{cudaPackages.nccl, onnxruntime}: remove reference to nvcc in binary (#457803)

pkgs/by-name/on/onnxruntime/package.nix

@@ -17,6 +17,7 @@
   perl,
   pkg-config,
   python3Packages,
+  removeReferencesTo,
   re2,
   zlib,
   protobuf,
@@ -44,6 +45,7 @@ let
 
   stdenv = throw "Use effectiveStdenv instead";
   effectiveStdenv = if cudaSupport then cudaPackages.backendStdenv else inputs.stdenv;
+  inherit (cudaPackages) cuda_nvcc;
 
   cudaArchitecturesString = cudaPackages.flags.cmakeCudaArchitecturesString;
 
@@ -121,6 +123,7 @@ effectiveStdenv.mkDerivation rec {
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc
     cudaPackages.cudnn-frontend
+    removeReferencesTo
   ]
   ++ lib.optionals isCudaJetson [
     cudaPackages.autoAddCudaCompatRunpath
@@ -318,6 +321,12 @@ effectiveStdenv.mkDerivation rec {
       ../include/onnxruntime/core/session/onnxruntime_*.h
   '';
 
+  # See comments in `cudaPackages.nccl`
+  postFixup = lib.optionalString cudaSupport ''
+    remove-references-to -t "${lib.getBin cuda_nvcc}" ''${!outputLib}/lib/libonnxruntime_providers_cuda.so
+  '';
+  disallowedRequisites = [ (lib.getBin cuda_nvcc) ];
+
   passthru = {
     inherit cudaSupport cudaPackages ncclSupport; # for the python module
     inherit protobuf;

pkgs/development/cuda-modules/packages/nccl.nix

@@ -10,6 +10,7 @@
   flags,
   lib,
   python3,
+  removeReferencesTo,
   which,
   # passthru.updateScript
   gitUpdater,
@@ -72,6 +73,7 @@ backendStdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cuda_nvcc
     python3
+    removeReferencesTo
     which
   ];
 
@@ -117,8 +119,22 @@ backendStdenv.mkDerivation (finalAttrs: {
   postFixup = ''
     _overrideFirst outputStatic "static" "lib" "out"
     moveToOutput lib/libnccl_static.a "''${!outputStatic:?}"
+  ''
+  # Since CUDA 12.8, the cuda_nvcc path leaks in:
+  # - libnccl.so's .nv_fatbin section
+  # - libnccl_static.a
+  # &devrt -L /nix/store/00000000000000000000000000000000-...nvcc-.../bin/...
+  # This string makes cuda_nvcc a runtime dependency of nccl.
+  # See https://github.com/NixOS/nixpkgs/pull/457803
+  + ''
+    remove-references-to -t "${lib.getBin cuda_nvcc}" \
+      ''${!outputLib}/lib/libnccl.so.* \
+      ''${!outputStatic}/lib/*.a
   '';
 
+  # C.f. remove-references-to above. Ensure *all* references to cuda_nvcc are removed
+  disallowedRequisites = [ (lib.getBin cuda_nvcc) ];
+
   passthru = {
     platformAssertions = [
       {