From e033e7c7531065d4ceec1ce5f326f2b28d7a3e45 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Thu, 21 Aug 2025 20:00:32 +0200 Subject: [PATCH 1/4] envoy: fix up Rust builds This unblocks using wasmtime rather than wamr as the WASM runtime in envoy (see #425065). --- pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel | 18 ++++++++++++++++-- pkgs/by-name/en/envoy/package.nix | 3 ++- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel b/pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel index 5531517addfb..17844db5112a 100644 --- a/pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel +++ b/pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel @@ -1,12 +1,26 @@ load("@bazel_tools//tools/sh:sh_toolchain.bzl", "sh_toolchain") load("@rules_rust//rust:toolchain.bzl", "rust_toolchain") +load("@rules_rust//rust:defs.bzl", "rust_stdlib_filegroup") toolchains = { "x86_64": "x86_64-unknown-linux-gnu", "aarch64": "aarch64-unknown-linux-gnu", } -exports_files(["cargo", "rustdoc", "ruststd", "rustc"]) +exports_files(["cargo", "rustdoc", "rustc"]) + +[ + rust_stdlib_filegroup( + name = "rust_nix_" + k + "_stdlib", + srcs = glob( + [ + "rustcroot/lib/rustlib/" + v + "/lib/**", + ], + allow_empty=True, + ), + ) + for k, v in toolchains.items() +] [ rust_toolchain( @@ -16,7 +30,7 @@ exports_files(["cargo", "rustdoc", "ruststd", "rustc"]) exec_triple = v, cargo = ":cargo", rust_doc = ":rustdoc", - rust_std = ":ruststd", + rust_std = ":rust_nix_" + k + "_stdlib", rustc = ":rustc", stdlib_linkflags = ["-ldl", "-lpthread"], staticlib_ext = ".a", diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix index 37a5037e0c41..88e6f9706fb3 100644 --- a/pkgs/by-name/en/envoy/package.nix +++ b/pkgs/by-name/en/envoy/package.nix @@ -94,7 +94,7 @@ buildBazelPackage rec { ln -sf "${cargo}/bin/cargo" bazel/nix/cargo ln -sf "${rustc}/bin/rustc" bazel/nix/rustc ln -sf "${rustc}/bin/rustdoc" bazel/nix/rustdoc - ln -sf "${rustPlatform.rustLibSrc}" bazel/nix/ruststd + ln -sf "${rustc.unwrapped}" bazel/nix/rustcroot substituteInPlace bazel/dependency_imports.bzl \ --replace-fail 'crate_universe_dependencies()' 'crate_universe_dependencies(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc")' \ --replace-fail 'crates_repository(' 'crates_repository(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc",' @@ -239,6 +239,7 @@ buildBazelPackage rec { "--linkopt=-Wl,-z,noexecstack" "--config=gcc" "--verbose_failures" + "--incompatible_enable_cc_toolchain_resolution=true" # Force use of system Java. "--extra_toolchains=@local_jdk//:all" From 6c9595844f2bb6aec59752644abc03a5aa62ca88 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Thu, 21 Aug 2025 20:01:25 +0200 Subject: [PATCH 2/4] envoy: add git dependency Some crates depended on by wasmtime are referenced directly from Git, so we'll need a git binary available. Part of fixing #425065. --- pkgs/by-name/en/envoy/package.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix index 88e6f9706fb3..c8d1fce18a41 100644 --- a/pkgs/by-name/en/envoy/package.nix +++ b/pkgs/by-name/en/envoy/package.nix @@ -23,6 +23,7 @@ gnutar, gnugrep, envoy, + git, # v8 (upstream default), wavm, wamr, wasmtime, disabled wasmRuntime ? "wamr", @@ -120,6 +121,7 @@ buildBazelPackage rec { ninja patchelf cacert + git ]; buildInputs = [ linuxHeaders ]; From 6cfa3cff385c4d44aa6658fb8e7e560a878b29b2 Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Thu, 21 Aug 2025 20:02:56 +0200 Subject: [PATCH 3/4] envoy: allow overriding depsHash externally This avoids needing to patch the package in order to change some of the configuration options. This is a bit of a cop out, but it's the easiest thing to do right now without doing a cross-product fetch of all of the configurations we want to support. --- pkgs/by-name/en/envoy/package.nix | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix index c8d1fce18a41..72fc9fb8effa 100644 --- a/pkgs/by-name/en/envoy/package.nix +++ b/pkgs/by-name/en/envoy/package.nix @@ -27,6 +27,10 @@ # v8 (upstream default), wavm, wamr, wasmtime, disabled wasmRuntime ? "wamr", + + # Allows overriding the deps hash used for building - you will likely need to + # set this if you have changed the 'wasmRuntime' setting. + depsHash ? null, }: let @@ -41,12 +45,15 @@ let }; # these need to be updated for any changes to fetchAttrs - depsHash = - { - x86_64-linux = "sha256-E6yUSd00ngmjaMds+9UVZLtcYhzeS8F9eSIkC1mZSps="; - aarch64-linux = "sha256-ivboOrV/uORKVHRL3685aopcElGvzsxgVcUmYsBwzXY="; - } - .${stdenv.system} or (throw "unsupported system ${stdenv.system}"); + depsHash' = + if depsHash != null then + depsHash + else + { + x86_64-linux = "sha256-E6yUSd00ngmjaMds+9UVZLtcYhzeS8F9eSIkC1mZSps="; + aarch64-linux = "sha256-ivboOrV/uORKVHRL3685aopcElGvzsxgVcUmYsBwzXY="; + } + .${stdenv.system} or (throw "unsupported system ${stdenv.system}"); python3 = python312; @@ -127,7 +134,7 @@ buildBazelPackage rec { buildInputs = [ linuxHeaders ]; fetchAttrs = { - sha256 = depsHash; + sha256 = depsHash'; env.CARGO_BAZEL_REPIN = true; dontUseCmakeConfigure = true; dontUseGnConfigure = true; From f89b85d6d00c9764c6716d047522cb01cfa752ab Mon Sep 17 00:00:00 2001 From: Luke Granger-Brown Date: Thu, 21 Aug 2025 20:03:32 +0200 Subject: [PATCH 4/4] envoy: switch default WASM runtime to wasmtime wasmtime is better maintained than WAMR (although they're both under the Bytecode Alliance umbrella), and tends to gain new features faster. Fixes #425065... ish, although it doesn't really solve the overall problem of needing a repin if you change which WASM runtime you want. --- pkgs/by-name/en/envoy/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix index 72fc9fb8effa..327af100c23f 100644 --- a/pkgs/by-name/en/envoy/package.nix +++ b/pkgs/by-name/en/envoy/package.nix @@ -26,7 +26,7 @@ git, # v8 (upstream default), wavm, wamr, wasmtime, disabled - wasmRuntime ? "wamr", + wasmRuntime ? "wasmtime", # Allows overriding the deps hash used for building - you will likely need to # set this if you have changed the 'wasmRuntime' setting. @@ -50,8 +50,8 @@ let depsHash else { - x86_64-linux = "sha256-E6yUSd00ngmjaMds+9UVZLtcYhzeS8F9eSIkC1mZSps="; - aarch64-linux = "sha256-ivboOrV/uORKVHRL3685aopcElGvzsxgVcUmYsBwzXY="; + x86_64-linux = "sha256-t4Xv4UGYW5YU0kmv+1rdf2JvM1BYQyNWdtpz6Cdmxm4="; + aarch64-linux = "sha256-aIBnNGzc0hTdlTgRyJ7eLnWvHqZ5ywhqOM+mHfH3/18="; } .${stdenv.system} or (throw "unsupported system ${stdenv.system}");