Add hermetic Windows SDK and MSVC runtime repositories (#37896)

## What changed

- Add pinned `windows_support` repositories for the Windows SDK and MSVC runtime on `x64` and `arm64`.
- Require explicit acceptance through `--repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1` before materializing the MSVC runtime.
- Preserve case-only SDK aliases when repositories created on case-insensitive Windows filesystems are consumed by case-sensitive remote executors.

GitOrigin-RevId: c7a5278e87c5e7e25e9c5f60af3d99e19303b0fd

MODULE.bazel

@@ -7,6 +7,7 @@ bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "protobuf", version = "34.0.bcr.1", repo_name = "com_google_protobuf")
 bazel_dep(name = "rules_proto", version = "7.1.0")
 bazel_dep(name = "llvm", version = "0.8.11")
+bazel_dep(name = "windows_support", version = "0.2.0")
 
 # Patch hermetic LLVM for Codex's custom libc++ and Windows gnullvm runtime
 # needs that have not landed upstream.
@@ -20,6 +21,57 @@ single_version_override(
     ],
 )
 
+# Preserve case-only SDK aliases when native Windows repository setup feeds
+# case-sensitive remote executors.
+single_version_override(
+    module_name = "windows_support",
+    patch_strip = 1,
+    patches = [
+        "//patches:windows-support-remote-case-aliases.patch",
+    ],
+    version = "0.2.0",
+)
+
+# MSVC repository materialization fails closed until a user who has accepted
+# Microsoft's Visual Studio terms explicitly supplies
+# --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1. Do not configure that
+# acceptance globally: Linux, macOS, and Windows GNU do not require it.
+msvc_runtime = use_extension("@windows_support//windows:extensions.bzl", "msvc_runtime")
+msvc_runtime.configure(
+    architectures = [
+        "x64",
+        "arm64",
+    ],
+    msvc_version = "14.50.35717",
+    visual_studio_installer_manifest_integrity = "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8=",
+    visual_studio_installer_manifest_url = "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman",
+)
+use_repo(msvc_runtime, "msvc_runtime")
+
+windows_sdk = use_extension("@windows_support//windows:extensions.bzl", "windows_sdk")
+windows_sdk.configure(
+    architectures = [
+        "x64",
+        "arm64",
+    ],
+    transformations = {
+        "base/c/Include/10.0.26100.0/shared/driverspecs.h": "base/c/Include/10.0.26100.0/shared/DriverSpecs.h",
+        "base/c/Include/10.0.26100.0/shared/specstrings.h": "base/c/Include/10.0.26100.0/shared/SpecStrings.h",
+        "base/c/Include/10.0.26100.0/um/ole2.h": "base/c/Include/10.0.26100.0/um/Ole2.h",
+        "base/c/Include/10.0.26100.0/um/olectl.h": "base/c/Include/10.0.26100.0/um/OleCtl.h",
+        "**/*.h": "lowercase",
+        "**/*.lib": "lowercase",
+        "**/*.Lib": "lowercase",
+    },
+    windows_sdk_integrity = {
+        "Microsoft.Windows.SDK.CPP": "sha256-/0VWYL7gcadEcVqWZWZvopwHaBV509gVlZqe7FpVZCQ=",
+        "Microsoft.Windows.SDK.CPP.x64": "sha256-rWzpD/lAEGmdKVSLPCseUsieuBFD4hmRVdmlw4ABtSs=",
+        "Microsoft.Windows.SDK.CPP.arm64": "sha256-A7wMA9Q5zvhQdLvNQl+dXTptO0Z5Z6zSHaO6bf7q+mc=",
+    },
+    windows_sdk_version = "10.0.26100.7705",
+)
+use_repo(windows_sdk, "windows_sdk")
+
 # Abseil picks a MinGW pthread TLS path that does not match our hermetic
 # windows-gnullvm toolchain; force it onto the portable C++11 thread-local path.
 single_version_override(

MODULE.bazel.lock

@@ -252,6 +252,8 @@
     "https://bcr.bazel.build/modules/tar.bzl/0.10.4/source.json": "20143442376c03426f6135292ba02d825cb75308aa47e6bf42dd4cc5a435c2ff",
     "https://bcr.bazel.build/modules/upb/0.0.0-20220923-a547704/MODULE.bazel": "7298990c00040a0e2f121f6c32544bab27d4452f80d9ce51349b1a28f3005c43",
     "https://bcr.bazel.build/modules/upb/0.0.0-20230516-61a97ef/MODULE.bazel": "c0df5e35ad55e264160417fd0875932ee3c9dda63d9fccace35ac62f45e1b6f9",
+    "https://bcr.bazel.build/modules/windows_support/0.2.0/MODULE.bazel": "aa17e272ca57409a71a53dae29bdadea721f9c8eeb4c136d1eaa1ee5f33b18a3",
+    "https://bcr.bazel.build/modules/windows_support/0.2.0/source.json": "5c9ed7f3fb7577cd2ce8030f2955d45dc0fa37e784b91431c0148631144a0209",
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/MODULE.bazel": "b573395fe63aef4299ba095173e2f62ccfee5ad9bbf7acaa95dba73af9fc2b38",
     "https://bcr.bazel.build/modules/with_cfg.bzl/0.12.0/source.json": "3f3fbaeafecaf629877ad152a2c9def21f8d330d91aa94c5dc75bbb98c10b8b8",
     "https://bcr.bazel.build/modules/xz/5.4.5.bcr.8/MODULE.bazel": "e48a69bd54053c2ec5fffc2a29fb70122afd3e83ab6c07068f63bc6553fa57cc",
@@ -576,6 +578,80 @@
           }
         }
       }
+    },
+    "@@windows_support+//windows:extensions.bzl%msvc_runtime": {
+      "general": {
+        "bzlTransitiveDigest": "AkkDwgsXUv5jmGJtc+lTM+O2jWPlwigCeIWMxMgYAjY=",
+        "usagesDigest": "XZ1DGFYwC06tBdgHxuZLhTfFlPFVKjmYmiBfiY2xe3c=",
+        "recordedInputs": [
+          "REPO_MAPPING:windows_support+,bazel_tools bazel_tools"
+        ],
+        "generatedRepoSpecs": {
+          "msvc_runtime": {
+            "repoRuleId": "@@windows_support+//windows/private/extensions:msvc_runtime.bzl%_msvc_runtime_repository",
+            "attributes": {
+              "msvc_version": "14.50.35717",
+              "architectures": [
+                "x64",
+                "arm64"
+              ],
+              "installer_manifest_url": "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman",
+              "installer_manifest_integrity": "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8="
+            }
+          }
+        },
+        "moduleExtensionMetadata": {
+          "explicitRootModuleDirectDeps": [
+            "msvc_runtime"
+          ],
+          "explicitRootModuleDirectDevDeps": [],
+          "useAllRepos": "NO",
+          "reproducible": false
+        }
+      }
+    },
+    "@@windows_support+//windows:extensions.bzl%windows_sdk": {
+      "general": {
+        "bzlTransitiveDigest": "AkkDwgsXUv5jmGJtc+lTM+O2jWPlwigCeIWMxMgYAjY=",
+        "usagesDigest": "M5xde76Im8TfiBsVtKQIavNOkqfp1QsjwJD4fVrrtFs=",
+        "recordedInputs": [
+          "REPO_MAPPING:windows_support+,bazel_tools bazel_tools"
+        ],
+        "generatedRepoSpecs": {
+          "windows_sdk": {
+            "repoRuleId": "@@windows_support+//windows/private/extensions:windows_sdk.bzl%_windows_sdk_repository",
+            "attributes": {
+              "windows_sdk_version": "10.0.26100.7705",
+              "windows_sdk_integrity": {
+                "Microsoft.Windows.SDK.CPP": "sha256-/0VWYL7gcadEcVqWZWZvopwHaBV509gVlZqe7FpVZCQ=",
+                "Microsoft.Windows.SDK.CPP.x64": "sha256-rWzpD/lAEGmdKVSLPCseUsieuBFD4hmRVdmlw4ABtSs=",
+                "Microsoft.Windows.SDK.CPP.arm64": "sha256-A7wMA9Q5zvhQdLvNQl+dXTptO0Z5Z6zSHaO6bf7q+mc="
+              },
+              "transformations": {
+                "base/c/Include/10.0.26100.0/shared/driverspecs.h": "base/c/Include/10.0.26100.0/shared/DriverSpecs.h",
+                "base/c/Include/10.0.26100.0/shared/specstrings.h": "base/c/Include/10.0.26100.0/shared/SpecStrings.h",
+                "base/c/Include/10.0.26100.0/um/ole2.h": "base/c/Include/10.0.26100.0/um/Ole2.h",
+                "base/c/Include/10.0.26100.0/um/olectl.h": "base/c/Include/10.0.26100.0/um/OleCtl.h",
+                "**/*.h": "lowercase",
+                "**/*.lib": "lowercase",
+                "**/*.Lib": "lowercase"
+              },
+              "architectures": [
+                "x64",
+                "arm64"
+              ]
+            }
+          }
+        },
+        "moduleExtensionMetadata": {
+          "explicitRootModuleDirectDeps": [
+            "windows_sdk"
+          ],
+          "explicitRootModuleDirectDevDeps": [],
+          "useAllRepos": "NO",
+          "reproducible": false
+        }
+      }
     }
   },
   "facts": {
@@ -2059,6 +2135,17 @@
       "rustfmt-1.95.0-x86_64-apple-darwin.tar.xz": "5f7228f40a160e80d260e74e068d6fec8627aa02f1f5ae29d2019b9347076401",
       "rustfmt-1.95.0-x86_64-pc-windows-msvc.tar.xz": "8bcf91606e36b8a0164efafde50709cd7a3c02143a2edaa81dbf3dccd6ed8f4c",
       "rustfmt-1.95.0-x86_64-unknown-linux-gnu.tar.xz": "f1b2a7301513ffdd95ebf22ebbdd932e4d17fc806f748d93924740d0297b1396"
+    },
+    "@@windows_support+//windows:extensions.bzl%msvc_runtime": {
+      "visual_studio_installer_manifest_v1": {
+        "integrity": "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8=",
+        "request": {
+          "visual_studio_channel_url": "https://aka.ms/vs/stable/channel",
+          "visual_studio_installer_manifest_integrity": "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8=",
+          "visual_studio_installer_manifest_url": "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman"
+        },
+        "url": "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman"
+      }
     }
   }
 }

patches/BUILD.bazel

@@ -16,6 +16,7 @@ exports_files([
     "v8_source_portability.patch",
     "webrtc-sys_hermetic_darwin_sysroot.patch",
     "windows-link.patch",
+    "windows-support-remote-case-aliases.patch",
     "xz_windows_stack_args.patch",
     "zstd-sys_windows_msvc_include_dirs.patch",
 ])

patches/windows-support-remote-case-aliases.patch

@@ -0,0 +1,235 @@
+diff --git a/windows/private/extensions/windows_sdk.bzl b/windows/private/extensions/windows_sdk.bzl
+index 420cee4..16d2cf3 100644
+--- a/windows/private/extensions/windows_sdk.bzl
++++ b/windows/private/extensions/windows_sdk.bzl
+@@ -133,19 +133,18 @@ def _repository_fs_is_case_sensitive(repository_ctx):
+ def _apply_transformations(repository_ctx):
+     transformations = repository_ctx.attr.transformations
+     if not transformations:
+-        return
++        return []
+ 
+     sysroot = repository_ctx.path(_SYSROOT_DIR)
+     if not sysroot.exists:
+-        return
+-    if not _repository_fs_is_case_sensitive(repository_ctx):
+-        # Case-only aliases cannot be materialized on case-insensitive filesystems.
+-        return
++        return []
++    repository_fs_is_case_sensitive = _repository_fs_is_case_sensitive(repository_ctx)
+ 
+     all_files = []
+     _collect_files_recursive(sysroot, all_files)
+     all_rel_files = [_relative_to_repo_root(repository_ctx, f) for f in all_files]
+     created = {}
++    logical_aliases = []
+ 
+     for src_pattern, transform in transformations.items():
+         src_pattern = _normalize_relpath(src_pattern)
+@@ -165,11 +164,18 @@ def _apply_transformations(repository_ctx):
+             if not dst_rel or dst_rel == src_rel or created.get(dst_rel, False):
+                 continue
+             if repository_ctx.path(dst_rel).exists:
++                if not repository_fs_is_case_sensitive and src_rel.lower() == dst_rel.lower():
++                    # Keep the alternate spelling as a Bazel source label. Bazel then
++                    # preserves that spelling in a case-sensitive remote input tree.
++                    logical_aliases.append(dst_rel)
++                    created[dst_rel] = True
+                 continue
+ 
+             repository_ctx.symlink(src_rel, dst_rel)
+             created[dst_rel] = True
+ 
++    return sorted(logical_aliases)
++
+ def _windows_sdk_repository_impl(repository_ctx):
+     if not repository_ctx.attr.windows_sdk_version:
+         fail("windows_sdk_version must be set")
+@@ -220,8 +226,8 @@ def _windows_sdk_repository_impl(repository_ctx):
+         "windows_sdk_include_versions",
+     )
+ 
+-    _apply_transformations(repository_ctx)
+     _keep_exposed_windows_sdk_files(repository_ctx, _SYSROOT_DIR, include_version, requested_architectures)
++    logical_aliases = _apply_transformations(repository_ctx)
+ 
+     repository_ctx.template(
+         "BUILD.bazel",
+@@ -229,6 +235,7 @@ def _windows_sdk_repository_impl(repository_ctx):
+         substitutions = {
+             "__WINSDK_DIR__": _SYSROOT_DIR,
+             "__WINSDK_INCLUDE_VERSION__": include_version,
++            "__WINSDK_LOGICAL_ALIASES__": repr(logical_aliases),
+         },
+     )
+ 
+@@ -258,7 +265,9 @@ _WINDOWS_SDK_ATTR = {
+     "transformations": attr.string_dict(
+         default = {},
+         doc = """
+-            Dict of source path patterns to transformations applied when run on case-sensitive filesystems.
++            Dict of source path patterns to transformations applied to extracted Windows SDK files.
++            Case-only transformations are Bazel aliases on case-insensitive filesystems and symlinks on
++            case-sensitive filesystems.
+ 
+             Supports exact paths and `**/*.ext` patterns. Use value `lowercase` to create lowercase aliases.
+ 
+diff --git a/windows/private/extensions/windows_sdk.BUILD.bazel b/windows/private/extensions/windows_sdk.BUILD.bazel
+index 0d03f4e..199fdf0 100644
+--- a/windows/private/extensions/windows_sdk.BUILD.bazel
++++ b/windows/private/extensions/windows_sdk.BUILD.bazel
+@@ -5,6 +5,8 @@ load("@bazel_skylib//rules/directory:subdirectory.bzl", "subdirectory")
+ 
+ package(default_visibility = ["//visibility:public"])
+ 
++_LOGICAL_ALIASES = __WINSDK_LOGICAL_ALIASES__
++
+ config_setting(
+     name = "windows_aarch64",
+     constraint_values = [
+@@ -18,7 +20,7 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/**"],
+         allow_empty = True,
+-    ),
++    ) + _LOGICAL_ALIASES,
+ )
+ 
+ subdirectory(
+@@ -32,7 +34,11 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/ucrt/**"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.startswith("__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/ucrt/")
++    ],
+ )
+ 
+ subdirectory(
+@@ -46,7 +52,11 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/shared/**"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.startswith("__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/shared/")
++    ],
+ )
+ 
+ subdirectory(
+@@ -60,7 +70,11 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/um/**"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.startswith("__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/um/")
++    ],
+ )
+ 
+ subdirectory(
+@@ -74,7 +88,11 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/winrt/**"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.startswith("__WINSDK_DIR__/base/c/Include/__WINSDK_INCLUDE_VERSION__/winrt/")
++    ],
+ )
+ 
+ subdirectory(
+@@ -88,7 +106,11 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/arm64/c/ucrt/arm64/**"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.startswith("__WINSDK_DIR__/arm64/c/ucrt/arm64/")
++    ],
+ )
+ 
+ subdirectory(
+@@ -102,7 +124,11 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/x64/c/ucrt/x64/**"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.startswith("__WINSDK_DIR__/x64/c/ucrt/x64/")
++    ],
+ )
+ 
+ subdirectory(
+@@ -116,7 +142,11 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/arm64/c/um/arm64/**"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.startswith("__WINSDK_DIR__/arm64/c/um/arm64/")
++    ],
+ )
+ 
+ subdirectory(
+@@ -130,7 +160,11 @@ directory(
+     srcs = glob(
+         ["__WINSDK_DIR__/x64/c/um/x64/**"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.startswith("__WINSDK_DIR__/x64/c/um/x64/")
++    ],
+ )
+ 
+ subdirectory(
+@@ -160,7 +194,7 @@ filegroup(
+     srcs = glob(
+         ["**"],
+         allow_empty = True,
+-    ),
++    ) + _LOGICAL_ALIASES,
+ )
+ 
+ filegroup(
+@@ -177,7 +211,11 @@ filegroup(
+             "**/*.hpp",
+         ],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.endswith(".h") or f.endswith(".hh") or f.endswith(".hpp")
++    ],
+ )
+ 
+ filegroup(
+@@ -185,5 +223,9 @@ filegroup(
+     srcs = glob(
+         ["**/*.lib"],
+         allow_empty = True,
+-    ),
++    ) + [
++        f
++        for f in _LOGICAL_ALIASES
++        if f.endswith(".lib")
++    ],
+ )