Bazel: Wrappers for transitions
- Public API:
bazel/rules/xcomp/cc.bzl
- Implementation:
bazel/rules/private/xcomp/**
The wrappers add a platform attribute to
cc_{binary,library,test}. It applies a transition that sets
the target platform (--platforms) for the target and its
deps. No-op if platform is unset.
Example:
load("@rules_cc//cc:cc_binary.bzl", "cc_binary") # <-- upstream
cc_binary(
name = "unixcat",
srcs = ["src/unixcat.cc"],
visibility = ["//visibility:public"],
deps = ["//packages/livestatus:livestatus_poller"],
)
load("//bazel/rules:xcomp/cc.bzl", "cc_binary") # <-- wrapper
cc_binary(
...
platform = "//bazel/platforms:x86_64-linux-gcc-hermetic", # <-- only difference from upstream
...
)
Debugging: Inspect configuration
$ bazel cquery //packages/unixcat --toolchain_resolution_debug='@bazel_tools//tools/cpp:toolchain_type' --action_env="__IGNORE=$(date +%s%N)"
INFO: Invocation ID: 0f408021-8fa2-4e9f-b814-4e323dbfca42
WARNING: Build option --action_env has changed, discarding analysis cache (this can be expensive, see https://bazel.build/advanced/performance/iteration-speed).
INFO: ToolchainResolution: Performing resolution of @@bazel_tools//tools/cpp:toolchain_type for target platform //bazel/platforms:x86_64-linux-gcc-hermetic
ToolchainResolution: Rejected toolchain @@toolchains_musl++toolchains_musl+musl-1_2_3-platform-aarch64-apple-darwin-target-aarch64-linux-musl//:musl-1_2_3-platform-aarch64-apple-darwin-target-aarch64-linux-musl; mismatching values: aarch64, musl
...
ToolchainResolution: Toolchain //bazel/toolchains/cc/gcc/hermetic:host_gcc is compatible with target platform, searching for execution platforms:
ToolchainResolution: Compatible execution platform @@platforms//host:host
ToolchainResolution: All execution platforms have been assigned a @@bazel_tools//tools/cpp:toolchain_type toolchain, stopping
ToolchainResolution: Recap of selected @@bazel_tools//tools/cpp:toolchain_type toolchains for target platform //bazel/platforms:x86_64-linux-gcc-hermetic:
ToolchainResolution: Selected //bazel/toolchains/cc/gcc/hermetic:host_gcc to run on execution platform @@platforms//host:host
INFO: ToolchainResolution: Target platform //bazel/platforms:x86_64-linux-gcc-hermetic: Selected execution platform @@platforms//host:host, type @@bazel_tools//tools/cpp:toolchain_type -> toolchain //bazel/toolchains/cc/gcc/hermetic:host_gcc
INFO: Analyzed target //packages/unixcat:unixcat (333 packages loaded, 7680 targets configured).
INFO: Found 1 target...
//packages/unixcat:unixcat (8336c99)
INFO: Elapsed time: 0.453s, Critical Path: 0.00s
INFO: 0 processes.
INFO: Build completed successfully, 0 total actions
--action_env="__IGNORE=$(date +%s%N)" changes on every
run. This reliably invalidates the analysis cache, so Bazel prints the
resolution log again.
Debugging: Inspect actions
$ bazel aquery 'mnemonic("CppCompile", //packages/unixcat)' # or ... mnemonic("CppLink", ...
action 'Compiling packages/unixcat/src/unixcat.cc'
...
ActionKey: 13d6e73a702f20c854f98e7c4fef85a5691b6965aa99be32befd9325c43163b1
Inputs: [... <too long for a slide but also contains standard headers and libraries> ...]
Outputs: [..., bazel-out/k8-fastbuild-ST-d7c9ef367ab5/bin/packages/unixcat/_objs/unixcat/unixcat.o]
Environment: [PATH=/usr/bin:/bin]
Command Line: (exec external/gcc_toolchain+/bin/x86_64-checkmk-linux-gnu-g++ \
'--sysroot=external/gcc_toolchain+/x86_64-checkmk-linux-gnu/sysroot' \
-no-canonical-prefixes \
-fno-canonical-system-headers \
-DNDEBUG \
-ffunction-sections \
-fdata-sections \
-fPIC \
-Wno-builtin-macro-redefined \
'-D__DATE__="redacted"' \
'-D__TIMESTAMP__="redacted"' \
'-D__TIME__="redacted"' \
'-ffile-prefix-map=__BAZEL_EXECUTION_ROOT__=.' \
'-frandom-seed=bazel-out/k8-fastbuild-ST-d7c9ef367ab5/bin/packages/unixcat/_objs/unixcat/unixcat.o' \
-iquote \
. \
-iquote \
bazel-out/k8-fastbuild-ST-d7c9ef367ab5/bin \
-iquote \
external/bazel_tools \
-iquote \
bazel-out/k8-fastbuild-ST-d7c9ef367ab5/bin/external/bazel_tools \
-Ibazel-out/k8-fastbuild-ST-d7c9ef367ab5/bin/packages/livestatus/_virtual_includes/livestatus_poller \
-MD \
-MF \
bazel-out/k8-fastbuild-ST-d7c9ef367ab5/bin/packages/unixcat/_objs/unixcat/unixcat.d \
-DRE2_ON_VALGRIND \
'-std=c++20' \
-O3 \
-c \
packages/unixcat/src/unixcat.cc \
-o \
bazel-out/k8-fastbuild-ST-d7c9ef367ab5/bin/packages/unixcat/_objs/unixcat/unixcat.o \
-O2)
ExecutionInfo: {manual: ''}
Debugging: Inspect binary artifacts
$ bazel --quiet build //packages/unixcat
Target //packages/unixcat:unixcat up-to-date:
bazel-bin/packages/unixcat/unixcat
readelf
$ readelf -p .comment bazel-bin/packages/unixcat/unixcat
String dump of section '.comment':
[ 0] GCC: (crosstool-NG UNKNOWN) 14.4.0
objdump -T or nm -D
$ objdump -T bazel-bin/packages/unixcat/unixcat | grep GLIBC_
0000000000000000 DF *UND* 0000000000000000 (GLIBC_2.2.5) __errno_location
0000000000000000 DF *UND* 0000000000000000 (GLIBC_2.2.5) socket
...
0000000000000000 DF *UND* 0000000000000000 (GLIBC_2.14) memcpy
...
0000000000000000 DF *UND* 0000000000000000 (GLIBC_2.2.5) __libc_start_main
$ nm -D --undefined-only bazel-bin/packages/unixcat/unixcat | grep '@GLIBC_'
U connect@GLIBC_2.2.5
U __errno_location@GLIBC_2.2.5
...
U memcpy@GLIBC_2.14
...
U write@GLIBC_2.2.5
Highest required version: GLIBC_2.14 ≤ 2.28, so unixcat
runs on Almalinux 8.
Handover: Pitfalls
For any system there is a certain amount of complexity which cannot
be reduced.
foreign_cc delegates to other build systems (autotools,
make, cmake, meson) that are not hermetic. Switching the toolchain on
those is possible but requires an assessment of their dependency
closure.- Apache modules are built with apxs2, which hardcodes the host
compiler by default.
apxs -S CC=... can override it, but we
have not tried.
- Updating the toolchain to a newer version of gcc typically means
adding multiple
-Wno-... flags to third-party builds.
- Proposal: Use two hermetic toolchains
- bleeding edge for cmc, livestatus, neb, and unixcat
- older gcc for third-party code
Handover: Open issues
--sysroot
We currently pass the --sysroot argument to gcc. This is
not required (gcc finds its files relative to the location of the
binary) and resulted in linker errors with foreign_cc in
the past.
However clang-tidy does require the argument: It
doesn’t use gcc at all and needs --sysroot to resolve the
headers correctly.
The latest version of clang_tidy.bzl in
rules_lint adds an args = [] parameter to
lint_clang_tidy_aspect() that gets forwarded to clang-tidy.
So, we might be able to remove the --sysroot argument from
gcc and add it to lint_clang_tidy_aspect().
bzlmod name
Currently bazel/thirdparty/modules/gcc_toolchain is
overly generic for a toolchain. It might be better to version the module
name to be able to add a gcc16 next to the current gcc14, for
example.
Move to fully hermetic
builds
WIP, currently low-prio
