Add support for layering_check

.github/workflows/tests.yml

@@ -110,7 +110,7 @@ jobs:
           release: llvmorg-16.0.0
           archive: clang+llvm-16.0.0-x86_64-linux-gnu-ubuntu-18.04
           ext: .tar.xz
-          local_path: /tmp/llvm-16
+          local_path: /opt/llvm-16
         run: wget --no-verbose "https://github.com/llvm/llvm-project/releases/download/${release}/${archive}${ext}" && tar -xf "${archive}${ext}" && mv "${archive}" "${local_path}"
       - name: Test
         run: tests/scripts/run_tests.sh -t @llvm_toolchain_with_system_llvm//:cc-toolchain-x86_64-linux

README.md

@@ -239,6 +239,19 @@ then they can be referenced as:
 - `@llvm_toolchain//:clang-format`
 - `@llvm_toolchain//:llvm-cov`
 
+### Strict header deps (Linux only)
+
+The toolchain supports Bazel's `layering_check` feature, which relies on
+[Clang modules](https://clang.llvm.org/docs/Modules.html) to implement strict
+deps (also known as "depend on what you use") for `cc_*` rules. This feature
+can be enabled by enabling the `layering_check` feature on a per-target,
+per-package or global basis.
+
+If one of toolchain or sysroot are specified via an absolute path rather than
+managed by Bazel, the `layering_check` feature may require running
+`bazel clean --expunge` after making changes to the set of header files
+installed on the host.
+
 ## Prior Art
 
 Other examples of toolchain configuration:

tests/.bazelrc

@@ -1 +1,2 @@
 build --incompatible_enable_cc_toolchain_resolution
+build --features=layering_check

tests/MODULE.bazel

@@ -31,9 +31,10 @@ bazel_dep(name = "rules_rust", version = "0.27.0")
 bazel_dep(name = "abseil-cpp", repo_name = "com_google_absl")
 archive_override(
     module_name = "abseil-cpp",
+    integrity = "sha256-y4VIbqbtC5jid7maB/QbWfwl9Yu0IZrDWaXGqQipvmk=",
     patches = ["//patches:abseil-cpp.patch"],
-    strip_prefix = "abseil-cpp-20230125.3",
-    urls = ["https://github.com/abseil/abseil-cpp/archive/refs/tags/20230125.3.tar.gz"],
+    strip_prefix = "abseil-cpp-b2dd3a5be797f8194bbc230c65f35aadd3998535",
+    urls = ["https://github.com/abseil/abseil-cpp/archive/b2dd3a5be797f8194bbc230c65f35aadd3998535.tar.gz"],
 )
 
 # Temporary override until newer version is released to the central registry.
@@ -52,6 +53,14 @@ git_override(
     remote = "https://github.com/bazelbuild/rules_rust.git",
 )
 
+# Temporary override until newer version is released to the central registry.
+# https://github.com/bazelbuild/rules_go/commit/31549c1f0fbe850aee3d2b7dd7a1303952f7cd75
+git_override(
+    module_name = "rules_go",
+    commit = "31549c1f0fbe850aee3d2b7dd7a1303952f7cd75",
+    remote = "https://github.com/bazelbuild/rules_go.git",
+)
+
 go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
 go_sdk.download(
     name = "go_sdk",
@@ -76,6 +85,7 @@ llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")
 # llvm_toolchain below, sys_paths_test in the workflows file, and xcompile_test
 # through the `llvm_toolchain_with_sysroot` toolchain.
 LLVM_VERSION = "15.0.6"
+
 LLVM_VERSIONS = {
     "": "16.0.0",
     "darwin-aarch64": "16.0.5",
@@ -144,8 +154,7 @@ llvm.toolchain(
     name = "llvm_toolchain_with_system_llvm",
     llvm_version = LLVM_VERSION,
     # For this toolchain to work, the LLVM distribution archive would need to be unpacked here.
-    # A path in /tmp to be part of system tmp cleanup schedule.
-    toolchain_roots = {"": "/tmp/llvm-16"},
+    toolchain_roots = {"": "/opt/llvm-16"},
 )
 use_repo(llvm, "llvm_toolchain_with_system_llvm")
 
@@ -155,11 +164,13 @@ llvm.toolchain(
     name = "llvm_toolchain_with_sysroot",
     llvm_versions = LLVM_VERSIONS,
     sysroot = {
-        "linux-x86_64": "@org_chromium_sysroot_linux_x64//:sysroot",
+        # TODO: Use an apparent repo name after #234 has been fixed.
+        "linux-x86_64": "@@org_chromium_sysroot_linux_x64//:sysroot",
     },
     # We can share the downloaded LLVM distribution with the first configuration.
     toolchain_roots = {
-        "": "@llvm_toolchain_llvm//",
+        # TODO: Use an apparent repo name after #234 has been fixed.
+        "": "@@toolchains_llvm~override~llvm~llvm_toolchain_llvm//",
     },
 )
 use_repo(llvm, "llvm_toolchain_with_sysroot")

tests/WORKSPACE

@@ -93,8 +93,7 @@ llvm_toolchain(
     name = "llvm_toolchain_with_system_llvm",
     llvm_version = LLVM_VERSION,
     # For this toolchain to work, the LLVM distribution archive would need to be unpacked here.
-    # A path in /tmp to be part of system tmp cleanup schedule.
-    toolchain_roots = {"": "/tmp/llvm-16"},
+    toolchain_roots = {"": "/opt/llvm-16"},
 )
 
 ## Toolchain example with a sysroot.
@@ -156,9 +155,8 @@ http_archive(
 
 http_archive(
     name = "com_google_absl",
-    sha256 = "91ac87d30cc6d79f9ab974c51874a704de9c2647c40f6932597329a282217ba8",
-    strip_prefix = "abseil-cpp-20220623.1",
-    urls = ["https://github.com/abseil/abseil-cpp/archive/refs/tags/20220623.1.tar.gz"],
+    strip_prefix = "abseil-cpp-b2dd3a5be797f8194bbc230c65f35aadd3998535",
+    urls = ["https://github.com/abseil/abseil-cpp/archive/b2dd3a5be797f8194bbc230c65f35aadd3998535.tar.gz"],
 )
 
 http_archive(
@@ -171,13 +169,13 @@ http_archive(
 
 # For testing rules_go.
 
+# Temporary override until newer version is released to the central registry.
+# https://github.com/bazelbuild/rules_go/commit/31549c1f0fbe850aee3d2b7dd7a1303952f7cd75
 http_archive(
     name = "io_bazel_rules_go",
-    sha256 = "278b7ff5a826f3dc10f04feaf0b70d48b68748ccd512d7f98bf442077f043fe3",
-    urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.41.0/rules_go-v0.41.0.zip",
-        "https://github.com/bazelbuild/rules_go/releases/download/v0.41.0/rules_go-v0.41.0.zip",
-    ],
+    integrity = "sha256-8cixNZS5cm7qapSierAHoRQh8fA9dKMyFD5PBRvFgOY=",
+    strip_prefix = "rules_go-31549c1f0fbe850aee3d2b7dd7a1303952f7cd75",
+    urls = ["https://github.com/bazelbuild/rules_go/archive/31549c1f0fbe850aee3d2b7dd7a1303952f7cd75.tar.gz"],
 )
 
 load("@io_bazel_rules_go//go:deps.bzl", "go_download_sdk", "go_rules_dependencies")

tests/openssl/openssl.bazel

@@ -864,6 +864,7 @@ cc_library(
 cc_library(
     name = "libssl",
     srcs = [
+        "e_os.h",
         "ssl/bio_ssl.c",
         "ssl/d1_lib.c",
         "ssl/d1_msg.c",

tests/patches/abseil-cpp.patch

@@ -1,12 +1,12 @@
 --- MODULE.bazel
 +++ MODULE.bazel
-@@ -0,0 +1,9 @@
-+module(
-+    name = "abseil-cpp",
-+    version = "20230125.1",
-+    compatibility_level = 1,
-+)
-+bazel_dep(name = "rules_cc", version = "0.0.8")
-+bazel_dep(name = "platforms", version = "0.0.6")
-+bazel_dep(name = "bazel_skylib", version = "1.4.2")
-+bazel_dep(name = "googletest", version = "1.12.1", repo_name = "com_google_googletest")
+@@ -28,8 +28,7 @@ bazel_dep(name = "bazel_skylib",
+
+ bazel_dep(name = "google_benchmark",
+           version = "1.8.3",
+-          repo_name = "com_github_google_benchmark",
+-          dev_dependency = True)
++          repo_name = "com_github_google_benchmark")
+
+ bazel_dep(name = "googletest",
+           version = "1.14.0.bcr.1",

tests/scripts/run_external_tests.sh

@@ -24,14 +24,18 @@ cd "${scripts_dir}"
 # Generate some files needed for the tests.
 "${bazel}" query "${common_args[@]}" @io_bazel_rules_go//tests/core/cgo:dylib_test >/dev/null
 if [[ ${USE_BZLMOD} == "true" ]]; then
-  "$("${bazel}" info output_base)/external/rules_go~0.41.0/tests/core/cgo/generate_imported_dylib.sh"
+  "$("${bazel}" info output_base)/external/rules_go~override/tests/core/cgo/generate_imported_dylib.sh"
 else
   "$("${bazel}" info output_base)/external/io_bazel_rules_go/tests/core/cgo/generate_imported_dylib.sh"
 fi
 
 test_args=(
   "${common_test_args[@]}"
   "--copt=-Wno-deprecated-builtins" # https://github.com/abseil/abseil-cpp/issues/1201
+  # Disable the "hermetic sandbox /tmp" behavior of Bazel 7 as it results in broken symlinks when
+  # rules_foreign_cc builds pcre.
+  # TODO: Remove this once rules_foreign_cc is fully compatible with Bazel 7.
+  "--sandbox_add_mount_pair=/tmp"
 )
 
 # We exclude the following targets:

toolchain/BUILD.toolchain.tpl

@@ -16,6 +16,7 @@ package(default_visibility = ["//visibility:public"])
 
 load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
 load("@rules_cc//cc:defs.bzl", "cc_toolchain", "cc_toolchain_suite")
+load("@toolchains_llvm//toolchain/internal:system_module_map.bzl", "system_module_map")
 load("%{cc_toolchain_config_bzl}", "cc_toolchain_config")
 
 # Following filegroup targets are used when not using absolute paths and shared

toolchain/cc_toolchain_config.bzl

@@ -36,24 +36,23 @@ def cc_toolchain_config(
         host_os,
         target_arch,
         target_os,
+        target_system_name,
         toolchain_path_prefix,
         tools_path_prefix,
         wrapper_bin_prefix,
         compiler_configuration,
-        llvm_version,
+        cxx_builtin_include_directories,
         host_tools_info = {}):
     host_os_arch_key = _os_arch_pair(host_os, host_arch)
     target_os_arch_key = _os_arch_pair(target_os, target_arch)
     _check_os_arch_keys([host_os_arch_key, target_os_arch_key])
-    major_llvm_version = int(llvm_version.split(".")[0])
 
     # A bunch of variables that get passed straight through to
     # `create_cc_toolchain_config_info`.
     # TODO: What do these values mean, and are they actually all correct?
     host_system_name = host_arch
     (
         toolchain_identifier,
-        target_system_name,
         target_cpu,
         target_libc,
         compiler,
@@ -62,7 +61,6 @@ def cc_toolchain_config(
     ) = {
         "darwin-x86_64": (
             "clang-x86_64-darwin",
-            "x86_64-apple-macosx",
             "darwin",
             "macosx",
             "clang",
@@ -71,7 +69,6 @@ def cc_toolchain_config(
         ),
         "darwin-aarch64": (
             "clang-aarch64-darwin",
-            "aarch64-apple-macosx",
             "darwin",
             "macosx",
             "clang",
@@ -80,7 +77,6 @@ def cc_toolchain_config(
         ),
         "linux-aarch64": (
             "clang-aarch64-linux",
-            "aarch64-unknown-linux-gnu",
             "aarch64",
             "glibc_unknown",
             "clang",
@@ -89,7 +85,6 @@ def cc_toolchain_config(
         ),
         "linux-x86_64": (
             "clang-x86_64-linux",
-            "x86_64-unknown-linux-gnu",
             "k8",
             "glibc_unknown",
             "clang",
@@ -175,6 +170,7 @@ def cc_toolchain_config(
     # always link C++ libraries.
     cxx_standard = compiler_configuration["cxx_standard"]
     stdlib = compiler_configuration["stdlib"]
+    sysroot_path = compiler_configuration["sysroot_path"]
     if stdlib == "builtin-libc++" and is_xcompile:
         stdlib = "stdc++"
     if stdlib == "builtin-libc++":
@@ -207,7 +203,7 @@ def cc_toolchain_config(
             # have the sysroot directory on the search path and then add the
             # toolchain directory back after we are done.
             link_flags.extend([
-                "-L{}/usr/lib".format(compiler_configuration["sysroot_path"]),
+                "-L{}/usr/lib".format(sysroot_path),
                 "-lc++",
                 "-lc++abi",
             ])
@@ -261,40 +257,6 @@ def cc_toolchain_config(
     ## NOTE: framework paths is missing here; unix_cc_toolchain_config
     ## doesn't seem to have a feature for this.
 
-    # C++ built-in include directories:
-    cxx_builtin_include_directories = []
-    if toolchain_path_prefix.startswith("/"):
-        cxx_builtin_include_directories.extend([
-            toolchain_path_prefix + "include/c++/v1",
-            toolchain_path_prefix + "include/{}/c++/v1".format(target_system_name),
-            toolchain_path_prefix + "lib/clang/{}/include".format(llvm_version),
-            toolchain_path_prefix + "lib/clang/{}/share".format(llvm_version),
-            toolchain_path_prefix + "lib64/clang/{}/include".format(llvm_version),
-            toolchain_path_prefix + "lib/clang/{}/include".format(major_llvm_version),
-            toolchain_path_prefix + "lib/clang/{}/share".format(major_llvm_version),
-            toolchain_path_prefix + "lib64/clang/{}/include".format(major_llvm_version),
-        ])
-
-    sysroot_path = compiler_configuration["sysroot_path"]
-    sysroot_prefix = ""
-    if sysroot_path:
-        sysroot_prefix = "%sysroot%"
-    if target_os == "linux":
-        cxx_builtin_include_directories.extend([
-            sysroot_prefix + "/include",
-            sysroot_prefix + "/usr/include",
-            sysroot_prefix + "/usr/local/include",
-        ])
-    elif target_os == "darwin":
-        cxx_builtin_include_directories.extend([
-            sysroot_prefix + "/usr/include",
-            sysroot_prefix + "/System/Library/Frameworks",
-        ])
-    else:
-        fail("Unreachable")
-
-    cxx_builtin_include_directories.extend(compiler_configuration["additional_include_dirs"])
-
     ## NOTE: make variables are missing here; unix_cc_toolchain_config doesn't
     ## pass these to `create_cc_toolchain_config_info`.
 

toolchain/internal/BUILD.bazel

@@ -11,3 +11,5 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
+exports_files(["generate_system_module_map.sh"])