diff --git a/MODULE.bazel b/MODULE.bazel index c4ef9500a7..ecf16e31bc 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -447,6 +447,114 @@ http_archive( urls = ["https://static.crates.io/crates/v8/v8-149.2.0.crate"], ) +http_file( + name = "rusty_v8_149_2_0_aarch64_apple_darwin_sandbox_archive", + downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.a.gz", + sha256 = "24d52c19cfa9b01b1c94607cd1f0edec408a0489dadab00b9d497bc3b29cb47b", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/librusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.a.gz", + ], +) + +http_file( + name = "rusty_v8_149_2_0_aarch64_apple_darwin_sandbox_binding", + downloaded_file_path = "src_binding_ptrcomp_sandbox_release_aarch64-apple-darwin.rs", + sha256 = "f0d0b199ec80f647b4fab01bc71947947588b6571eb11c08f946b8d8748c400b", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/src_binding_ptrcomp_sandbox_release_aarch64-apple-darwin.rs", + ], +) + +http_file( + name = "rusty_v8_149_2_0_aarch64_unknown_linux_gnu_sandbox_archive", + downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.a.gz", + sha256 = "9998989f174032ec51aa90d5fb92cd472c1da82f7ad133fbd908c3330a79d653", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.a.gz", + ], +) + +http_file( + name = "rusty_v8_149_2_0_aarch64_unknown_linux_gnu_sandbox_binding", + downloaded_file_path = "src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.rs", + sha256 = "5db3ec0783531d12862a3f38dd5a679273550e67962260b81f07e612a68a0c24", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.rs", + ], +) + +http_file( + name = "rusty_v8_149_2_0_aarch64_unknown_linux_musl_sandbox_archive", + downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz", + sha256 = "1258cf8552cbc2630918021344c30a39c45d3e72f6cba5bf04cbc138201eec2c", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz", + ], +) + +http_file( + name = "rusty_v8_149_2_0_aarch64_unknown_linux_musl_sandbox_binding", + downloaded_file_path = "src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.rs", + sha256 = "5db3ec0783531d12862a3f38dd5a679273550e67962260b81f07e612a68a0c24", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.rs", + ], +) + +http_file( + name = "rusty_v8_149_2_0_x86_64_apple_darwin_sandbox_archive", + downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_x86_64-apple-darwin.a.gz", + sha256 = "f87cd21be19cf8a7f15fc4747569ee44865f2804e10facbfffa87458a37a037c", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/librusty_v8_ptrcomp_sandbox_release_x86_64-apple-darwin.a.gz", + ], +) + +http_file( + name = "rusty_v8_149_2_0_x86_64_apple_darwin_sandbox_binding", + downloaded_file_path = "src_binding_ptrcomp_sandbox_release_x86_64-apple-darwin.rs", + sha256 = "f0d0b199ec80f647b4fab01bc71947947588b6571eb11c08f946b8d8748c400b", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/src_binding_ptrcomp_sandbox_release_x86_64-apple-darwin.rs", + ], +) + +http_file( + name = "rusty_v8_149_2_0_x86_64_unknown_linux_gnu_sandbox_archive", + downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.a.gz", + sha256 = "a7bef1c9212781d699a31077d1033b656e1586d60af49b514ceaed5229b65555", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.a.gz", + ], +) + +http_file( + name = "rusty_v8_149_2_0_x86_64_unknown_linux_gnu_sandbox_binding", + downloaded_file_path = "src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.rs", + sha256 = "5db3ec0783531d12862a3f38dd5a679273550e67962260b81f07e612a68a0c24", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.rs", + ], +) + +http_file( + name = "rusty_v8_149_2_0_x86_64_unknown_linux_musl_sandbox_archive", + downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.a.gz", + sha256 = "e61cfb5dc553407f930b144932a48e00dae4a2ca2787f18a120c75f858d98675", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.a.gz", + ], +) + +http_file( + name = "rusty_v8_149_2_0_x86_64_unknown_linux_musl_sandbox_binding", + downloaded_file_path = "src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs", + sha256 = "5db3ec0783531d12862a3f38dd5a679273550e67962260b81f07e612a68a0c24", + urls = [ + "https://github.com/openai/codex/releases/download/rusty-v8-v149.2.0/src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs", + ], +) + git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository") git_repository( diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel index 425d81ea85..265c232f05 100644 --- a/third_party/v8/BUILD.bazel +++ b/third_party/v8/BUILD.bazel @@ -39,6 +39,36 @@ alias( actual = "@rusty_v8_149_2_0_aarch64_pc_windows_msvc_archive//file", ) +alias( + name = "v8_149_2_0_aarch64_apple_darwin_sandbox_release", + actual = "@rusty_v8_149_2_0_aarch64_apple_darwin_sandbox_archive//file", +) + +alias( + name = "v8_149_2_0_aarch64_unknown_linux_gnu_sandbox_release", + actual = "@rusty_v8_149_2_0_aarch64_unknown_linux_gnu_sandbox_archive//file", +) + +alias( + name = "v8_149_2_0_aarch64_unknown_linux_musl_sandbox_release", + actual = "@rusty_v8_149_2_0_aarch64_unknown_linux_musl_sandbox_archive//file", +) + +alias( + name = "v8_149_2_0_x86_64_apple_darwin_sandbox_release", + actual = "@rusty_v8_149_2_0_x86_64_apple_darwin_sandbox_archive//file", +) + +alias( + name = "v8_149_2_0_x86_64_unknown_linux_gnu_sandbox_release", + actual = "@rusty_v8_149_2_0_x86_64_unknown_linux_gnu_sandbox_archive//file", +) + +alias( + name = "v8_149_2_0_x86_64_unknown_linux_musl_sandbox_release", + actual = "@rusty_v8_149_2_0_x86_64_unknown_linux_musl_sandbox_archive//file", +) + alias( name = "v8_149_2_0_aarch64_pc_windows_gnullvm", # `rusty_v8` only ships prebuilt Windows archives for MSVC. Build the @@ -86,37 +116,67 @@ alias( actual = ":src_binding_release_aarch64_unknown_linux_gnu_149_2_0_release", ) +alias( + name = "src_binding_release_aarch64_apple_darwin_149_2_0_sandbox_published", + actual = "@rusty_v8_149_2_0_aarch64_apple_darwin_sandbox_binding//file", +) + +alias( + name = "src_binding_release_aarch64_unknown_linux_gnu_149_2_0_sandbox_published", + actual = "@rusty_v8_149_2_0_aarch64_unknown_linux_gnu_sandbox_binding//file", +) + +alias( + name = "src_binding_release_aarch64_unknown_linux_musl_149_2_0_sandbox_published", + actual = "@rusty_v8_149_2_0_aarch64_unknown_linux_musl_sandbox_binding//file", +) + +alias( + name = "src_binding_release_x86_64_apple_darwin_149_2_0_sandbox_published", + actual = "@rusty_v8_149_2_0_x86_64_apple_darwin_sandbox_binding//file", +) + +alias( + name = "src_binding_release_x86_64_unknown_linux_gnu_149_2_0_sandbox_published", + actual = "@rusty_v8_149_2_0_x86_64_unknown_linux_gnu_sandbox_binding//file", +) + +alias( + name = "src_binding_release_x86_64_unknown_linux_musl_149_2_0_sandbox_published", + actual = "@rusty_v8_149_2_0_x86_64_unknown_linux_musl_sandbox_binding//file", +) + alias( name = "rusty_v8_archive_for_target", actual = select({ - "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":v8_149_2_0_aarch64_apple_darwin_bazel", + "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":v8_149_2_0_aarch64_apple_darwin_sandbox_release", "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":v8_149_2_0_aarch64_pc_windows_gnullvm", "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":v8_149_2_0_aarch64_pc_windows_msvc", - "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":v8_149_2_0_aarch64_unknown_linux_gnu_bazel", - ":platform_aarch64_unknown_linux_musl": ":v8_149_2_0_aarch64_unknown_linux_musl_release_base", - "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":v8_149_2_0_x86_64_apple_darwin_bazel", + "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":v8_149_2_0_aarch64_unknown_linux_gnu_sandbox_release", + ":platform_aarch64_unknown_linux_musl": ":v8_149_2_0_aarch64_unknown_linux_musl_sandbox_release", + "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":v8_149_2_0_x86_64_apple_darwin_sandbox_release", "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":v8_149_2_0_x86_64_pc_windows_gnullvm", "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":v8_149_2_0_x86_64_pc_windows_msvc", - "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":v8_149_2_0_x86_64_unknown_linux_gnu_bazel", - ":platform_x86_64_unknown_linux_musl": ":v8_149_2_0_x86_64_unknown_linux_musl_release", - "//conditions:default": ":v8_149_2_0_x86_64_unknown_linux_gnu_bazel", + "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":v8_149_2_0_x86_64_unknown_linux_gnu_sandbox_release", + ":platform_x86_64_unknown_linux_musl": ":v8_149_2_0_x86_64_unknown_linux_musl_sandbox_release", + "//conditions:default": ":v8_149_2_0_x86_64_unknown_linux_gnu_sandbox_release", }), ) alias( name = "rusty_v8_binding_for_target", actual = select({ - "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":src_binding_release_aarch64_apple_darwin_149_2_0_release", + "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":src_binding_release_aarch64_apple_darwin_149_2_0_sandbox_published", "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":src_binding_release_aarch64_pc_windows_gnullvm_149_2_0_release", "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":src_binding_release_aarch64_pc_windows_msvc_149_2_0_release", - "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":src_binding_release_aarch64_unknown_linux_gnu_149_2_0_release", - ":platform_aarch64_unknown_linux_musl": ":src_binding_release_aarch64_unknown_linux_musl_149_2_0_release", - "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":src_binding_release_x86_64_apple_darwin_149_2_0_release", + "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":src_binding_release_aarch64_unknown_linux_gnu_149_2_0_sandbox_published", + ":platform_aarch64_unknown_linux_musl": ":src_binding_release_aarch64_unknown_linux_musl_149_2_0_sandbox_published", + "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":src_binding_release_x86_64_apple_darwin_149_2_0_sandbox_published", "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":src_binding_release_x86_64_pc_windows_gnullvm_149_2_0_release", "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":src_binding_release_x86_64_pc_windows_msvc_149_2_0_release", - "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":src_binding_release_x86_64_unknown_linux_gnu_149_2_0_release", - ":platform_x86_64_unknown_linux_musl": ":src_binding_release_x86_64_unknown_linux_musl_149_2_0_release", - "//conditions:default": ":src_binding_release_x86_64_unknown_linux_gnu_149_2_0_release", + "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":src_binding_release_x86_64_unknown_linux_gnu_149_2_0_sandbox_published", + ":platform_x86_64_unknown_linux_musl": ":src_binding_release_x86_64_unknown_linux_musl_149_2_0_sandbox_published", + "//conditions:default": ":src_binding_release_x86_64_unknown_linux_gnu_149_2_0_sandbox_published", }), ) diff --git a/third_party/v8/README.md b/third_party/v8/README.md index a08675795c..0a22135f7f 100644 --- a/third_party/v8/README.md +++ b/third_party/v8/README.md @@ -4,19 +4,21 @@ This directory wires the `v8` crate to exact-version Bazel inputs. Bazel consumer builds use: - upstream `denoland/rusty_v8` release archives on Windows MSVC -- source-built V8 archives on Darwin, GNU Linux, musl Linux, and Windows GNU -- `openai/codex` release assets for published musl release pairs +- sandbox-enabled `openai/codex` release assets on Darwin, GNU Linux, and musl + Linux +- source-built V8 archives on Windows GNU -Cargo builds still use prebuilt `rusty_v8` archives by default. Only Bazel -overrides `RUSTY_V8_ARCHIVE`/`RUSTY_V8_SRC_BINDING_PATH` in `MODULE.bazel` to -select source-built local archives for its consumer builds. +Local Cargo builds still use upstream prebuilt `rusty_v8` archives by default. +Selected Cargo CI, release, and package builds override +`RUSTY_V8_ARCHIVE`/`RUSTY_V8_SRC_BINDING_PATH` with Codex release assets. Bazel +sets the same overrides in `MODULE.bazel` to select the matching release archive +and binding for its consumer builds. -Source-built Bazel V8 artifacts enable V8's in-process sandbox by default, and -the Bazel `v8` crate feature selection tracks those targets. A full consumer -rollout still needs matching sandbox-enabled archives for every non-source-built -target. Until that artifact migration lands, the rusty_v8 publishing workflows -use `--config=v8-release-compat` to preserve the current non-sandboxed release -artifact contract. +The Bazel `v8` crate feature selection enables V8's in-process sandbox for +Darwin, Linux, and Windows GNU. Darwin and Linux consume the matching published +sandbox artifacts. Windows GNU continues to build from source because the +release workflow does not publish Windows GNU artifacts. Windows MSVC remains +on upstream non-sandboxed prebuilts. Current pinned versions: @@ -35,8 +37,8 @@ Use this as the maintainer flow for a version bump: 5. Once the release build completes, rerun the build on the candidate branch and verify that the final artifact builds and tests pass. -When changing the remaining prebuilt `rusty_v8` `http_file` inputs, keep the -checked-in checksum manifest and `MODULE.bazel` in sync: +When changing `rusty_v8` `http_file` inputs, keep the checked-in checksum +manifest and `MODULE.bazel` in sync: ```bash python3 .github/scripts/rusty_v8_bazel.py update-module-bazel @@ -90,10 +92,12 @@ The same run also builds the matching sandbox pair targets: The Bazel graph pins the same libc++, libc++abi, and llvm-libc source revisions used by `rusty_v8 v149.2.0`, compiles published artifact targets with `--config=rusty-v8-upstream-libcxx`, and folds the matching runtime objects into -the final static archive so Cargo consumers can link it with the `v8` crate's -default `use_custom_libcxx` feature. The config keeps the object files and the -bundled runtime on Chromium's `std::__Cr` ABI namespace instead of mixing those -objects with the toolchain libc++ default namespace. +the final static archive so consumers can link it with the `v8` crate's default +`use_custom_libcxx` feature. The config keeps the object files and the bundled +runtime on Chromium's `std::__Cr` ABI namespace instead of mixing those objects +with the toolchain libc++ default namespace. The source-built targets remain in +the graph as the producers for future release tags; the consumer selectors use +the immutable assets from the current tag. MSVC is not part of the Bazel-produced matrix yet. The repository's current hermetic Windows C++ platform is `windows-gnullvm`/`x86_64-w64-windows-gnu`, so diff --git a/third_party/v8/rusty_v8_149_2_0.sha256 b/third_party/v8/rusty_v8_149_2_0.sha256 index 4c97754744..d22b9ca380 100644 --- a/third_party/v8/rusty_v8_149_2_0.sha256 +++ b/third_party/v8/rusty_v8_149_2_0.sha256 @@ -1,2 +1,14 @@ +24d52c19cfa9b01b1c94607cd1f0edec408a0489dadab00b9d497bc3b29cb47b librusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.a.gz +9998989f174032ec51aa90d5fb92cd472c1da82f7ad133fbd908c3330a79d653 librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.a.gz +1258cf8552cbc2630918021344c30a39c45d3e72f6cba5bf04cbc138201eec2c librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz +f87cd21be19cf8a7f15fc4747569ee44865f2804e10facbfffa87458a37a037c librusty_v8_ptrcomp_sandbox_release_x86_64-apple-darwin.a.gz +a7bef1c9212781d699a31077d1033b656e1586d60af49b514ceaed5229b65555 librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.a.gz +e61cfb5dc553407f930b144932a48e00dae4a2ca2787f18a120c75f858d98675 librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.a.gz 923f2b6ccdc14526b814e171e34c9aafd7969f12304948857c6696d022f0fb3c rusty_v8_release_aarch64-pc-windows-msvc.lib.gz 12b5a791b54e92f748738ad8d0d12dad8d281a2d836638ad1aa6678e3b855d9a rusty_v8_release_x86_64-pc-windows-msvc.lib.gz +f0d0b199ec80f647b4fab01bc71947947588b6571eb11c08f946b8d8748c400b src_binding_ptrcomp_sandbox_release_aarch64-apple-darwin.rs +5db3ec0783531d12862a3f38dd5a679273550e67962260b81f07e612a68a0c24 src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.rs +5db3ec0783531d12862a3f38dd5a679273550e67962260b81f07e612a68a0c24 src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.rs +f0d0b199ec80f647b4fab01bc71947947588b6571eb11c08f946b8d8748c400b src_binding_ptrcomp_sandbox_release_x86_64-apple-darwin.rs +5db3ec0783531d12862a3f38dd5a679273550e67962260b81f07e612a68a0c24 src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.rs +5db3ec0783531d12862a3f38dd5a679273550e67962260b81f07e612a68a0c24 src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs