From 92912d6d84e567f8fc921c0b7c429abff182b004 Mon Sep 17 00:00:00 2001 From: Sean Huang Date: Mon, 10 Aug 2026 22:52:57 +0000 Subject: [PATCH] Add hermetic Windows SDK and MSVC runtime repositories (#37896) ## What changed - Add pinned `windows_support` repositories for the Windows SDK and MSVC runtime on `x64` and `arm64`. - Require explicit acceptance through `--repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1` before materializing the MSVC runtime. - Preserve case-only SDK aliases when repositories created on case-insensitive Windows filesystems are consumed by case-sensitive remote executors. GitOrigin-RevId: c7a5278e87c5e7e25e9c5f60af3d99e19303b0fd --- MODULE.bazel | 52 ++++ MODULE.bazel.lock | 87 +++++++ patches/BUILD.bazel | 1 + .../windows-support-remote-case-aliases.patch | 235 ++++++++++++++++++ 4 files changed, 375 insertions(+) create mode 100644 patches/windows-support-remote-case-aliases.patch diff --git a/MODULE.bazel b/MODULE.bazel index 0e0d1d3ed0..65abc14cf6 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -7,6 +7,7 @@ bazel_dep(name = "platforms", version = "1.0.0") bazel_dep(name = "protobuf", version = "34.0.bcr.1", repo_name = "com_google_protobuf") bazel_dep(name = "rules_proto", version = "7.1.0") bazel_dep(name = "llvm", version = "0.8.11") +bazel_dep(name = "windows_support", version = "0.2.0") # Patch hermetic LLVM for Codex's custom libc++ and Windows gnullvm runtime # needs that have not landed upstream. @@ -20,6 +21,57 @@ single_version_override( ], ) +# Preserve case-only SDK aliases when native Windows repository setup feeds +# case-sensitive remote executors. +single_version_override( + module_name = "windows_support", + patch_strip = 1, + patches = [ + "//patches:windows-support-remote-case-aliases.patch", + ], + version = "0.2.0", +) + +# MSVC repository materialization fails closed until a user who has accepted +# Microsoft's Visual Studio terms explicitly supplies +# --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1. Do not configure that +# acceptance globally: Linux, macOS, and Windows GNU do not require it. +msvc_runtime = use_extension("@windows_support//windows:extensions.bzl", "msvc_runtime") +msvc_runtime.configure( + architectures = [ + "x64", + "arm64", + ], + msvc_version = "14.50.35717", + visual_studio_installer_manifest_integrity = "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8=", + visual_studio_installer_manifest_url = "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman", +) +use_repo(msvc_runtime, "msvc_runtime") + +windows_sdk = use_extension("@windows_support//windows:extensions.bzl", "windows_sdk") +windows_sdk.configure( + architectures = [ + "x64", + "arm64", + ], + transformations = { + "base/c/Include/10.0.26100.0/shared/driverspecs.h": "base/c/Include/10.0.26100.0/shared/DriverSpecs.h", + "base/c/Include/10.0.26100.0/shared/specstrings.h": "base/c/Include/10.0.26100.0/shared/SpecStrings.h", + "base/c/Include/10.0.26100.0/um/ole2.h": "base/c/Include/10.0.26100.0/um/Ole2.h", + "base/c/Include/10.0.26100.0/um/olectl.h": "base/c/Include/10.0.26100.0/um/OleCtl.h", + "**/*.h": "lowercase", + "**/*.lib": "lowercase", + "**/*.Lib": "lowercase", + }, + windows_sdk_integrity = { + "Microsoft.Windows.SDK.CPP": "sha256-/0VWYL7gcadEcVqWZWZvopwHaBV509gVlZqe7FpVZCQ=", + "Microsoft.Windows.SDK.CPP.x64": "sha256-rWzpD/lAEGmdKVSLPCseUsieuBFD4hmRVdmlw4ABtSs=", + "Microsoft.Windows.SDK.CPP.arm64": "sha256-A7wMA9Q5zvhQdLvNQl+dXTptO0Z5Z6zSHaO6bf7q+mc=", + }, + windows_sdk_version = "10.0.26100.7705", +) +use_repo(windows_sdk, "windows_sdk") + # Abseil picks a MinGW pthread TLS path that does not match our hermetic # windows-gnullvm toolchain; force it onto the portable C++11 thread-local path. single_version_override( diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock index 017d0e03c7..bb3883d593 100644 --- a/MODULE.bazel.lock +++ b/MODULE.bazel.lock @@ -252,6 +252,8 @@ "https://bcr.bazel.build/modules/tar.bzl/0.10.4/source.json": "20143442376c03426f6135292ba02d825cb75308aa47e6bf42dd4cc5a435c2ff", "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43", "https://bcr.bazel.build/modules/upb/0.0.0-20230516-61a97ef/MODULE.bazel": "c0df5e35ad55e264160417fd0875932ee3c9dda63d9fccace35ac62f45e1b6f9", + "https://bcr.bazel.build/modules/windows_support/0.2.0/MODULE.bazel": "aa17e272ca57409a71a53dae29bdadea721f9c8eeb4c136d1eaa1ee5f33b18a3", + "https://bcr.bazel.build/modules/windows_support/0.2.0/source.json": "5c9ed7f3fb7577cd2ce8030f2955d45dc0fa37e784b91431c0148631144a0209", "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/MODULE.bazel": "b573395fe63aef4299ba095173e2f62ccfee5ad9bbf7acaa95dba73af9fc2b38", "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/source.json": "3f3fbaeafecaf629877ad152a2c9def21f8d330d91aa94c5dc75bbb98c10b8b8", "https://bcr.bazel.build/modules/xz/5.4.5.bcr.8/MODULE.bazel": "e48a69bd54053c2ec5fffc2a29fb70122afd3e83ab6c07068f63bc6553fa57cc", @@ -576,6 +578,80 @@ } } } + }, + "@@windows_support+//windows:extensions.bzl%msvc_runtime": { + "general": { + "bzlTransitiveDigest": "AkkDwgsXUv5jmGJtc+lTM+O2jWPlwigCeIWMxMgYAjY=", + "usagesDigest": "XZ1DGFYwC06tBdgHxuZLhTfFlPFVKjmYmiBfiY2xe3c=", + "recordedInputs": [ + "REPO_MAPPING:windows_support+,bazel_tools bazel_tools" + ], + "generatedRepoSpecs": { + "msvc_runtime": { + "repoRuleId": "@@windows_support+//windows/private/extensions:msvc_runtime.bzl%_msvc_runtime_repository", + "attributes": { + "msvc_version": "14.50.35717", + "architectures": [ + "x64", + "arm64" + ], + "installer_manifest_url": "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman", + "installer_manifest_integrity": "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8=" + } + } + }, + "moduleExtensionMetadata": { + "explicitRootModuleDirectDeps": [ + "msvc_runtime" + ], + "explicitRootModuleDirectDevDeps": [], + "useAllRepos": "NO", + "reproducible": false + } + } + }, + "@@windows_support+//windows:extensions.bzl%windows_sdk": { + "general": { + "bzlTransitiveDigest": "AkkDwgsXUv5jmGJtc+lTM+O2jWPlwigCeIWMxMgYAjY=", + "usagesDigest": "M5xde76Im8TfiBsVtKQIavNOkqfp1QsjwJD4fVrrtFs=", + "recordedInputs": [ + "REPO_MAPPING:windows_support+,bazel_tools bazel_tools" + ], + "generatedRepoSpecs": { + "windows_sdk": { + "repoRuleId": "@@windows_support+//windows/private/extensions:windows_sdk.bzl%_windows_sdk_repository", + "attributes": { + "windows_sdk_version": "10.0.26100.7705", + "windows_sdk_integrity": { + "Microsoft.Windows.SDK.CPP": "sha256-/0VWYL7gcadEcVqWZWZvopwHaBV509gVlZqe7FpVZCQ=", + "Microsoft.Windows.SDK.CPP.x64": "sha256-rWzpD/lAEGmdKVSLPCseUsieuBFD4hmRVdmlw4ABtSs=", + "Microsoft.Windows.SDK.CPP.arm64": "sha256-A7wMA9Q5zvhQdLvNQl+dXTptO0Z5Z6zSHaO6bf7q+mc=" + }, + "transformations": { + "base/c/Include/10.0.26100.0/shared/driverspecs.h": "base/c/Include/10.0.26100.0/shared/DriverSpecs.h", + "base/c/Include/10.0.26100.0/shared/specstrings.h": "base/c/Include/10.0.26100.0/shared/SpecStrings.h", + "base/c/Include/10.0.26100.0/um/ole2.h": "base/c/Include/10.0.26100.0/um/Ole2.h", + "base/c/Include/10.0.26100.0/um/olectl.h": "base/c/Include/10.0.26100.0/um/OleCtl.h", + "**/*.h": "lowercase", + "**/*.lib": "lowercase", + "**/*.Lib": "lowercase" + }, + "architectures": [ + "x64", + "arm64" + ] + } + } + }, + "moduleExtensionMetadata": { + "explicitRootModuleDirectDeps": [ + "windows_sdk" + ], + "explicitRootModuleDirectDevDeps": [], + "useAllRepos": "NO", + "reproducible": false + } + } } }, "facts": { @@ -2059,6 +2135,17 @@ "rustfmt-1.95.0-x86_64-apple-darwin.tar.xz": "5f7228f40a160e80d260e74e068d6fec8627aa02f1f5ae29d2019b9347076401", "rustfmt-1.95.0-x86_64-pc-windows-msvc.tar.xz": "8bcf91606e36b8a0164efafde50709cd7a3c02143a2edaa81dbf3dccd6ed8f4c", "rustfmt-1.95.0-x86_64-unknown-linux-gnu.tar.xz": "f1b2a7301513ffdd95ebf22ebbdd932e4d17fc806f748d93924740d0297b1396" + }, + "@@windows_support+//windows:extensions.bzl%msvc_runtime": { + "visual_studio_installer_manifest_v1": { + "integrity": "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8=", + "request": { + "visual_studio_channel_url": "https://aka.ms/vs/stable/channel", + "visual_studio_installer_manifest_integrity": "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8=", + "visual_studio_installer_manifest_url": "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman" + }, + "url": "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman" + } } } } diff --git a/patches/BUILD.bazel b/patches/BUILD.bazel index 81bc6d4efb..eb1fe27b41 100644 --- a/patches/BUILD.bazel +++ b/patches/BUILD.bazel @@ -16,6 +16,7 @@ exports_files([ "v8_source_portability.patch", "webrtc-sys_hermetic_darwin_sysroot.patch", "windows-link.patch", + "windows-support-remote-case-aliases.patch", "xz_windows_stack_args.patch", "zstd-sys_windows_msvc_include_dirs.patch", ]) diff --git a/patches/windows-support-remote-case-aliases.patch b/patches/windows-support-remote-case-aliases.patch new file mode 100644 index 0000000000..0127a7ef60 --- /dev/null +++ b/patches/windows-support-remote-case-aliases.patch @@ -0,0 +1,235 @@ +diff --git a/windows/private/extensions/windows_sdk.bzl b/windows/private/extensions/windows_sdk.bzl +index 420cee4..16d2cf3 100644 +--- a/windows/private/extensions/windows_sdk.bzl ++++ b/windows/private/extensions/windows_sdk.bzl +@@ -133,19 +133,18 @@ def _repository_fs_is_case_sensitive(repository_ctx): + def _apply_transformations(repository_ctx): + transformations = repository_ctx.attr.transformations + if not transformations: +- return ++ return [] + + sysroot = repository_ctx.path(_SYSROOT_DIR) + if not sysroot.exists: +- return +- if not _repository_fs_is_case_sensitive(repository_ctx): +- # Case-only aliases cannot be materialized on case-insensitive filesystems. +- return ++ return [] ++ repository_fs_is_case_sensitive = _repository_fs_is_case_sensitive(repository_ctx) + + all_files = [] + _collect_files_recursive(sysroot, all_files) + all_rel_files = [_relative_to_repo_root(repository_ctx, f) for f in all_files] + created = {} ++ logical_aliases = [] + + for src_pattern, transform in transformations.items(): + src_pattern = _normalize_relpath(src_pattern) +@@ -165,11 +164,18 @@ def _apply_transformations(repository_ctx): + if not dst_rel or dst_rel == src_rel or created.get(dst_rel, False): + continue + if repository_ctx.path(dst_rel).exists: ++ if not repository_fs_is_case_sensitive and src_rel.lower() == dst_rel.lower(): ++ # Keep the alternate spelling as a Bazel source label. Bazel then ++ # preserves that spelling in a case-sensitive remote input tree. ++ logical_aliases.append(dst_rel) ++ created[dst_rel] = True + continue + + repository_ctx.symlink(src_rel, dst_rel) + created[dst_rel] = True + ++ return sorted(logical_aliases) ++ + def _windows_sdk_repository_impl(repository_ctx): + if not repository_ctx.attr.windows_sdk_version: + fail("windows_sdk_version must be set") +@@ -220,8 +226,8 @@ def _windows_sdk_repository_impl(repository_ctx): + "windows_sdk_include_versions", + ) + +- _apply_transformations(repository_ctx) + _keep_exposed_windows_sdk_files(repository_ctx, _SYSROOT_DIR, include_version, requested_architectures) ++ logical_aliases = _apply_transformations(repository_ctx) + + repository_ctx.template( + "BUILD.bazel", +@@ -229,6 +235,7 @@ def _windows_sdk_repository_impl(repository_ctx): + substitutions = { + "__WINSDK_DIR__": _SYSROOT_DIR, + "__WINSDK_INCLUDE_VERSION__": include_version, ++ "__WINSDK_LOGICAL_ALIASES__": repr(logical_aliases), + }, + ) + +@@ -258,7 +265,9 @@ _WINDOWS_SDK_ATTR = { + "transformations": attr.string_dict( + default = {}, + doc = """ +- Dict of source path patterns to transformations applied when run on case-sensitive filesystems. ++ Dict of source path patterns to transformations applied to extracted Windows SDK files. ++ Case-only transformations are Bazel aliases on case-insensitive filesystems and symlinks on ++ case-sensitive filesystems. + + Supports exact paths and `**/*.ext` patterns. Use value `lowercase` to create lowercase aliases. + +diff --git a/windows/private/extensions/windows_sdk.BUILD.bazel b/windows/private/extensions/windows_sdk.BUILD.bazel +index 0d03f4e..199fdf0 100644 +--- a/windows/private/extensions/windows_sdk.BUILD.bazel ++++ b/windows/private/extensions/windows_sdk.BUILD.bazel +@@ -5,6 +5,8 @@ load("@bazel_skylib//rules/directory:subdirectory.bzl", "subdirectory") + + package(default_visibility = ["//visibility:public"]) + ++_LOGICAL_ALIASES = __WINSDK_LOGICAL_ALIASES__ ++ + config_setting( + name = "windows_aarch64", + constraint_values = [ +@@ -18,7 +20,7 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/**"], + allow_empty = True, +- ), ++ ) + _LOGICAL_ALIASES, + ) + + subdirectory( +@@ -32,7 +34,11 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/ucrt/**"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.startswith("__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/ucrt/") ++ ], + ) + + subdirectory( +@@ -46,7 +52,11 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/shared/**"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.startswith("__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/shared/") ++ ], + ) + + subdirectory( +@@ -60,7 +70,11 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/um/**"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.startswith("__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/um/") ++ ], + ) + + subdirectory( +@@ -74,7 +88,11 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/winrt/**"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.startswith("__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/winrt/") ++ ], + ) + + subdirectory( +@@ -88,7 +106,11 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/arm64/c/ucrt/arm64/**"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.startswith("__WINSDK_DIR__/arm64/c/ucrt/arm64/") ++ ], + ) + + subdirectory( +@@ -102,7 +124,11 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/x64/c/ucrt/x64/**"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.startswith("__WINSDK_DIR__/x64/c/ucrt/x64/") ++ ], + ) + + subdirectory( +@@ -116,7 +142,11 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/arm64/c/um/arm64/**"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.startswith("__WINSDK_DIR__/arm64/c/um/arm64/") ++ ], + ) + + subdirectory( +@@ -130,7 +160,11 @@ directory( + srcs = glob( + ["__WINSDK_DIR__/x64/c/um/x64/**"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.startswith("__WINSDK_DIR__/x64/c/um/x64/") ++ ], + ) + + subdirectory( +@@ -160,7 +194,7 @@ filegroup( + srcs = glob( + ["**"], + allow_empty = True, +- ), ++ ) + _LOGICAL_ALIASES, + ) + + filegroup( +@@ -177,7 +211,11 @@ filegroup( + "**/*.hpp", + ], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.endswith(".h") or f.endswith(".hh") or f.endswith(".hpp") ++ ], + ) + + filegroup( +@@ -185,5 +223,9 @@ filegroup( + srcs = glob( + ["**/*.lib"], + allow_empty = True, +- ), ++ ) + [ ++ f ++ for f in _LOGICAL_ALIASES ++ if f.endswith(".lib") ++ ], + )