envoy: 1.31.2 -> 1.32.0 (#349028)

pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch

@@ -1,7 +1,7 @@
-From 07af89ac82e0c5876590f89284795bffa4b0e1c8 Mon Sep 17 00:00:00 2001
+From 47406ebaf0260e5b66a92baac3717936c8386b69 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:52:59 +0200
-Subject: [PATCH 1/3] nixpkgs: use system Python
+Subject: [PATCH] nixpkgs: use system Python
 
 Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 ---
@@ -10,13 +10,13 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  2 files changed, 5 insertions(+), 23 deletions(-)
 
 diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
-index b015e851c0..53a2c93c59 100644
+index 9f2b336b1a..53a2c93c59 100644
 --- a/bazel/python_dependencies.bzl
 +++ b/bazel/python_dependencies.bzl
 @@ -1,28 +1,25 @@
  load("@com_google_protobuf//bazel:system_python.bzl", "system_python")
 -load("@envoy_toolshed//:packages.bzl", "load_packages")
--load("@python3_11//:defs.bzl", "interpreter")
+-load("@python3_12//:defs.bzl", "interpreter")
  load("@rules_python//python:pip.bzl", "pip_parse")
  
  def envoy_python_dependencies():
@@ -47,13 +47,13 @@ index b015e851c0..53a2c93c59 100644
          extra_pip_args = ["--require-hashes"],
      )
 diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
-index 7fd1dc4095..001de36a16 100644
+index b92dd461ba..cef32b3140 100644
 --- a/bazel/repositories_extra.bzl
 +++ b/bazel/repositories_extra.bzl
 @@ -2,19 +2,11 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
- load("@com_github_rules_proto_grpc//:repositories.bzl", "rules_proto_grpc_toolchains")
+ load("@bazel_features//:deps.bzl", "bazel_features_deps")
  load("@emsdk//:deps.bzl", emsdk_deps = "deps")
- load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime:crates.bzl", "wasmtime_fetch_remote_crates")
+ load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime/remote:crates.bzl", "crate_repositories")
 -load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
 +load("@rules_python//python:repositories.bzl", "py_repositories")
  load("//bazel/external/cargo:crates.bzl", "raze_fetch_remote_crates")
@@ -62,17 +62,17 @@ index 7fd1dc4095..001de36a16 100644
 -    return "_".join(python_version.split(".")[:-1])
 -
 -# Python version for `rules_python`
--PYTHON_VERSION = "3.11.9"
+-PYTHON_VERSION = "3.12.3"
 -PYTHON_MINOR_VERSION = _python_minor_version(PYTHON_VERSION)
 -
  # Envoy deps that rely on a first stage of dependency loading in envoy_dependencies().
  def envoy_dependencies_extra(
 -        python_version = PYTHON_VERSION,
          ignore_root_user_error = False):
+     bazel_features_deps()
      emsdk_deps()
-     raze_fetch_remote_crates()
 @@ -22,11 +14,4 @@ def envoy_dependencies_extra(
-     rules_proto_grpc_toolchains()
+     crate_repositories()
      py_repositories()
  
 -    # Registers underscored Python minor version - eg `python3_10`
@@ -83,6 +83,3 @@ index 7fd1dc4095..001de36a16 100644
 -    )
 -
      aspect_bazel_lib_dependencies()
--- 
-2.45.1
-

pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch

@@ -1,41 +1,23 @@
-From 06b51e6a0c14e5ad7cfc1dc801561e6e6e1b2014 Mon Sep 17 00:00:00 2001
+From 4be181e96199529a36e9a93c837af7173c827493 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:58:00 +0200
-Subject: [PATCH 2/3] nixpkgs: use system Go
+Subject: [PATCH] nixpkgs: use system Go
 
 Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 ---
  bazel/dependency_imports.bzl | 2 +-
- bazel/repositories.bzl       | 3 ---
- 2 files changed, 1 insertion(+), 4 deletions(-)
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index 1bf6c54a25..4e55a129e4 100644
+index c68eb4bf3e..addee4f6af 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -18,7 +18,7 @@ load("@rules_rust//rust:defs.bzl", "rust_common")
+@@ -20,7 +20,7 @@ load("@rules_rust//rust:defs.bzl", "rust_common")
  load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_register_toolchains", "rust_repository_set")
  
  # go version for rules_go
--GO_VERSION = "1.20"
+-GO_VERSION = "1.23.1"
 +GO_VERSION = "host"
  
  JQ_VERSION = "1.7"
  YQ_VERSION = "4.24.4"
-diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index 02f7abd725..aad9adac24 100644
---- a/bazel/repositories.bzl
-+++ b/bazel/repositories.bzl
-@@ -246,9 +246,6 @@ def _go_deps(skip_targets):
-     if "io_bazel_rules_go" not in skip_targets:
-         external_http_archive(
-             name = "io_bazel_rules_go",
--            # TODO(wrowe, sunjayBhatia): remove when Windows RBE supports batch file invocation
--            patch_args = ["-p1"],
--            patches = ["@envoy//bazel:rules_go.patch"],
-         )
-         external_http_archive("bazel_gazelle")
- 
--- 
-2.45.1
-

pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch

@@ -1,7 +1,7 @@
-From 1213bbf5583c6615f719e0acf5f568e08bca5b35 Mon Sep 17 00:00:00 2001
+From 3ecb08a7603a07310d1a38c0f47bc54bbe1f11c8 Mon Sep 17 00:00:00 2001
 From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 Date: Mon, 22 Apr 2024 11:59:22 +0200
-Subject: [PATCH 3/3] nixpkgs: use system C/C++ toolchains
+Subject: [PATCH] nixpkgs: use system C/C++ toolchains
 
 Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
 ---
@@ -9,10 +9,10 @@ Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index 4e55a129e4..6c2a5f0d82 100644
+index addee4f6af..dc1967e43b 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -24,7 +24,11 @@ JQ_VERSION = "1.7"
+@@ -26,7 +26,11 @@ JQ_VERSION = "1.7"
  YQ_VERSION = "4.24.4"
  
  def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, yq_version = YQ_VERSION):
@@ -25,6 +25,3 @@ index 4e55a129e4..6c2a5f0d82 100644
      go_rules_dependencies()
      go_register_toolchains(go_version)
      if go_version != "host":
--- 
-2.45.1
-

pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel

@@ -0,0 +1,54 @@
+load("@bazel_tools//tools/sh:sh_toolchain.bzl", "sh_toolchain")
+load("@rules_rust//rust:toolchain.bzl", "rust_toolchain")
+
+toolchains = {
+    "x86_64": "x86_64-unknown-linux-gnu",
+    "aarch64": "aarch64-unknown-linux-gnu",
+}
+
+exports_files(["cargo", "rustdoc", "ruststd", "rustc"])
+
+[
+    rust_toolchain(
+        name = "rust_nix_" + k + "_impl",
+        binary_ext = "",
+        dylib_ext = ".so",
+        exec_triple = v,
+        cargo = ":cargo",
+        rust_doc = ":rustdoc",
+        rust_std = ":ruststd",
+        rustc = ":rustc",
+        stdlib_linkflags = ["-ldl", "-lpthread"],
+        staticlib_ext = ".a",
+        target_triple = v,
+    )
+    for k, v in toolchains.items()
+]
+
+[
+    toolchain(
+        name = "rust_nix_" + k,
+        exec_compatible_with = [
+            "@platforms//cpu:" + k,
+            "@platforms//os:linux",
+        ],
+        target_compatible_with = [
+            "@platforms//cpu:" + k,
+            "@platforms//os:linux",
+        ],
+        toolchain = ":rust_nix_" + k + "_impl",
+        toolchain_type = "@rules_rust//rust:toolchain_type",
+    )
+    for k in toolchains.keys()
+]
+
+sh_toolchain(
+    name = "local_sh_impl",
+    path = "@bash@",
+)
+
+toolchain(
+    name = "local_sh",
+    toolchain = ":local_sh_impl",
+    toolchain_type = "@bazel_tools//tools/sh:toolchain_type",
+)

pkgs/by-name/en/envoy/package.nix

@@ -5,6 +5,10 @@
   buildBazelPackage,
   fetchFromGitHub,
   stdenv,
+  cacert,
+  cargo,
+  rustc,
+  rustPlatform,
   cmake,
   gn,
   go,
@@ -25,20 +29,20 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.31.2";
-    rev = "cc4a75482810de4b84c301d13deb551bd3147339";
-    hash = "sha256-mfQpEGLMJV3UKqcUdbhy6/pP1sWut26zjwN6vDE7LmA=";
+    version = "1.32.0";
+    rev = "86dc7ef91ca15fb4957a74bd599397413fc26a24";
+    hash = "sha256-Wcbt62RfaNcTntmPjaAM0cP3LJangm4ht7Q0bzEpu5A=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-9KXZdSvRfi5mWOSotG//+ljsx64I4bYwzbeQFuCIwDE=";
-      aarch64-linux = "sha256-knrCfUYUL+bYuHSNrNeX3SwoGDf2rLYNXuukEmj4BjA=";
+      x86_64-linux = "sha256-LkDNPFT7UUCsGPG1dMnwzdIw0lzc5+3JYDoblF5oZVk=";
+      aarch64-linux = "sha256-DkibjmY1YND9Q2aQ41bhNdch0SKM5ghY2mjYSQfV30M=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 in
-buildBazelPackage {
+buildBazelPackage rec {
   pname = "envoy";
   inherit (srcVer) version;
   bazel = bazel_6;
@@ -58,6 +62,22 @@ buildBazelPackage {
     sed -i 's,#!/usr/bin/env python3,#!${python3}/bin/python,' bazel/foreign_cc/luajit.patch
     sed -i '/javabase=/d' .bazelrc
     sed -i '/"-Werror"/d' bazel/envoy_internal.bzl
+
+    mkdir -p bazel/nix/
+    substitute ${./bazel_nix.BUILD.bazel} bazel/nix/BUILD.bazel \
+      --subst-var-by bash "$(type -p bash)"
+    ln -sf "${cargo}/bin/cargo" bazel/nix/cargo
+    ln -sf "${rustc}/bin/rustc" bazel/nix/rustc
+    ln -sf "${rustc}/bin/rustdoc" bazel/nix/rustdoc
+    ln -sf "${rustPlatform.rustLibSrc}" bazel/nix/ruststd
+    substituteInPlace bazel/dependency_imports.bzl \
+      --replace-fail 'crate_universe_dependencies()' 'crate_universe_dependencies(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc")' \
+      --replace-fail 'crates_repository(' 'crates_repository(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc",'
+
+    substitute ${./rules_rust_extra.patch} bazel/nix/rules_rust_extra.patch \
+      --subst-var-by bash "$(type -p bash)"
+    cat bazel/nix/rules_rust_extra.patch bazel/rules_rust.patch > bazel/nix/rules_rust.patch
+    mv bazel/nix/rules_rust.patch bazel/rules_rust.patch
   '';
 
   patches = [
@@ -79,14 +99,23 @@ buildBazelPackage {
     jdk
     ninja
     patchelf
+    cacert
   ];
 
   buildInputs = [ linuxHeaders ];
 
   fetchAttrs = {
     sha256 = depsHash;
+    env.CARGO_BAZEL_REPIN = true;
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
+    postPatch = ''
+      ${postPatch}
+
+      substituteInPlace bazel/dependency_imports.bzl \
+        --replace-fail 'crate_universe_dependencies(' 'crate_universe_dependencies(bootstrap=True, ' \
+        --replace-fail 'crates_repository(' 'crates_repository(generator="@@cargo_bazel_bootstrap//:cargo-bazel", '
+    '';
     preInstall = ''
       # Strip out the path to the build location (by deleting the comment line).
       find $bazelOut/external -name requirements.bzl | while read requirements; do
@@ -113,6 +142,12 @@ buildBazelPackage {
 
       # fix tcmalloc failure https://github.com/envoyproxy/envoy/issues/30838
       sed -i '/TCMALLOC_GCC_FLAGS = \[/a"-Wno-changes-meaning",' $bazelOut/external/com_github_google_tcmalloc/tcmalloc/copts.bzl
+
+      # Install repinned rules_rust lockfile
+      cp source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock $bazelOut/external/Cargo.Bazel.lock
+
+      # Don't save cargo_bazel_bootstrap or the crate index cache
+      rm -rf $bazelOut/external/cargo_bazel_bootstrap $bazelOut/external/dynamic_modules_rust_sdk_crate_index/.cargo_home $bazelOut/external/dynamic_modules_rust_sdk_crate_index/splicing-output
     '';
   };
   buildAttrs = {
@@ -125,7 +160,7 @@ buildBazelPackage {
         file "$execbin" | grep -q ': ELF .*, dynamically linked,' || continue
         patchelf \
           --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
-          "$execbin"
+          "$execbin" || echo "$execbin"
       done
 
       ln -s ${bazel-gazelle}/bin $bazelOut/external/bazel_gazelle_go_repository_tools/bin
@@ -139,6 +174,9 @@ buildBazelPackage {
         $bazelOut/external/com_github_luajit_luajit/build.py \
         $bazelOut/external/local_config_sh/BUILD \
         $bazelOut/external/*_pip3/BUILD.bazel
+
+      # Install repinned rules_rust lockfile
+      cp $bazelOut/external/Cargo.Bazel.lock source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
     '';
     installPhase = ''
       install -Dm0755 bazel-bin/source/exe/envoy-static $out/bin/envoy
@@ -162,6 +200,9 @@ buildBazelPackage {
       "--java_runtime_version=local_jdk"
       "--tool_java_runtime_version=local_jdk"
 
+      # Force use of system Rust.
+      "--extra_toolchains=//bazel/nix:rust_nix_aarch64,//bazel/nix:rust_nix_x86_64"
+
       # undefined reference to 'grpc_core::*Metadata*::*Memento*
       #
       # During linking of the final binary, we see undefined references to grpc_core related symbols.
@@ -182,6 +223,9 @@ buildBazelPackage {
   bazelFetchFlags = [
     "--define=wasm=${wasmRuntime}"
 
+    # Force use of system Rust.
+    "--extra_toolchains=//bazel/nix:rust_nix_aarch64,//bazel/nix:rust_nix_x86_64"
+
     # https://github.com/bazelbuild/rules_go/issues/3844
     "--repo_env=GOPROXY=https://proxy.golang.org,direct"
     "--repo_env=GOSUMDB=sum.golang.org"

pkgs/by-name/en/envoy/rules_rust_extra.patch

@@ -0,0 +1,18 @@
+--- crate_universe/src/metadata/cargo_tree_rustc_wrapper.sh
++++ crate_universe/src/metadata/cargo_tree_rustc_wrapper.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
++#!@bash@
+ #
+ # For details, see:
+ # `@rules_rust//crate_universe/src/metadata/cargo_tree_resolver.rs - TreeResolver::create_rustc_wrapper`
+
+--- util/process_wrapper/private/process_wrapper.sh
++++ util/process_wrapper/private/process_wrapper.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
++#!@bash@
+ 
+ set -euo pipefail
+ 
+

pkgs/top-level/all-packages.nix

@@ -24181,7 +24181,6 @@ with pkgs;
 
   envoy = callPackage ../by-name/en/envoy/package.nix {
     jdk = openjdk11_headless;
-    gn = gn1924;
   };
 
   ergochat = callPackage ../servers/irc/ergochat { };