gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

envoy: fix deps fetch by disabling bzlmod in empty-workspace sync

Browse Source 
The preInstall phase of the deps derivation ran `bazel fetch` and
`bazel sync` in an empty directory with bzlmod enabled. This pulled
rules_jvm_external from the Bazel Central Registry, which tried to
execute a coursier GraalVM native binary that cannot run in the Nix
sandbox.

Since envoy itself uses --noenable_bzlmod, BCR modules are not needed.
Replace the two commands with a single `bazel sync --noenable_bzlmod`
over an empty WORKSPACE, and update deps hashes for both platforms.
This commit is contained in:
Philip Taron
2026-02-14 16:08:51 -08:00
parent a5b1db7653
commit 5e8d1c5224
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/by-name/en/envoy/package.nix
+8 -8
View File
@@ -49,8 +49,8 @@ let
depsHash
else
{
x86_64-linux = "sha256-cUpCkmJmFyd2mTImMKt5Cgi+A4bAWAXLYjJjMnV6haQ=";
aarch64-linux = "sha256-f1FbdFDunlF7uhCpkb5AqmKN5uimuKnFYBzXjIcRabk=";
x86_64-linux = "sha256-CMd8dIyvuYFoHg1+AdkkyBj5P367ZcklCOgih+7uQIA=";
aarch64-linux = "sha256-NJIkiTIJBZFPb+FpTYo6pQQQt8++VuCHHj0Y0AjqWGo=";
}
.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
@@ -144,14 +144,14 @@ buildBazelPackage rec {
--replace-fail 'crates_repository(' 'crates_repository(generator="@@cargo_bazel_bootstrap//:cargo-bazel", '
'';
preInstall = ''
# Envoy uses --noenable_bzlmod so BCR modules are not needed.
# Populate the repository cache with entries the build needs from the empty
# workspace. Use `bazel sync` (which fetches WORKSPACE repos) rather than
# `bazel fetch` (which requires bzlmod for its --all mode).
mkdir $NIX_BUILD_TOP/empty
pushd $NIX_BUILD_TOP/empty
touch MODULE.bazel
# Unfortunately, we need to fetch a lot of irrelevant junk to make this work.
# This really bloats the size of the FOD.
# TODO: lukegb - figure out how to make this suck less.
bazel fetch --repository_cache="$bazelOut/external/repository_cache"
bazel sync --repository_cache="$bazelOut/external/repository_cache"
touch MODULE.bazel WORKSPACE
bazel sync --noenable_bzlmod --repository_cache="$bazelOut/external/repository_cache"
popd
# Strip out the path to the build location (by deleting the comment line).