From 5e8d1c5224f5412e9dd44fb4ff901112b7a3ffdb Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Sat, 14 Feb 2026 16:08:51 -0800
Subject: [PATCH] envoy: fix deps fetch by disabling bzlmod in empty-workspace
 sync

The preInstall phase of the deps derivation ran `bazel fetch` and
`bazel sync` in an empty directory with bzlmod enabled. This pulled
rules_jvm_external from the Bazel Central Registry, which tried to
execute a coursier GraalVM native binary that cannot run in the Nix
sandbox.

Since envoy itself uses --noenable_bzlmod, BCR modules are not needed.
Replace the two commands with a single `bazel sync --noenable_bzlmod`
over an empty WORKSPACE, and update deps hashes for both platforms.
---
 pkgs/by-name/en/envoy/package.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 9611303664ab..9e048cc48d36 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -49,8 +49,8 @@ let
       depsHash
     else
       {
-        x86_64-linux = "sha256-cUpCkmJmFyd2mTImMKt5Cgi+A4bAWAXLYjJjMnV6haQ=";
-        aarch64-linux = "sha256-f1FbdFDunlF7uhCpkb5AqmKN5uimuKnFYBzXjIcRabk=";
+        x86_64-linux = "sha256-CMd8dIyvuYFoHg1+AdkkyBj5P367ZcklCOgih+7uQIA=";
+        aarch64-linux = "sha256-NJIkiTIJBZFPb+FpTYo6pQQQt8++VuCHHj0Y0AjqWGo=";
       }
       .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -144,14 +144,14 @@ buildBazelPackage rec {
         --replace-fail 'crates_repository(' 'crates_repository(generator="@@cargo_bazel_bootstrap//:cargo-bazel", '
     '';
     preInstall = ''
+      # Envoy uses --noenable_bzlmod so BCR modules are not needed.
+      # Populate the repository cache with entries the build needs from the empty
+      # workspace.  Use `bazel sync` (which fetches WORKSPACE repos) rather than
+      # `bazel fetch` (which requires bzlmod for its --all mode).
       mkdir $NIX_BUILD_TOP/empty
       pushd $NIX_BUILD_TOP/empty
-      touch MODULE.bazel
-      # Unfortunately, we need to fetch a lot of irrelevant junk to make this work.
-      # This really bloats the size of the FOD.
-      # TODO: lukegb - figure out how to make this suck less.
-      bazel fetch --repository_cache="$bazelOut/external/repository_cache"
-      bazel sync --repository_cache="$bazelOut/external/repository_cache"
+      touch MODULE.bazel WORKSPACE
+      bazel sync --noenable_bzlmod --repository_cache="$bazelOut/external/repository_cache"
       popd
 
       # Strip out the path to the build location (by deleting the comment line).