From 1840e7deadd9e70cf2c9215ad80fce52e8c83362 Mon Sep 17 00:00:00 2001 From: Dmitriy Kovalenko Date: Fri, 6 Nov 2026 01:09:47 +0000 Subject: [PATCH] Enable safe identical code folding for x86-64 musl releases (#59780) ## What changed Enable `--addrsig` and `--icf=safe` for `x86_64-unknown-linux-musl` release packages in Cargo and Bazel. Opt Cargo release builds into these flags with `CODEX_MUSL_RELEASE_LINK_FLAGS=1`, selecting `lld` and preserving existing `RUSTFLAGS`. Apply the corresponding flags in Bazel's release package transition for the x86-64 musl platform. GitOrigin-RevId: ade3c619dad2f03fd93a6fec35477607caec8b31 --- .../actions/build-cargo-package-binaries/action.yml | 1 + .github/scripts/install-musl-build-tools.sh | 6 ++++++ .github/workflows/rust-release.yml | 1 + bazel/rules/runtime_package.bzl | 11 +++++++++++ 4 files changed, 19 insertions(+) diff --git a/.github/actions/build-cargo-package-binaries/action.yml b/.github/actions/build-cargo-package-binaries/action.yml index 84a35f5ec2..7ddab0bd50 100644 --- a/.github/actions/build-cargo-package-binaries/action.yml +++ b/.github/actions/build-cargo-package-binaries/action.yml @@ -68,6 +68,7 @@ runs: working-directory: codex-rs env: TARGET: ${{ inputs.target }} + CODEX_MUSL_RELEASE_LINK_FLAGS: "1" run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh" - name: Disable aws-lc jitter entropy (musl) diff --git a/.github/scripts/install-musl-build-tools.sh b/.github/scripts/install-musl-build-tools.sh index 4853d0654c..89a69df221 100644 --- a/.github/scripts/install-musl-build-tools.sh +++ b/.github/scripts/install-musl-build-tools.sh @@ -261,6 +261,12 @@ target_cxx_var="CXX_${TARGET}" target_cxx_var="${target_cxx_var//-/_}" echo "${target_cxx_var}=${cxx}" >> "$GITHUB_ENV" +# Enable safe identical code folding for release packages on x86-64 musl. +if [[ "${TARGET}" == "x86_64-unknown-linux-musl" && "${CODEX_MUSL_RELEASE_LINK_FLAGS:-}" == "1" ]]; then + link_flags=(-Cllvm-args=--addrsig -Clink-arg=-fuse-ld=lld -Clink-arg=-Wl,--icf=safe) + echo "RUSTFLAGS=${RUSTFLAGS:+$RUSTFLAGS }${link_flags[*]}" >> "$GITHUB_ENV" +fi + cargo_linker_var="CARGO_TARGET_${TARGET^^}_LINKER" cargo_linker_var="${cargo_linker_var//-/_}" echo "${cargo_linker_var}=${musl_linker}" >> "$GITHUB_ENV" diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml index 9878d3cdda..b72a8cf498 100644 --- a/.github/workflows/rust-release.yml +++ b/.github/workflows/rust-release.yml @@ -208,6 +208,7 @@ jobs: name: Install musl build tools env: TARGET: ${{ matrix.target }} + CODEX_MUSL_RELEASE_LINK_FLAGS: "1" run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh" - if: ${{ matrix.build-system == 'cargo' && contains(matrix.target, 'linux') }} diff --git a/bazel/rules/runtime_package.bzl b/bazel/rules/runtime_package.bzl index b0d9919c19..6ab0e57bec 100644 --- a/bazel/rules/runtime_package.bzl +++ b/bazel/rules/runtime_package.bzl @@ -67,6 +67,12 @@ def _release_profile_impl(settings, attr): "@local_config_cc//:cc-toolchain-x64_windows", "@local_config_cc//:cc-toolchain-arm64_windows", ] + if attr.linux_x86_64_musl: + # Match the Cargo release linker for x86-64 static PIEs. + profile[_RUSTC_FLAGS] += [ + "-Cllvm-args=--addrsig", + "-Clink-arg=-Wl,--icf=safe", + ] return profile _release_profile = transition( @@ -132,6 +138,7 @@ _runtime_binary_files = rule( attrs = { "binary": attr.label(mandatory = True, executable = True, cfg = _release_profile), "platform_os": attr.string(), + "linux_x86_64_musl": attr.bool(), "macos_minimum_os": attr.string(), "_allowlist_function_transition": attr.label( default = "@bazel_tools//tools/allowlists/function_transition_allowlist", @@ -159,6 +166,10 @@ def release_binary(binary, name = "release", macos_x86_64_minimum_os = "10.12", _runtime_binary_files( name = name + "_files", binary = binary, + linux_x86_64_musl = select({ + "@llvm//platforms/config:linux_x86_64_musl": True, + "//conditions:default": False, + }), platform_os = select({ "@platforms//os:macos": "macos", "@platforms//os:linux": "linux",