mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
813dc5f08d
## Why `rules_rust` drops the build script's per-binary linker directives, so Bazel builds can omit the `asInvoker` manifest from the Windows sandbox setup helper. ## What changed - Add per-binary compile data and Rust flags to `codex_rust_crate` so linker inputs remain scoped to the setup helper. - Embed the manifest directly for MSVC builds and compile it into a resource with hermetic LLVM tooling for GNU/LLVM cross-builds. - Disable the redundant build script under Bazel and avoid duplicating binary runfiles in integration test data. ## Testing Add a Windows integration test that loads the setup executable's manifest resource and verifies that it requests `asInvoker` execution with UI access disabled. GitOrigin-RevId: a77e7e627ee43810f5eaf7701bb4909bf855216b
59 lines
2.5 KiB
Python
59 lines
2.5 KiB
Python
load("//:defs.bzl", "codex_rust_crate")
|
|
|
|
# Cargo's build.rs emits rustc-link-arg-bin so only the setup helper gets the
|
|
# asInvoker manifest. rules_rust warns on and drops that directive, so Bazel
|
|
# spells out the same per-binary linker contract here.
|
|
WINDOWS_SETUP_MANIFEST_RUSTC_FLAGS = select({
|
|
"@llvm//constraints/windows/abi:gnullvm": [
|
|
"-C",
|
|
"link-arg=$(location :codex-windows-sandbox-setup-manifest-resource)",
|
|
],
|
|
"@llvm//constraints/windows/abi:msvc": [
|
|
"-C",
|
|
"link-arg=/MANIFEST:EMBED",
|
|
"-C",
|
|
"link-arg=/MANIFESTINPUT:$(location :codex-windows-sandbox-setup.manifest)",
|
|
],
|
|
"//conditions:default": [],
|
|
})
|
|
|
|
# Copying build.rs's gnullvm /MANIFESTINPUT flags is not enough: lld-link
|
|
# shells out to mt.exe, but the supported gnullvm cross-build executes on
|
|
# Linux RBE. Compile the same RT_MANIFEST resource with hermetic LLVM instead.
|
|
# -no-preprocess does not expand RT_MANIFEST, so use its numeric type, 24.
|
|
# Keep the command on one line: Windows checkouts use CRLF, but Linux RBE runs it.
|
|
genrule(
|
|
name = "codex-windows-sandbox-setup-manifest-resource",
|
|
srcs = ["codex-windows-sandbox-setup.manifest"],
|
|
outs = ["codex-windows-sandbox-setup.manifest.res"],
|
|
cmd = " && ".join([
|
|
"printf '1 24 \"%s\"\\n' \"$(location :codex-windows-sandbox-setup.manifest)\" > \"$(@D)/codex-windows-sandbox-setup.manifest.rc\"",
|
|
"$(location @llvm//tools:llvm-rc) -no-preprocess \"$(@D)/codex-windows-sandbox-setup.manifest.rc\"",
|
|
]),
|
|
tools = ["@llvm//tools:llvm-rc"],
|
|
)
|
|
|
|
codex_rust_crate(
|
|
name = "windows-sandbox-rs",
|
|
binary_compile_data_extra = {
|
|
"codex-windows-sandbox-setup": select({
|
|
"@llvm//constraints/windows/abi:gnullvm": [":codex-windows-sandbox-setup-manifest-resource"],
|
|
"@llvm//constraints/windows/abi:msvc": ["codex-windows-sandbox-setup.manifest"],
|
|
"//conditions:default": [],
|
|
}),
|
|
},
|
|
binary_rustc_flags_extra = {
|
|
"codex-windows-sandbox-setup": WINDOWS_SETUP_MANIFEST_RUSTC_FLAGS,
|
|
},
|
|
binary_test_target_compatible_with = ["@platforms//os:windows"],
|
|
# Do not run build.rs under Bazel: rules_rust cannot translate its
|
|
# rustc-link-arg-bin directives, and the target-local equivalents above
|
|
# provide the link inputs and flags without the unsupported-directive warning.
|
|
build_script_enabled = False,
|
|
crate_name = "codex_windows_sandbox",
|
|
test_data_extra = [
|
|
":codex-command-runner",
|
|
":codex-windows-sandbox-setup",
|
|
],
|
|
)
|