Skip to content

Build Linux releases with a hermetic toolchain #27312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

Build Linux releases with a hermetic toolchain #27312

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
20b07df
Build Bazel's releases with a hermetic toolchain and sysroot
fmeum Oct 17, 2025
7d368b5
Fix flags
fmeum Oct 17, 2025
6c21211
Use LLVM 17
fmeum Oct 17, 2025
2d2f462
TMP: Use host libz
fmeum Oct 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 9 additions & 18 deletions .bazelci/build_bazel_binaries.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,29 +5,25 @@ platforms:
- "//src:bazel"
- "//src:bazel_nojdk"
build_flags:
- "-c"
- "opt"
- "--config=release-linux"
rockylinux8_arm64:
build_targets:
- "//src:bazel"
- "//src:bazel_nojdk"
build_flags:
- "-c"
- "opt"
- "--config=release-linux"
ubuntu2004:
build_targets:
- "//src:bazel"
- "//src:bazel_nojdk"
build_flags:
- "-c"
- "opt"
- "--config=release-linux"
ubuntu2004_arm64:
build_targets:
- "//src:bazel"
- "//src:bazel_nojdk"
build_flags:
- "-c"
- "opt"
- "--config=release-linux"
# https://github.com/bazelbuild/continuous-integration/issues/2353
- "--linkopt=-Wl,--no-fix-cortex-a53-843419"
- "--host_linkopt=-Wl,--no-fix-cortex-a53-843419"
Expand All @@ -36,37 +32,32 @@ platforms:
- "//src:bazel"
- "//src:bazel_nojdk"
build_flags:
- "-c"
- "opt"
- "--config=release-linux"
macos:
build_targets:
- "//src:bazel"
- "//src:bazel_nojdk"
build_flags:
- "-c"
- "opt"
- "--config=release"
macos_arm64:
build_targets:
- "//src:bazel"
- "//src:bazel_nojdk"
build_flags:
- "-c"
- "opt"
- "--config=release"
windows:
build_flags:
- "--copt=-w"
- "--host_copt=-w"
- "-c"
- "opt"
- "--config=release"
build_targets:
- "//src:bazel.exe"
- "//src:bazel_nojdk.exe"
windows_arm64:
build_flags:
- "--copt=-w"
- "--host_copt=-w"
- "-c"
- "opt"
- "--config=release"
- "--config=windows_arm64"
build_targets:
- "//src:bazel.exe"
Expand Down
10 changes: 10 additions & 0 deletions .bazelrc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,16 @@ try-import %workspace%/user.bazelrc

common:docs --workspace_status_command=scripts/docs/get_workspace_status.sh

# Flags for release builds
common:release --compilation_mode opt
common:release-linux --config=release
common:release-linux --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux
common:release-linux --extra_toolchains=@llvm_toolchain//:cc-toolchain-aarch64-linux
common:release-linux --features=thin_lto

# TMP
common:linux --config=release-linux

# Flags for CI builds
## Common
common:ci-common --lockfile_mode=error
Expand Down
57 changes: 52 additions & 5 deletions MODULE.bazel
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ bazel_dep(name = "rules_python", version = "1.4.1")
bazel_dep(name = "rules_shell", version = "0.6.1")
bazel_dep(name = "rules_testing", version = "0.6.0")
bazel_dep(name = "stardoc", version = "0.7.2", repo_name = "io_bazel_skydoc")
bazel_dep(name = "toolchains_llvm", version = "1.5.0")
bazel_dep(name = "with_cfg.bzl", version = "0.10.3")
bazel_dep(name = "zlib", version = "1.3.1.bcr.5")
bazel_dep(name = "zstd-jni", version = "1.5.6-9")
Expand Down Expand Up @@ -157,9 +158,9 @@ maven.install(
# keep sorted
"args4j:args4j:2.37",
"com.beust:jcommander:1.82",
"com.dylibso.chicory:log:1.5.2",
"com.dylibso.chicory:runtime:1.5.2",
"com.dylibso.chicory:wasm:1.5.2",
"com.dylibso.chicory:log:1.5.2",
"com.github.ben-manes.caffeine:caffeine:3.1.8",
"com.github.stephenc.jcip:jcip-annotations:1.0-1",
"com.google.api-client:google-api-client:1.35.2",
Expand Down Expand Up @@ -345,6 +346,56 @@ pip.parse(
)
use_repo(pip, "bazel_pip_dev_deps")

# =========================================
# C++ dependencies
# =========================================

# Required only by `--extra_toolchains=@local_config_cc//:cc-toolchain-arm64_windows` from .bazelrc
cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension")
use_repo(cc_configure, "local_config_cc")

http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

SYSROOT_BUILD_FILE = """
filegroup(
name = "sysroot",
srcs = glob(["*/**"]),
visibility = ["//visibility:public"],
)
"""

http_archive(
name = "chromium_sysroot_linux_x64",
build_file_content = SYSROOT_BUILD_FILE,
sha256 = "84656a6df544ecef62169cfe3ab6e41bb4346a62d3ba2a045dc5a0a2ecea94a3",
urls = [
"https://commondatastorage.googleapis.com/chrome-linux-sysroot/toolchain/2202c161310ffde63729f29d27fe7bb24a0bc540/debian_stretch_amd64_sysroot.tar.xz",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May want to consider to run something like https://github.com/DavidZbarsky-at/sysroot-min/blob/master/build.sh instead of using the sysroot directly, that removed 80-90% of files and made the sandbox overhead way less painful

],
)

http_archive(
name = "chromium_sysroot_linux_aarch64",
build_file_content = SYSROOT_BUILD_FILE,
sha256 = "e39b700d8858d18868544c8c84922f6adfa8419f3f42471b92024ba38eff7aca",
urls = [
"https://commondatastorage.googleapis.com/chrome-linux-sysroot/toolchain/2202c161310ffde63729f29d27fe7bb24a0bc540/debian_stretch_arm64_sysroot.tar.xz",
],
)

llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm")

# Use a version that still runs on Rocky Linux 8.
llvm.toolchain(llvm_version = "17.0.6")
llvm.sysroot(
label = "@chromium_sysroot_linux_x64//:sysroot",
targets = ["linux-x86_64"],
)
llvm.sysroot(
label = "@chromium_sysroot_linux_aarch64//:sysroot",
targets = ["linux-aarch64"],
)
use_repo(llvm, "llvm_toolchain")

# =========================================
# Other Bazel build dependencies
# =========================================
Expand All @@ -371,10 +422,6 @@ use_repo(
"openjdk_win_vanilla",
)

# Required only by `--extra_toolchains=@local_config_cc//:cc-toolchain-arm64_windows` from .bazelrc
cc_configure = use_extension("@rules_cc//cc:extensions.bzl", "cc_configure_extension")
use_repo(cc_configure, "local_config_cc")

http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")

# DO NOT UPDATE the jq versions, they are used to verify compatibility with old and new versions.
Expand Down
95 changes: 95 additions & 0 deletions MODULE.bazel.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 1 addition & 2 deletions scripts/kokoro/release/build_linux.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ mkdir output
cp bazel-bin/src/bazel output/bazel

output/bazel build \
-c opt \
--config=release-linux \
--stamp \
--sandbox_tmpfs_path=/tmp \
--embed_label "${RELEASE_NAME}" \
Expand All @@ -59,4 +59,3 @@ if [ $ARCHITECTURE = "x86_64" ]; then
cp "bazel-bin/scripts/packages/debian/bazel.tar.gz" "artifacts/bazel_${RELEASE_NAME}.tar.gz"
cp "bazel-bin/bazel-distfile.zip" "artifacts/bazel-${RELEASE_NAME}-dist.zip"
fi

2 changes: 1 addition & 1 deletion scripts/kokoro/release/build_macos.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ cp bazel-bin/src/bazel output/bazel

output/bazel build \
--define IPHONE_SDK=1 \
-c opt \
--config=release \
--stamp \
--embed_label "${RELEASE_NAME}" \
--workspace_status_command=scripts/ci/build_status_command.sh \
Expand Down
2 changes: 1 addition & 1 deletion scripts/kokoro/release/build_windows.bat
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ set PATH=C:\python37;%PATH%
mkdir output
copy bazel-bin\src\bazel.exe output\bazel.exe

output\bazel build -c opt --copt=-w --host_copt=-w --stamp --embed_label %RELEASE_NAME% src/bazel scripts/packages/bazel.zip
output\bazel build --config=release --copt=-w --host_copt=-w --stamp --embed_label %RELEASE_NAME% src/bazel scripts/packages/bazel.zip

mkdir artifacts
move bazel-bin\src\bazel artifacts\bazel-%RELEASE_NAME%-windows-x86_64.exe
Expand Down
2 changes: 0 additions & 2 deletions src/java_tools/buildjar/java/com/google/devtools/build/java/turbine/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,8 +122,6 @@ native_image(
":do_use_oracle_graalvm": ["profile.iprof"],
"//conditions:default": [],
}),
# This provides libz.a on Linux instead of the host system.
static_zlib = "@zlib",
deps = [":turbine_deps"],
)

Expand Down
6 changes: 5 additions & 1 deletion src/upload_all_java_tools.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,11 @@ commit_hash=$(git rev-parse HEAD)
timestamp=$(date +%s)
bazel_version=$(bazel info release | cut -d' ' -f2)

RELEASE_BUILD_OPTS="-c opt"
if [[ "$platform" == "linux" ]]; then
RELEASE_BUILD_OPTS="--config=release-linux"
else
RELEASE_BUILD_OPTS="--config=release"
fi

# Check that the build machine is set up for Unicode.
bazel run ${RELEASE_BUILD_OPTS} //src:CheckSunJnuEncoding
Expand Down