains():
 +def declare_toolchains(extra_settings = []):
      for target_config in target_structs():
@@ -190,16 +224,16 @@ index 50cc881..0549c26 100644
 @@ -12,7 +12,7 @@ def declare_toolchains():
          if hasattr(target_config, "libc_constraint"):
              extra_constraints = ["@zig_sdk//libc:unconstrained"]
-
+ 
 -        _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + extra_constraints)
 +        _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + extra_constraints, extra_settings)
-
+ 
  def declare_libc_aware_toolchains():
      for target_config in target_structs():
 @@ -25,13 +25,14 @@ def declare_libc_aware_toolchains():
          if hasattr(target_config, "libc_constraint"):
              _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + [target_config.libc_constraint])
-
+ 
 -def _declare_toolchain(gotarget, zigtarget, target_compatible_with):
 +def _declare_toolchain(gotarget, zigtarget, target_compatible_with, extra_settings):
      # register two kinds of toolchain targets: Go and Zig conventions.
@@ -236,7 +270,7 @@ index d1d59f9..4f471ee 100644
 @@ -161,6 +161,71 @@ fn execUnix(arena: mem.Allocator, params: ExecParams) u8 {
      return 1;
  }
-
+ 
 +fn makeSuffix(allocator: std.mem.Allocator, pwd: []const u8) ![]const u8 {
 +    var it = std.mem.tokenize(u8, pwd, "/");
 +
@@ -308,7 +342,7 @@ index d1d59f9..4f471ee 100644
 @@ -217,9 +282,19 @@ fn parseArgs(
      var env = process.getEnvMap(arena) catch |err|
          return parseFatal(arena, "error getting env: {s}", .{@errorName(err)});
-
+ 
 +    // Get the current working directory (PWD)
 +    const allocator = std.heap.page_allocator;
 +    const pwd = std.fs.cwd().realpathAlloc(allocator, ".") catch {
@@ -324,15 +358,15 @@ index d1d59f9..4f471ee 100644
 -    try env.put("ZIG_GLOBAL_CACHE_DIR", CACHE_DIR);
 +    try env.put("ZIG_LOCAL_CACHE_DIR", cache_dir);
 +    try env.put("ZIG_GLOBAL_CACHE_DIR", cache_dir);
-
+ 
      // args is the path to the zig binary and args to it.
      var args = ArrayListUnmanaged([]const u8){};
 @@ -283,7 +358,7 @@ fn getRunMode(self_exe: []const u8, self_base_noexe: []const u8) error{BadParent
          return error.BadParent;
-
+ 
      const got_os = it.next() orelse return error.BadParent;
 -    if (mem.indexOf(u8, "linux,macos,windows,wasi", got_os) == null)
 +    if (mem.indexOf(u8, "linux,macos,windows,wasi,freestanding", got_os) == null)
          return error.BadParent;
-
+ 
      // ABI triple is too much of a moving target

toolchains/sysimage/build_container_filesystem_tar.py

@@ -17,10 +17,8 @@
 from loguru import logger as log
 
 from toolchains.sysimage.utils import (
-    path_owned_by_root,
     purge_podman,
     remove_image,
-    take_ownership_of_file,
 )
 
 
@@ -103,19 +101,22 @@ def export_container_filesystem(container_cmd: str, image_tag: str, destination_
     Export the filesystem from an image.
     Creates container - but does not start it, avoiding timestamp and other determinism issues.
     """
+    tempdir = tempfile.mkdtemp()
+    tar_file = tempdir + "/temp.tar"
+    fakeroot_statefile = tempdir + "/fakeroot.state"
+    tar_dir = tempdir + "/tar"
+
     container_name = image_tag + "_container"
     invoke.run(f"{container_cmd} create --name {container_name} {image_tag}")
-    invoke.run(f"{container_cmd} export -o {destination_tar_filename} {container_name}")
+    invoke.run(f"{container_cmd} export -o {tar_file} {container_name}")
+    invoke.run(f"mkdir -p {tar_dir}")
+    invoke.run(f"fakeroot -s {fakeroot_statefile} tar xpf {tar_file} --same-owner -C {tar_dir}")
+    invoke.run(
+        f"fakeroot -i {fakeroot_statefile} tar cf {destination_tar_filename} --numeric-owner --sort=name --exclude='run/*' -C {tar_dir} $(ls -A {tar_dir})"
+    )
     invoke.run("sync")
     invoke.run(f"{container_cmd} container rm {container_name}")
 
-    destination_tar_path = Path(destination_tar_filename)
-    # Using sudo w/ podman requires changing permissions on the output tar file (not the tar contents)
-    assert path_owned_by_root(
-        destination_tar_path
-    ), f"'{destination_tar_path}' not owned by root. Remove this and the next line."
-    take_ownership_of_file(destination_tar_path)
-
 
 def resolve_file_args(context_dir: str, file_build_args: List[str]) -> List[str]:
     result = list()