From cfae44ae9c90dc070dba9702140b9e3f24043bc5 Mon Sep 17 00:00:00 2001
From: flurie <flurie@gmail.com>
Date: Tue, 1 Oct 2024 18:29:02 -0400
Subject: [PATCH 01/11] bazel: 7.1.2 -> 7.3.1

---
 .../build-managers/bazel/bazel_7/default.nix  | 474 +++++++++++-------
 .../bazel/bazel_7/test_source_sort.patch      |  12 +
 pkgs/top-level/all-packages.nix               |   4 +-
 3 files changed, 307 insertions(+), 183 deletions(-)
 create mode 100644 pkgs/development/tools/build-managers/bazel/bazel_7/test_source_sort.patch

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 661eb1a71aa9..4a457551785d 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -1,49 +1,52 @@
-{ stdenv
+{
+  stdenv,
   # nix tooling and utilities
-, callPackage
-, lib
-, fetchurl
-, makeWrapper
-, writeTextFile
-, substituteAll
-, writeShellApplication
-, makeBinaryWrapper
+  lib,
+  fetchurl,
+  makeWrapper,
+  writeTextFile,
+  substituteAll,
+  writeShellApplication,
+  makeBinaryWrapper,
+  autoPatchelfHook,
+  buildFHSEnv,
   # this package (through the fixpoint glass)
-, bazel_self
+  # TODO probably still need for tests at some point
+  bazel_self,
   # native build inputs
-, runtimeShell
-, zip
-, unzip
-, bash
-, coreutils
-, which
-, gawk
-, gnused
-, gnutar
-, gnugrep
-, gzip
-, findutils
-, diffutils
-, gnupatch
-, file
-, installShellFiles
-, lndir
-, python3
+  runtimeShell,
+  zip,
+  unzip,
+  bash,
+  coreutils,
+  which,
+  gawk,
+  gnused,
+  gnutar,
+  gnugrep,
+  gzip,
+  findutils,
+  diffutils,
+  gnupatch,
+  file,
+  installShellFiles,
+  lndir,
+  python3,
   # Apple dependencies
-, cctools
-, libcxx
-, sigtool
-, CoreFoundation
-, CoreServices
-, Foundation
-, IOKit
+  cctools,
+  libcxx,
+  sigtool,
+  CoreFoundation,
+  CoreServices,
+  Foundation,
+  IOKit,
   # Allow to independently override the jdks used to build and run respectively
-, buildJdk
-, runJdk
+  buildJdk,
+  runJdk,
   # Always assume all markers valid (this is needed because we remove markers; they are non-deterministic).
   # Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
-, enableNixHacks ? false
-, version ? "7.1.2"
+  enableNixHacks ? false,
+  version ? "7.3.1",
 }:
 
 let
@@ -51,27 +54,7 @@ let
 
   src = fetchurl {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-nPbtIxnIFpGdlwFe720MWULNGu1I4DxzuggV2VPtYas=";
-  };
-
-  # Use builtins.fetchurl to avoid IFD, in particular on hydra
-  #lockfile = builtins.fetchurl {
-  #  url = "https://raw.githubusercontent.com/bazelbuild/bazel/release-${version}/MODULE.bazel.lock";
-  #  sha256 = "sha256-5xPpCeWVKVp1s4RVce/GoW2+fH8vniz5G1MNI4uezpc=";
-  #};
-  # Use a local copy of the above lockfile to make ofborg happy.
-  lockfile = ./MODULE.bazel.lock;
-
-  # Two-in-one format
-  distDir = repoCache;
-  repoCache = callPackage ./bazel-repository-cache.nix {
-    inherit lockfile;
-
-    # We use the release tarball that already has everything bundled so we
-    # should not need any extra external deps. But our nonprebuilt java
-    # toolchains hack needs just one non bundled dep.
-    requiredDepNamePredicate = name:
-      null != builtins.match "rules_java~.*~toolchains~remote_java_tools" name;
+    hash = "sha256-8FAfkMn8dM1pM9vcWeF7jWJy1sCfi448QomFxYlxR8c=";
   };
 
   defaultShellUtils =
@@ -117,8 +100,126 @@ let
       unzip
       which
       zip
+      runJdk
+      makeWrapper
     ];
 
+  # Bootstrap an existing Bazel so we can vendor deps with vendor mode
+  bazel_bootstrap = stdenv.mkDerivation rec {
+    name = "bazel_bootstrap";
+    src = fetchurl {
+      url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-x86_64";
+      hash = "sha256-05fHtz47OilpOVYawB17VRVEDpycfYTIHBmwYCOyPjI=";
+    };
+
+    nativeBuildInputs = defaultShellUtils;
+    buildInputs = [
+      stdenv.cc.cc
+      autoPatchelfHook
+    ];
+
+    dontUnpack = true;
+    dontPatch = true;
+    dontBuild = true;
+    dontStrip = true;
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin
+      install -Dm755 $src $out/bin/bazel
+
+      runHook postInstall
+    '';
+
+    postFixup = ''
+      wrapProgram $out/bin/bazel \
+        --prefix PATH : ${lib.makeBinPath nativeBuildInputs}
+    '';
+  };
+
+  # The bootstrapped Bazel did not work on its own for vendoring, but a wrapped FHS did
+  bazel_fhs = buildFHSEnv {
+    name = "bazel";
+    targetPkgs = _: [ bazel_bootstrap ];
+    runScript = "bazel";
+  };
+
+  # A FOD that vendors the Bazel dependencies using Bazel's new vendor mode.
+  # See https://bazel.build/versions/7.3.0/external/vendor for details.
+  # Note that it may be possible to vendor less than the full set of deps in
+  # the future, as this is approximately 16GB.
+  bazel_deps = stdenv.mkDerivation {
+    name = "bazel_deps";
+    src = fetchurl {
+      url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
+      hash = "sha256-8FAfkMn8dM1pM9vcWeF7jWJy1sCfi448QomFxYlxR8c=";
+    };
+    inherit version;
+    sourceRoot = ".";
+    patches = [
+      # The repo rule that creates a manifest of the bazel source for testing
+      # the cli is not reproducible. This patch ensures that it is by sorting
+      # the results in the repo rule rather than the downstream genrule.
+      ./test_source_sort.patch
+    ];
+    patchFlags = [
+      "--no-backup-if-mismatch"
+      "-p1"
+    ];
+    nativeBuildInputs = [
+      unzip
+      bazel_fhs
+    ];
+    configurePhase = ''
+      runHook preConfigure
+
+      mkdir bazel_src
+      shopt -s dotglob extglob
+      mv !(bazel_src) bazel_src
+      mkdir vendor_dir
+
+      runHook postConfigure
+    '';
+    dontFixup = true;
+    buildPhase = ''
+      runHook preBuild
+      export HOME=$TMP
+      (cd bazel_src; ${bazel_fhs}/bin/bazel --server_javabase=${runJdk} mod deps --curses=no;
+      ${bazel_fhs}/bin/bazel --server_javabase=${runJdk} vendor \
+      --curses=no \
+      --vendor_dir ../vendor_dir \
+      --verbose_failures \
+      --experimental_strict_java_deps=off \
+      --strict_proto_deps=off \
+      --tool_java_runtime_version=local_jdk_21 \
+      --java_runtime_version=local_jdk_21 \
+      --tool_java_language_version=21 \
+      --java_language_version=21)
+
+      # Some post-fetch fixup is necessary, because the deps come with some
+      # baggage that is not reproducible. Luckily, this baggage does not factor
+      # into the final product, so removing it is enough.
+
+      # the GOCACHE is poisonous!
+      rm -rf vendor_dir/gazelle~~non_module_deps~bazel_gazelle_go_repository_cache/gocache
+
+      # so are .pyc files apparently
+      find vendor_dir -name "*.pyc" -type f -delete
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      mkdir -p $out/vendor_dir
+      cp -r --reflink=auto vendor_dir/* $out/vendor_dir
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = "sha256-xW+KZIsOGrDV7WIcg/elHpFEmfs1TfFky3bVqCdWr9k=";
+    outputHashAlgo = "sha256";
+
+  };
+
   defaultShellPath = lib.makeBinPath defaultShellUtils;
 
   bashWithDefaultShellUtilsSh = writeShellApplication {
@@ -174,87 +275,88 @@ stdenv.mkDerivation rec {
   inherit version src;
   inherit sourceRoot;
 
-  patches = [
-    # Remote java toolchains do not work on NixOS because they download binaries,
-    # so we need to use the @local_jdk//:jdk
-    # It could in theory be done by registering @local_jdk//:all toolchains,
-    # but these java toolchains still bundle binaries for ijar and stuff. So we
-    # need a nonprebult java toolchain (where ijar and stuff is built from
-    # sources).
-    # There is no such java toolchain, so we introduce one here.
-    # By providing no version information, the toolchain will set itself to the
-    # version of $JAVA_HOME/bin/java, just like the local_jdk does.
-    # To ensure this toolchain gets used, we can set
-    # --{,tool_}java_runtime_version=local_jdk and rely on the fact no java
-    # toolchain registered by default uses the local_jdk, making the selection
-    # unambiguous.
-    # This toolchain has the advantage that it can use any ambiant java jdk,
-    # not only a given, fixed version. It allows bazel to work correctly in any
-    # environment where JAVA_HOME is set to the right java version, like inside
-    # nix derivations.
-    # However, this patch breaks bazel hermeticity, by picking the ambiant java
-    # version instead of the more hermetic remote_jdk prebuilt binaries that
-    # rules_java provide by default. It also requires the user to have a
-    # JAVA_HOME set to the exact version required by the project.
-    # With more code, we could define java toolchains for all the java versions
-    # supported by the jdk as in rules_java's
-    # toolchains/local_java_repository.bzl, but this is not implemented here.
-    # To recover vanilla behavior, non NixOS users can set
-    # --{,tool_}java_runtime_version=remote_jdk, effectively reverting the
-    # effect of this patch and the fake system bazelrc.
-    ./java_toolchain.patch
+  patches =
+    [
+      # Remote java toolchains do not work on NixOS because they download binaries,
+      # so we need to use the @local_jdk//:jdk
+      # It could in theory be done by registering @local_jdk//:all toolchains,
+      # but these java toolchains still bundle binaries for ijar and stuff. So we
+      # need a nonprebult java toolchain (where ijar and stuff is built from
+      # sources).
+      # There is no such java toolchain, so we introduce one here.
+      # By providing no version information, the toolchain will set itself to the
+      # version of $JAVA_HOME/bin/java, just like the local_jdk does.
+      # To ensure this toolchain gets used, we can set
+      # --{,tool_}java_runtime_version=local_jdk and rely on the fact no java
+      # toolchain registered by default uses the local_jdk, making the selection
+      # unambiguous.
+      # This toolchain has the advantage that it can use any ambiant java jdk,
+      # not only a given, fixed version. It allows bazel to work correctly in any
+      # environment where JAVA_HOME is set to the right java version, like inside
+      # nix derivations.
+      # However, this patch breaks bazel hermeticity, by picking the ambiant java
+      # version instead of the more hermetic remote_jdk prebuilt binaries that
+      # rules_java provide by default. It also requires the user to have a
+      # JAVA_HOME set to the exact version required by the project.
+      # With more code, we could define java toolchains for all the java versions
+      # supported by the jdk as in rules_java's
+      # toolchains/local_java_repository.bzl, but this is not implemented here.
+      # To recover vanilla behavior, non NixOS users can set
+      # --{,tool_}java_runtime_version=remote_jdk, effectively reverting the
+      # effect of this patch and the fake system bazelrc.
+      ./java_toolchain.patch
 
-    # Bazel integrates with apple IOKit to inhibit and track system sleep.
-    # Inside the darwin sandbox, these API calls are blocked, and bazel
-    # crashes. It seems possible to allow these APIs inside the sandbox, but it
-    # feels simpler to patch bazel not to use it at all. So our bazel is
-    # incapable of preventing system sleep, which is a small price to pay to
-    # guarantee that it will always run in any nix context.
-    #
-    # See also ./bazel_darwin_sandbox.patch in bazel_5. That patch uses
-    # NIX_BUILD_TOP env var to conditionnally disable sleep features inside the
-    # sandbox.
-    #
-    # If you want to investigate the sandbox profile path,
-    # IORegisterForSystemPower can be allowed with
-    #
-    #     propagatedSandboxProfile = ''
-    #       (allow iokit-open (iokit-user-client-class "RootDomainUserClient"))
-    #     '';
-    #
-    # I do not know yet how to allow IOPMAssertion{CreateWithName,Release}
-    ./darwin_sleep.patch
+      # Bazel integrates with apple IOKit to inhibit and track system sleep.
+      # Inside the darwin sandbox, these API calls are blocked, and bazel
+      # crashes. It seems possible to allow these APIs inside the sandbox, but it
+      # feels simpler to patch bazel not to use it at all. So our bazel is
+      # incapable of preventing system sleep, which is a small price to pay to
+      # guarantee that it will always run in any nix context.
+      #
+      # See also ./bazel_darwin_sandbox.patch in bazel_5. That patch uses
+      # NIX_BUILD_TOP env var to conditionnally disable sleep features inside the
+      # sandbox.
+      #
+      # If you want to investigate the sandbox profile path,
+      # IORegisterForSystemPower can be allowed with
+      #
+      #     propagatedSandboxProfile = ''
+      #       (allow iokit-open (iokit-user-client-class "RootDomainUserClient"))
+      #     '';
+      #
+      # I do not know yet how to allow IOPMAssertion{CreateWithName,Release}
+      ./darwin_sleep.patch
 
-    # Fix DARWIN_XCODE_LOCATOR_COMPILE_COMMAND by removing multi-arch support.
-    # Nixpkgs toolcahins do not support that (yet?) and get confused.
-    # Also add an explicit /usr/bin prefix that will be patched below.
-    ./xcode_locator.patch
+      # Fix DARWIN_XCODE_LOCATOR_COMPILE_COMMAND by removing multi-arch support.
+      # Nixpkgs toolcahins do not support that (yet?) and get confused.
+      # Also add an explicit /usr/bin prefix that will be patched below.
+      ./xcode_locator.patch
 
-    # On Darwin, the last argument to gcc is coming up as an empty string. i.e: ''
-    # This is breaking the build of any C target. This patch removes the last
-    # argument if it's found to be an empty string.
-    ../trim-last-argument-to-gcc-if-empty.patch
+      # On Darwin, the last argument to gcc is coming up as an empty string. i.e: ''
+      # This is breaking the build of any C target. This patch removes the last
+      # argument if it's found to be an empty string.
+      ../trim-last-argument-to-gcc-if-empty.patch
 
-    # --experimental_strict_action_env (which may one day become the default
-    # see bazelbuild/bazel#2574) hardcodes the default
-    # action environment to a non hermetic value (e.g. "/usr/local/bin").
-    # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
-    # So we are replacing this bazel paths by defaultShellPath,
-    # improving hermeticity and making it work in nixos.
-    (substituteAll {
-      src = ../strict_action_env.patch;
-      strictActionEnvPatch = defaultShellPath;
-    })
+      # --experimental_strict_action_env (which may one day become the default
+      # see bazelbuild/bazel#2574) hardcodes the default
+      # action environment to a non hermetic value (e.g. "/usr/local/bin").
+      # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
+      # So we are replacing this bazel paths by defaultShellPath,
+      # improving hermeticity and making it work in nixos.
+      (substituteAll {
+        src = ../strict_action_env.patch;
+        strictActionEnvPatch = defaultShellPath;
+      })
 
-    # bazel reads its system bazelrc in /etc
-    # override this path to a builtin one
-    (substituteAll {
-      src = ../bazel_rc.patch;
-      bazelSystemBazelRCPath = bazelRC;
-    })
-  ]
-  # See enableNixHacks argument above.
-  ++ lib.optional enableNixHacks ./nix-hacks.patch;
+      # bazel reads its system bazelrc in /etc
+      # override this path to a builtin one
+      (substituteAll {
+        src = ../bazel_rc.patch;
+        bazelSystemBazelRCPath = bazelRC;
+      })
+    ]
+    # See enableNixHacks argument above.
+    ++ lib.optional enableNixHacks ./nix-hacks.patch;
 
   postPatch =
     let
@@ -339,10 +441,6 @@ stdenv.mkDerivation rec {
           -e 's!/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
           -e 's!shasum -a 256!sha256sum!g'
 
-        # Augment bundled repository_cache with our extra paths
-        ${lndir}/bin/lndir ${repoCache}/content_addressable \
-          $PWD/derived/repository_cache/content_addressable
-
         # Add required flags to bazel command line.
         # XXX: It would suit a bazelrc file better, but I found no way to pass it.
         #      It seems that bazel bootstrapping ignores it.
@@ -350,15 +448,16 @@ stdenv.mkDerivation rec {
         sedVerbose compile.sh \
           -e "/bazel_build /a\  --verbose_failures \\\\" \
           -e "/bazel_build /a\  --curses=no \\\\" \
-          -e "/bazel_build /a\  --features=-layering_check \\\\" \
-          -e "/bazel_build /a\  --experimental_strict_java_deps=off \\\\" \
-          -e "/bazel_build /a\  --strict_proto_deps=off \\\\" \
           -e "/bazel_build /a\  --toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type' \\\\" \
-          -e "/bazel_build /a\  --tool_java_runtime_version=local_jdk_17 \\\\" \
-          -e "/bazel_build /a\  --java_runtime_version=local_jdk_17 \\\\" \
-          -e "/bazel_build /a\  --tool_java_language_version=17 \\\\" \
-          -e "/bazel_build /a\  --java_language_version=17 \\\\" \
+          -e "/bazel_build /a\  --tool_java_runtime_version=local_jdk_21 \\\\" \
+          -e "/bazel_build /a\  --java_runtime_version=local_jdk_21 \\\\" \
+          -e "/bazel_build /a\  --tool_java_language_version=21 \\\\" \
+          -e "/bazel_build /a\  --java_language_version=21 \\\\" \
           -e "/bazel_build /a\  --extra_toolchains=@bazel_tools//tools/jdk:all \\\\" \
+          -e "/bazel_build /a\  --vendor_dir=../vendor_dir \\\\" \
+          -e "/bazel_build /a\  --repository_disable_download \\\\" \
+          -e "/bazel_build /a\  --announce_rc \\\\" \
+          -e "/bazel_build /a\  --nobuild_python_zip \\\\" \
 
         # Also build parser_deploy.jar with bootstrap bazel
         # TODO: Turn into a proper patch
@@ -407,25 +506,30 @@ stdenv.mkDerivation rec {
   # Bazel starts a local server and needs to bind a local address.
   __darwinAllowLocalNetworking = true;
 
-  buildInputs = [ buildJdk bashWithDefaultShellUtils ] ++ defaultShellUtils;
+  buildInputs = [
+    buildJdk
+    bashWithDefaultShellUtils
+  ] ++ defaultShellUtils;
 
   # when a command can’t be found in a bazel build, you might also
   # need to add it to `defaultShellPath`.
-  nativeBuildInputs = [
-    installShellFiles
-    makeWrapper
-    python3
-    unzip
-    which
-    zip
-    python3.pkgs.absl-py # Needed to build fish completion
-  ] ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-    cctools
-    libcxx
-    Foundation
-    CoreFoundation
-    CoreServices
-  ];
+  nativeBuildInputs =
+    [
+      installShellFiles
+      makeWrapper
+      python3
+      unzip
+      which
+      zip
+      python3.pkgs.absl-py # Needed to build fish completion
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
+      cctools
+      libcxx
+      Foundation
+      CoreFoundation
+      CoreServices
+    ];
 
   # Bazel makes extensive use of symlinks in the WORKSPACE.
   # This causes problems with infinite symlinks if the build output is in the same location as the
@@ -437,12 +541,15 @@ stdenv.mkDerivation rec {
     mkdir bazel_src
     shopt -s dotglob extglob
     mv !(bazel_src) bazel_src
+    # Augment bundled repository_cache with our extra paths
+    mkdir vendor_dir
+    ${lndir}/bin/lndir ${bazel_deps}/vendor_dir vendor_dir
+    rm vendor_dir/VENDOR.bazel
+    find vendor_dir -maxdepth 1 -type d -printf "pin(\"@@%P\")\n" > vendor_dir/VENDOR.bazel
   '';
   buildPhase = ''
     runHook preBuild
-
-    # Increasing memory during compilation might be necessary.
-    # export BAZEL_JAVAC_OPTS="-J-Xmx2g -J-Xms200m"
+    export HOME=$(mktemp -d)
 
     # If EMBED_LABEL isn't set, it'd be auto-detected from CHANGELOG.md
     # and `git rev-parse --short HEAD` which would result in
@@ -452,6 +559,7 @@ stdenv.mkDerivation rec {
     # Note that .bazelversion is always correct and is based on bazel-*
     # executable name, version checks should work fine
     export EMBED_LABEL="${version}- (@non-git)"
+
     echo "Stage 1 - Running bazel bootstrap script"
     ${bash}/bin/bash ./bazel_src/compile.sh
 
@@ -554,16 +662,18 @@ stdenv.mkDerivation rec {
 
   # Save paths to hardcoded dependencies so Nix can detect them.
   # This is needed because the templates get tar’d up into a .jar.
-  postFixup = ''
-    mkdir -p $out/nix-support
-    echo "${defaultShellPath}" >> $out/nix-support/depends
-    # The string literal specifying the path to the bazel-rc file is sometimes
-    # stored non-contiguously in the binary due to gcc optimisations, which leads
-    # Nix to miss the hash when scanning for dependencies
-    echo "${bazelRC}" >> $out/nix-support/depends
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    echo "${cctools}" >> $out/nix-support/depends
-  '';
+  postFixup =
+    ''
+      mkdir -p $out/nix-support
+      echo "${defaultShellPath}" >> $out/nix-support/depends
+      # The string literal specifying the path to the bazel-rc file is sometimes
+      # stored non-contiguously in the binary due to gcc optimisations, which leads
+      # Nix to miss the hash when scanning for dependencies
+      echo "${bazelRC}" >> $out/nix-support/depends
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      echo "${cctools}" >> $out/nix-support/depends
+    '';
 
   dontStrip = true;
   dontPatchELF = true;
@@ -571,14 +681,16 @@ stdenv.mkDerivation rec {
   passthru = {
     # Additional tests that check bazel’s functionality. Execute
     #
-    #     nix-build . -A bazel_7.tests
+    #     nix-build . -A bazel_73.tests
     #
     # in the nixpkgs checkout root to exercise them locally.
-    tests = callPackage ./tests.nix {
-      inherit Foundation bazel_self lockfile repoCache;
-    };
+    # tests = callPackage ./tests.nix {
+    #   inherit Foundation bazel_self lockfile repoCache;
+    # };
+    # TODO tests have not been updated yet and will likely need a rewrite
+    # tests = callPackage ./tests.nix { inherit Foundation bazel_deps bazel_self; };
 
     # For ease of debugging
-    inherit distDir repoCache lockfile;
+    inherit bazel_deps bazel_fhs;
   };
 }
diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/test_source_sort.patch b/pkgs/development/tools/build-managers/bazel/bazel_7/test_source_sort.patch
new file mode 100644
index 000000000000..3ddd0d109e00
--- /dev/null
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/test_source_sort.patch
@@ -0,0 +1,12 @@
+--- a/src/test/shell/bazel/list_source_repository.bzl
++++ b/src/test/shell/bazel/list_source_repository.bzl
+@@ -32,7 +32,8 @@ def _impl(rctx):
+     if "SRCS_EXCLUDES" in rctx.os.environ:
+         srcs_excludes = rctx.os.environ["SRCS_EXCLUDES"]
+     r = rctx.execute(["find", "-L", str(workspace), "-type", "f"])
+-    rctx.file("find.result.raw", r.stdout.replace(str(workspace) + "/", ""))
++    stdout = "\n".join(sorted(r.stdout.splitlines()))
++    rctx.file("find.result.raw", stdout.replace(str(workspace) + "/", ""))
+     rctx.file("BUILD", """
+ genrule(
+   name = "sources",
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1463ac224a84..e794ba9307cd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -17143,8 +17143,8 @@ with pkgs;
   bazel_7 = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_7 {
     inherit (darwin) sigtool;
     inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation CoreServices Foundation IOKit;
-    buildJdk = jdk17_headless;
-    runJdk = jdk17_headless;
+    buildJdk = jdk21_headless;
+    runJdk = jdk21_headless;
     stdenv = if stdenv.hostPlatform.isDarwin then darwin.apple_sdk_11_0.stdenv
       else if stdenv.cc.isClang then llvmPackages.stdenv
       else stdenv;

From 95a4a50c0907d37a39672e0884e2a8ffa3192732 Mon Sep 17 00:00:00 2001
From: Alexander Flurie <alex@flurie.net>
Date: Sat, 7 Sep 2024 11:42:09 -0400
Subject: [PATCH 02/11] make bazel bootstrap multi-platform

---
 .../tools/build-managers/bazel/bazel_7/default.nix  | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 4a457551785d..40be93c5b6b7 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -107,9 +107,18 @@ let
   # Bootstrap an existing Bazel so we can vendor deps with vendor mode
   bazel_bootstrap = stdenv.mkDerivation rec {
     name = "bazel_bootstrap";
-    src = fetchurl {
+    src = if stdenv.hostPlatform.system == "x86_64-linux" then fetchurl {
       url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-x86_64";
       hash = "sha256-05fHtz47OilpOVYawB17VRVEDpycfYTIHBmwYCOyPjI=";
+    } else if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
+      url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-arm64";
+      hash = "sha256-olrlIia/oXWleXp12E+LGXv+F1m4/S4jj/t7p2/xGdM=";
+    } else if stdenv.hostPlatform.system == "x86_64-darwin" then fetchurl {
+      url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-darwin-x86_64";
+      hash = "sha256-e5RRZTrhzoTMk2NRRl9m2K5+h1/+5mJNW2vF8h0uftc=";
+    } else fetchurl { # stdenv.hostPlatform.system == "aarch64-darwin"
+        url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-darwin-arm64";
+        hash = "sha256-ciNBdqm+cIrNR1Wu2wt+wGGb6m9i9aE8LhRqL4BJ0Y4=";
     };
 
     nativeBuildInputs = defaultShellUtils;
@@ -681,7 +690,7 @@ stdenv.mkDerivation rec {
   passthru = {
     # Additional tests that check bazel’s functionality. Execute
     #
-    #     nix-build . -A bazel_73.tests
+    #     nix-build . -A bazel_7.tests
     #
     # in the nixpkgs checkout root to exercise them locally.
     # tests = callPackage ./tests.nix {

From 8e8d4a6c365d752d4b1601817cc5a7e97bb96b26 Mon Sep 17 00:00:00 2001
From: Alexander Flurie <alex@flurie.net>
Date: Sat, 7 Sep 2024 13:34:51 -0400
Subject: [PATCH 03/11] set meta.sourceProvenance for bazel bootstrap

---
 .../development/tools/build-managers/bazel/bazel_7/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 40be93c5b6b7..28b247bf00e6 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -107,6 +107,7 @@ let
   # Bootstrap an existing Bazel so we can vendor deps with vendor mode
   bazel_bootstrap = stdenv.mkDerivation rec {
     name = "bazel_bootstrap";
+
     src = if stdenv.hostPlatform.system == "x86_64-linux" then fetchurl {
       url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-x86_64";
       hash = "sha256-05fHtz47OilpOVYawB17VRVEDpycfYTIHBmwYCOyPjI=";
@@ -144,6 +145,8 @@ let
       wrapProgram $out/bin/bazel \
         --prefix PATH : ${lib.makeBinPath nativeBuildInputs}
     '';
+
+    meta.sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 
   # The bootstrapped Bazel did not work on its own for vendoring, but a wrapped FHS did

From 76bf576d03c5187f3c57335c3222d665ba2e0123 Mon Sep 17 00:00:00 2001
From: Alexander Flurie <alex@flurie.net>
Date: Tue, 10 Sep 2024 18:08:43 -0400
Subject: [PATCH 04/11] use camelCase for FODs, fix deps FOD

---
 .../build-managers/bazel/bazel_7/default.nix  | 32 +++++++++----------
 1 file changed, 15 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 28b247bf00e6..886d17acb583 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -149,8 +149,7 @@ let
     meta.sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 
-  # The bootstrapped Bazel did not work on its own for vendoring, but a wrapped FHS did
-  bazel_fhs = buildFHSEnv {
+  bazelFhs = buildFHSEnv {
     name = "bazel";
     targetPkgs = _: [ bazel_bootstrap ];
     runScript = "bazel";
@@ -160,13 +159,9 @@ let
   # See https://bazel.build/versions/7.3.0/external/vendor for details.
   # Note that it may be possible to vendor less than the full set of deps in
   # the future, as this is approximately 16GB.
-  bazel_deps = stdenv.mkDerivation {
-    name = "bazel_deps";
-    src = fetchurl {
-      url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-      hash = "sha256-8FAfkMn8dM1pM9vcWeF7jWJy1sCfi448QomFxYlxR8c=";
-    };
-    inherit version;
+  bazelDeps = stdenv.mkDerivation {
+    name = "bazelDeps";
+    inherit src version;
     sourceRoot = ".";
     patches = [
       # The repo rule that creates a manifest of the bazel source for testing
@@ -180,7 +175,7 @@ let
     ];
     nativeBuildInputs = [
       unzip
-      bazel_fhs
+      bazelFhs
     ];
     configurePhase = ''
       runHook preConfigure
@@ -196,8 +191,8 @@ let
     buildPhase = ''
       runHook preBuild
       export HOME=$TMP
-      (cd bazel_src; ${bazel_fhs}/bin/bazel --server_javabase=${runJdk} mod deps --curses=no;
-      ${bazel_fhs}/bin/bazel --server_javabase=${runJdk} vendor \
+      (cd bazel_src; ${bazelFhs}/bin/bazel --server_javabase=${runJdk} mod deps --curses=no;
+      ${bazelFhs}/bin/bazel --server_javabase=${runJdk} vendor \
       --curses=no \
       --vendor_dir ../vendor_dir \
       --verbose_failures \
@@ -215,7 +210,10 @@ let
       # the GOCACHE is poisonous!
       rm -rf vendor_dir/gazelle~~non_module_deps~bazel_gazelle_go_repository_cache/gocache
 
-      # so are .pyc files apparently
+      # as is the go versions file (changes when new versions show up)
+      rm -f vendor_dir/rules_go~~go_sdk~go_default_sdk/versions.json
+
+      # and so are .pyc files
       find vendor_dir -name "*.pyc" -type f -delete
 
       runHook postBuild
@@ -227,7 +225,7 @@ let
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-xW+KZIsOGrDV7WIcg/elHpFEmfs1TfFky3bVqCdWr9k=";
+    outputHash = "sha256-GjktM25K4OPrww1o9jB38h0FwJrcJo7TR0x0owZV9I0=";
     outputHashAlgo = "sha256";
 
   };
@@ -555,7 +553,7 @@ stdenv.mkDerivation rec {
     mv !(bazel_src) bazel_src
     # Augment bundled repository_cache with our extra paths
     mkdir vendor_dir
-    ${lndir}/bin/lndir ${bazel_deps}/vendor_dir vendor_dir
+    ${lndir}/bin/lndir ${bazelDeps}/vendor_dir vendor_dir
     rm vendor_dir/VENDOR.bazel
     find vendor_dir -maxdepth 1 -type d -printf "pin(\"@@%P\")\n" > vendor_dir/VENDOR.bazel
   '';
@@ -700,9 +698,9 @@ stdenv.mkDerivation rec {
     #   inherit Foundation bazel_self lockfile repoCache;
     # };
     # TODO tests have not been updated yet and will likely need a rewrite
-    # tests = callPackage ./tests.nix { inherit Foundation bazel_deps bazel_self; };
+    # tests = callPackage ./tests.nix { inherit Foundation bazelDeps bazel_self; };
 
     # For ease of debugging
-    inherit bazel_deps bazel_fhs;
+    inherit bazelDeps bazelFhs;
   };
 }

From 3de687a6b6faaed2ecbde08b3de5e63262b7ead3 Mon Sep 17 00:00:00 2001
From: flurie <flurie@gmail.com>
Date: Mon, 16 Sep 2024 23:52:29 -0400
Subject: [PATCH 05/11] get linux/aarch64-darwin builds working

---
 .../build-managers/bazel/bazel_7/default.nix  | 182 ++++++++++--------
 1 file changed, 102 insertions(+), 80 deletions(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 886d17acb583..9c409779aeb0 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -100,33 +100,40 @@ let
       unzip
       which
       zip
-      runJdk
       makeWrapper
     ];
 
   # Bootstrap an existing Bazel so we can vendor deps with vendor mode
-  bazel_bootstrap = stdenv.mkDerivation rec {
-    name = "bazel_bootstrap";
+  bazelBootstrap = stdenv.mkDerivation rec {
+    name = "bazelBootstrap";
 
-    src = if stdenv.hostPlatform.system == "x86_64-linux" then fetchurl {
-      url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-x86_64";
-      hash = "sha256-05fHtz47OilpOVYawB17VRVEDpycfYTIHBmwYCOyPjI=";
-    } else if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
-      url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-arm64";
-      hash = "sha256-olrlIia/oXWleXp12E+LGXv+F1m4/S4jj/t7p2/xGdM=";
-    } else if stdenv.hostPlatform.system == "x86_64-darwin" then fetchurl {
-      url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-darwin-x86_64";
-      hash = "sha256-e5RRZTrhzoTMk2NRRl9m2K5+h1/+5mJNW2vF8h0uftc=";
-    } else fetchurl { # stdenv.hostPlatform.system == "aarch64-darwin"
-        url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-darwin-arm64";
-        hash = "sha256-ciNBdqm+cIrNR1Wu2wt+wGGb6m9i9aE8LhRqL4BJ0Y4=";
-    };
+    src =
+      if stdenv.hostPlatform.system == "x86_64-linux" then
+        fetchurl {
+          url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-x86_64";
+          hash = "sha256-05fHtz47OilpOVYawB17VRVEDpycfYTIHBmwYCOyPjI=";
+        }
+      else if stdenv.hostPlatform.system == "aarch64-linux" then
+        fetchurl {
+          url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel_nojdk-${version}-linux-arm64";
+          hash = "sha256-olrlIia/oXWleXp12E+LGXv+F1m4/S4jj/t7p2/xGdM=";
+        }
+      else if stdenv.hostPlatform.system == "x86_64-darwin" then
+        fetchurl {
+          url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-darwin-x86_64";
+          hash = "sha256-e5RRZTrhzoTMk2NRRl9m2K5+h1/+5mJNW2vF8h0uftc=";
+        }
+      else
+        fetchurl {
+          # stdenv.hostPlatform.system == "aarch64-darwin"
+          url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-darwin-arm64";
+          hash = "sha256-mB+CpHC60TSTIrb1HJxv+gqikdqxAU+sQRVDwS5mHf8=";
+        };
 
     nativeBuildInputs = defaultShellUtils;
     buildInputs = [
       stdenv.cc.cc
-      autoPatchelfHook
-    ];
+    ] ++ lib.optional (!stdenv.hostPlatform.isDarwin) autoPatchelfHook;
 
     dontUnpack = true;
     dontPatch = true;
@@ -151,7 +158,7 @@ let
 
   bazelFhs = buildFHSEnv {
     name = "bazel";
-    targetPkgs = _: [ bazel_bootstrap ];
+    targetPkgs = _: [ bazelBootstrap ];
     runScript = "bazel";
   };
 
@@ -159,76 +166,90 @@ let
   # See https://bazel.build/versions/7.3.0/external/vendor for details.
   # Note that it may be possible to vendor less than the full set of deps in
   # the future, as this is approximately 16GB.
-  bazelDeps = stdenv.mkDerivation {
-    name = "bazelDeps";
-    inherit src version;
-    sourceRoot = ".";
-    patches = [
-      # The repo rule that creates a manifest of the bazel source for testing
-      # the cli is not reproducible. This patch ensures that it is by sorting
-      # the results in the repo rule rather than the downstream genrule.
-      ./test_source_sort.patch
-    ];
-    patchFlags = [
-      "--no-backup-if-mismatch"
-      "-p1"
-    ];
-    nativeBuildInputs = [
-      unzip
-      bazelFhs
-    ];
-    configurePhase = ''
-      runHook preConfigure
+  bazelDeps =
+    let
+      bazelForDeps = if stdenv.hostPlatform.isDarwin then bazelBootstrap else bazelFhs;
+    in
+    stdenv.mkDerivation {
+      name = "bazelDeps";
+      inherit src version;
+      sourceRoot = ".";
+      patches = [
+        # The repo rule that creates a manifest of the bazel source for testing
+        # the cli is not reproducible. This patch ensures that it is by sorting
+        # the results in the repo rule rather than the downstream genrule.
+        ./test_source_sort.patch
+      ];
+      patchFlags = [
+        "--no-backup-if-mismatch"
+        "-p1"
+      ];
+      nativeBuildInputs = [
+        unzip
+        runJdk
+        bazelForDeps
+      ];
+      configurePhase = ''
+        runHook preConfigure
 
-      mkdir bazel_src
-      shopt -s dotglob extglob
-      mv !(bazel_src) bazel_src
-      mkdir vendor_dir
+        mkdir bazel_src
+        shopt -s dotglob extglob
+        mv !(bazel_src) bazel_src
+        mkdir vendor_dir
 
-      runHook postConfigure
-    '';
-    dontFixup = true;
-    buildPhase = ''
-      runHook preBuild
-      export HOME=$TMP
-      (cd bazel_src; ${bazelFhs}/bin/bazel --server_javabase=${runJdk} mod deps --curses=no;
-      ${bazelFhs}/bin/bazel --server_javabase=${runJdk} vendor \
-      --curses=no \
-      --vendor_dir ../vendor_dir \
-      --verbose_failures \
-      --experimental_strict_java_deps=off \
-      --strict_proto_deps=off \
-      --tool_java_runtime_version=local_jdk_21 \
-      --java_runtime_version=local_jdk_21 \
-      --tool_java_language_version=21 \
-      --java_language_version=21)
+        runHook postConfigure
+      '';
+      dontFixup = true;
+      buildPhase = ''
+        runHook preBuild
+        export HOME=$TMP
+        (cd bazel_src; ${bazelForDeps}/bin/bazel --server_javabase=${runJdk} mod deps --curses=no;
+        ${bazelForDeps}/bin/bazel --server_javabase=${runJdk} vendor src:bazel_nojdk \
+        --curses=no \
+        --vendor_dir ../vendor_dir \
+        --verbose_failures \
+        --experimental_strict_java_deps=off \
+        --strict_proto_deps=off \
+        --tool_java_runtime_version=local_jdk_21 \
+        --java_runtime_version=local_jdk_21 \
+        --tool_java_language_version=21 \
+        --java_language_version=21)
 
-      # Some post-fetch fixup is necessary, because the deps come with some
-      # baggage that is not reproducible. Luckily, this baggage does not factor
-      # into the final product, so removing it is enough.
+        # Some post-fetch fixup is necessary, because the deps come with some
+        # baggage that is not reproducible. Luckily, this baggage does not factor
+        # into the final product, so removing it is enough.
 
-      # the GOCACHE is poisonous!
-      rm -rf vendor_dir/gazelle~~non_module_deps~bazel_gazelle_go_repository_cache/gocache
+        # the GOCACHE is poisonous!
+        rm -rf vendor_dir/gazelle~~non_module_deps~bazel_gazelle_go_repository_cache/gocache
 
-      # as is the go versions file (changes when new versions show up)
-      rm -f vendor_dir/rules_go~~go_sdk~go_default_sdk/versions.json
+        # as is the go versions file (changes when new versions show up)
+        rm -f vendor_dir/rules_go~~go_sdk~go_default_sdk/versions.json
 
-      # and so are .pyc files
-      find vendor_dir -name "*.pyc" -type f -delete
+        # and so are .pyc files
+        find vendor_dir -name "*.pyc" -type f -delete
 
-      runHook postBuild
-    '';
+        runHook postBuild
+      '';
 
-    installPhase = ''
-      mkdir -p $out/vendor_dir
-      cp -r --reflink=auto vendor_dir/* $out/vendor_dir
-    '';
+      installPhase = ''
+        mkdir -p $out/vendor_dir
+        cp -r --reflink=auto vendor_dir/* $out/vendor_dir
+      '';
 
-    outputHashMode = "recursive";
-    outputHash = "sha256-GjktM25K4OPrww1o9jB38h0FwJrcJo7TR0x0owZV9I0=";
-    outputHashAlgo = "sha256";
+      outputHashMode = "recursive";
+      outputHash =
+        if stdenv.hostPlatform.system == "x86_64-linux" then
+          "sha256-GjktM25K4OPrww1o9jB38h0FwJrcJo7TR0x0owZV9I0="
+        else if stdenv.hostPlatform.system == "aarch64-linux" then
+          "sha256-T7vVWLlRzhaWneKMgMdgjUpBwRuGZ9ZFtD2AQvH9krI="
+        else if stdenv.hostPlatform.system == "aarch64-darwin" then
+          "sha256-zv39lLMwfOr0MfK8dZ0alEwXpWdf97XEc6ciAoO4OK0="
+        else
+          # x86_64-darwin
+          lib.fakeSha256;
+      outputHashAlgo = "sha256";
 
-  };
+    };
 
   defaultShellPath = lib.makeBinPath defaultShellUtils;
 
@@ -647,6 +668,7 @@ stdenv.mkDerivation rec {
     #!${runtimeShell} -e
     exit 1
     EOF
+
     chmod +x tools/bazel
 
     # first call should fail if tools/bazel is used
@@ -701,6 +723,6 @@ stdenv.mkDerivation rec {
     # tests = callPackage ./tests.nix { inherit Foundation bazelDeps bazel_self; };
 
     # For ease of debugging
-    inherit bazelDeps bazelFhs;
+    inherit bazelDeps bazelFhs bazelBootstrap;
   };
 }

From bee45a2c281a40246b2993b4c03c20f2a5e937bc Mon Sep 17 00:00:00 2001
From: flurie <flurie@gmail.com>
Date: Tue, 17 Sep 2024 09:08:15 -0400
Subject: [PATCH 06/11] correct x86_64-linux deps sha

---
 pkgs/development/tools/build-managers/bazel/bazel_7/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 9c409779aeb0..049b3e8c31b3 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -239,7 +239,7 @@ let
       outputHashMode = "recursive";
       outputHash =
         if stdenv.hostPlatform.system == "x86_64-linux" then
-          "sha256-GjktM25K4OPrww1o9jB38h0FwJrcJo7TR0x0owZV9I0="
+          "sha256-ugi2F0xTDVWDCYKknSk3dTbnI78WluDMq4QvlLWtCts="
         else if stdenv.hostPlatform.system == "aarch64-linux" then
           "sha256-T7vVWLlRzhaWneKMgMdgjUpBwRuGZ9ZFtD2AQvH9krI="
         else if stdenv.hostPlatform.system == "aarch64-darwin" then

From 77c941be7f5a88d0bbf8f65fd17bb3c361a8b43a Mon Sep 17 00:00:00 2001
From: flurie <flurie@gmail.com>
Date: Tue, 1 Oct 2024 17:59:55 -0400
Subject: [PATCH 07/11] fix deps and hashes for darwin

---
 .../tools/build-managers/bazel/bazel_7/default.nix     | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 049b3e8c31b3..d12218cdddb6 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -121,7 +121,7 @@ let
       else if stdenv.hostPlatform.system == "x86_64-darwin" then
         fetchurl {
           url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-darwin-x86_64";
-          hash = "sha256-e5RRZTrhzoTMk2NRRl9m2K5+h1/+5mJNW2vF8h0uftc=";
+          hash = "sha256-LraN6MSVJQ3NzkyeLl5LvGxf+VNDJiVo/dVJIkyF1jU=";
         }
       else
         fetchurl {
@@ -228,6 +228,10 @@ let
         # and so are .pyc files
         find vendor_dir -name "*.pyc" -type f -delete
 
+        # bazel-external is auto-generated and should be removed
+        # see https://bazel.build/external/vendor#vendor-symlinks for more details
+        rm vendor_dir/bazel-external 
+
         runHook postBuild
       '';
 
@@ -243,10 +247,10 @@ let
         else if stdenv.hostPlatform.system == "aarch64-linux" then
           "sha256-T7vVWLlRzhaWneKMgMdgjUpBwRuGZ9ZFtD2AQvH9krI="
         else if stdenv.hostPlatform.system == "aarch64-darwin" then
-          "sha256-zv39lLMwfOr0MfK8dZ0alEwXpWdf97XEc6ciAoO4OK0="
+          "sha256-E6j31Sl+aGs6+Xdx+c0Xi6ryfYZ/ms5/HzIyc3QpMHY="
         else
           # x86_64-darwin
-          lib.fakeSha256;
+          "sha256-VVuNGY4+SFDhcv9iEo8JToYPzqk9NQCrYlLhhae89MM=";
       outputHashAlgo = "sha256";
 
     };

From bd5023c4ea26c08d8e702ae9099e421e2f1e3654 Mon Sep 17 00:00:00 2001
From: flurie <flurie@gmail.com>
Date: Tue, 1 Oct 2024 18:56:04 -0400
Subject: [PATCH 08/11] fix deps hashes for linux

---
 .../tools/build-managers/bazel/bazel_7/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index d12218cdddb6..bcdfc9397192 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -243,9 +243,9 @@ let
       outputHashMode = "recursive";
       outputHash =
         if stdenv.hostPlatform.system == "x86_64-linux" then
-          "sha256-ugi2F0xTDVWDCYKknSk3dTbnI78WluDMq4QvlLWtCts="
+          "sha256-II5R2YjaIejcO4Topdcz1H268eplYsYrW2oLJHKEkYw="
         else if stdenv.hostPlatform.system == "aarch64-linux" then
-          "sha256-T7vVWLlRzhaWneKMgMdgjUpBwRuGZ9ZFtD2AQvH9krI="
+          "sha256-n8RMKf8OxJsEkcxLe7xZgMu9RyeU58NESFF9F0nLNC4="
         else if stdenv.hostPlatform.system == "aarch64-darwin" then
           "sha256-E6j31Sl+aGs6+Xdx+c0Xi6ryfYZ/ms5/HzIyc3QpMHY="
         else

From 46016bada3730c22055eb010818024ff46fd96e6 Mon Sep 17 00:00:00 2001
From: flurie <flurie@gmail.com>
Date: Tue, 1 Oct 2024 19:59:27 -0400
Subject: [PATCH 09/11] fix whitespace

---
 pkgs/development/tools/build-managers/bazel/bazel_7/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index bcdfc9397192..7772413cee04 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -230,7 +230,7 @@ let
 
         # bazel-external is auto-generated and should be removed
         # see https://bazel.build/external/vendor#vendor-symlinks for more details
-        rm vendor_dir/bazel-external 
+        rm vendor_dir/bazel-external
 
         runHook postBuild
       '';

From 6aae06b8ce27bc07bd62de7e20d8da44af521295 Mon Sep 17 00:00:00 2001
From: flurie <flurie@gmail.com>
Date: Wed, 2 Oct 2024 11:38:46 -0400
Subject: [PATCH 10/11] use mktemp instead of TMP for deps

---
 pkgs/development/tools/build-managers/bazel/bazel_7/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 7772413cee04..703f25e34d96 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -202,7 +202,7 @@ let
       dontFixup = true;
       buildPhase = ''
         runHook preBuild
-        export HOME=$TMP
+        export HOME=$(mktemp -d)
         (cd bazel_src; ${bazelForDeps}/bin/bazel --server_javabase=${runJdk} mod deps --curses=no;
         ${bazelForDeps}/bin/bazel --server_javabase=${runJdk} vendor src:bazel_nojdk \
         --curses=no \

From 097532a3ccd20a41bb3dd5bc76013a7d9be0ad2f Mon Sep 17 00:00:00 2001
From: flurie <flurie@gmail.com>
Date: Sun, 20 Oct 2024 16:11:42 -0400
Subject: [PATCH 11/11] add libtool to darwin bazel deps

---
 .../development/tools/build-managers/bazel/bazel_7/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
index 703f25e34d96..149f6bcd533d 100644
--- a/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_7/default.nix
@@ -35,6 +35,7 @@
   # Apple dependencies
   cctools,
   libcxx,
+  libtool,
   sigtool,
   CoreFoundation,
   CoreServices,
@@ -188,7 +189,7 @@ let
         unzip
         runJdk
         bazelForDeps
-      ];
+      ] ++ lib.optional (stdenv.hostPlatform.isDarwin) libtool;
       configurePhase = ''
         runHook preConfigure