Merge pull request #262152 from layus/master

bazel_7: init at 7.0.0
2024-01-01 13:04:23 +08:00
parent af7115b019 7916e168a8
commit dc594fa5f6
23 changed files with 14322 additions and 24 deletions
@@ -1,4 +1,4 @@
-{ writeText, bazel, runLocal, bazelTest, distDir }:
+{ writeText, bazel, runLocal, bazelTest, distDir, extraBazelArgs ? ""}:

 # Tests that certain executables are available in bazel-executed bash shells.

@@ -35,7 +35,7 @@ let
    inherit workspaceDir;

    bazelScript = ''
-      ${bazel}/bin/bazel build :tool_usage --distdir=${distDir}
+      ${bazel}/bin/bazel build :tool_usage --distdir=${distDir} ${extraBazelArgs}
      cp bazel-bin/output.txt $out
      echo "Testing content" && [ "$(cat $out | wc -l)" == "2" ] && echo "OK"
    '';
@@ -0,0 +1,139 @@
+{ lib
+, rnix-hashes
+, runCommand
+, fetchurl
+  # The path to the right MODULE.bazel.lock
+, lockfile
+  # A predicate used to select only some dependencies based on their name
+, requiredDepNamePredicate ? _: true
+, canonicalIds ? true
+}:
+let
+  modules = builtins.fromJSON (builtins.readFile lockfile);
+  modulesVersion = modules.lockFileVersion;
+
+  # a foldl' for json values
+  foldlJSON = op: acc: value:
+    let
+      # preorder, visit the current node first
+      acc' = op acc value;
+
+      # then visit child values, ignoring attribute names
+      children =
+        if builtins.isList value then
+          lib.foldl' (foldlJSON op) acc' value
+        else if builtins.isAttrs value then
+          lib.foldlAttrs (_acc: _name: foldlJSON op _acc) acc' value
+        else
+          acc';
+    in
+    # like foldl', force evaluation of intermediate results
+    builtins.seq acc' children;
+
+  # remove the "--" prefix, abusing undocumented negative substring length
+  sanitize = str:
+    if modulesVersion < 3
+    then builtins.substring 2 (-1) str
+    else str;
+
+  # We take any "attributes" object that has a "sha256" field. Every value
+  # under "attributes" is assumed to be an object, and all the "attributes"
+  # with a "sha256" field are assumed to have either a "urls" or "url" field.
+  #
+  # We add them to the `acc`umulator:
+  #
+  #    acc // {
+  #      "ffad2b06ef2e09d040...fc8e33706bb01634" = fetchurl {
+  #        name = "source";
+  #        sha256 = "ffad2b06ef2e09d040...fc8e33706bb01634";
+  #        urls = [
+  #          "https://mirror.bazel.build/github.com/golang/library.zip",
+  #          "https://github.com/golang/library.zip"
+  #        ];
+  #      };
+  #    }
+  #
+  # !REMINDER! This works on a best-effort basis, so try to keep it from
+  # failing loudly. Prefer warning traces.
+  extract_source = f: acc: value:
+    let
+      attrs = value.attributes;
+      entry = hash: urls: name: {
+        ${hash} = fetchurl {
+          name = "source"; # just like fetch*, to get some deduplication
+          inherit urls;
+          sha256 = hash;
+          passthru.sha256 = hash;
+          passthru.source_name = name;
+          passthru.urls = urls;
+        };
+      };
+      insert = acc: hash: urls:
+        let
+          validUrls = builtins.isList urls
+            && builtins.all (url: builtins.isString url && builtins.substring 0 4 url == "http") urls;
+          validName = builtins.isString attrs.name;
+          validHash = builtins.isString hash;
+          valid = validUrls && validName && validHash;
+        in
+        if valid then acc // entry hash urls attrs.name
+        else acc;
+      withToplevelValue = acc: insert acc
+        (attrs.integrity or attrs.sha256)
+        (attrs.urls or [ attrs.url ]);
+      # for http_file patches
+      withRemotePatches = acc: lib.foldlAttrs
+        (acc: url: hash: insert acc hash [ url ])
+        acc
+        (attrs.remote_patches or { });
+      # for _distdir_tar
+      withArchives = acc: lib.foldl'
+        (acc: archive: insert acc attrs.sha256.${archive} attrs.urls.${archive})
+        acc
+        (attrs.archives or [ ]);
+      addSources = acc: withToplevelValue (withRemotePatches (withArchives acc));
+    in
+    if builtins.isAttrs value && value ? attributes
+      && builtins.isAttrs attrs && attrs ? name
+      && (attrs ? sha256 || attrs ? integrity)
+      && (attrs ? urls || attrs ? url)
+      && f attrs.name
+    then addSources acc
+    else acc;
+
+  requiredSourcePredicate = n: requiredDepNamePredicate (sanitize n);
+  requiredDeps = foldlJSON (extract_source requiredSourcePredicate) { } modules;
+
+  command = ''
+    mkdir -p $out/content_addressable/sha256
+    cd $out
+  '' + lib.concatMapStrings
+    (drv: ''
+      filename=$(basename "${lib.head drv.urls}")
+      echo Bundling $filename ${lib.optionalString (drv?source_name) "from ${drv.source_name}"}
+
+      # 1. --repository_cache format:
+      # 1.a. A file under a content-hash directory
+      hash=$(${rnix-hashes}/bin/rnix-hashes --encoding BASE16 ${drv.sha256} | cut -f 2)
+      mkdir -p content_addressable/sha256/$hash
+      ln -sfn ${drv} content_addressable/sha256/$hash/file
+
+      # 1.b. a canonicalId marker based on the download urls
+      # Bazel uses these to avoid reusing a stale hash when the urls have changed.
+      canonicalId="${lib.concatStringsSep " " drv.urls}"
+      canonicalIdHash=$(echo -n "$canonicalId" | sha256sum | cut -d" " -f1)
+      echo -n "$canonicalId" > content_addressable/sha256/$hash/id-$canonicalIdHash
+
+      # 2. --distdir format:
+      # Just a file with the right basename
+      # Mostly to keep old tests happy, and because symlinks cost nothing.
+      # This is brittle because of expected file name conflicts
+      ln -sn ${drv} $filename || true
+    '')
+    (builtins.attrValues requiredDeps)
+  ;
+
+  repository_cache = runCommand "bazel-repository-cache" { } command;
+
+in
+repository_cache
@@ -0,0 +1,7 @@
+###############################################################################
+# Bazel now uses Bzlmod by default to manage external dependencies.
+# Please consider migrating your external dependencies from WORKSPACE to MODULE.bazel.
+#
+# For more details, please check https://github.com/bazelbuild/bazel/issues/18958
+###############################################################################
+
@@ -0,0 +1,89 @@
+{
+  bazel
+, bazel-examples
+, bazelTest
+, callPackage
+, darwin
+, distDir
+, extraBazelArgs ? ""
+, Foundation ? null
+, lib
+, runLocal
+, runtimeShell
+, stdenv
+, symlinkJoin
+, writeScript
+, writeText
+}:
+
+let
+
+  localDistDir = callPackage ./bazel-repository-cache.nix {
+    lockfile = ./cpp-test-MODULE.bazel.lock;
+
+    # Take all the rules_ deps, bazel_ deps and their transitive dependencies,
+    # but none of the platform-specific binaries, as they are large and useless.
+    requiredDepNamePredicate = name:
+      null == builtins.match ".*(macos|osx|linux|win|apple|android|maven).*" name
+      && null != builtins.match "(platforms|com_google_|protobuf|rules_|bazel_).*" name ;
+  };
+
+  mergedDistDir = symlinkJoin {
+    name = "mergedDistDir";
+    paths = [ localDistDir distDir ];
+  };
+
+  toolsBazel = writeScript "bazel" ''
+    #! ${runtimeShell}
+
+    export CXX='${stdenv.cc}/bin/clang++'
+    export LD='${darwin.cctools}/bin/ld'
+    export LIBTOOL='${darwin.cctools}/bin/libtool'
+    export CC='${stdenv.cc}/bin/clang'
+
+    # XXX: hack for macosX, this flags disable bazel usage of xcode
+    # See: https://github.com/bazelbuild/bazel/issues/4231
+    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+
+    exec "$BAZEL_REAL" "$@"
+  '';
+
+  workspaceDir = runLocal "our_workspace" {} (''
+    cp -r ${bazel-examples}/cpp-tutorial/stage3 $out
+    find $out -type d -exec chmod 755 {} \;
+    cp ${./cpp-test-MODULE.bazel} $out/MODULE.bazel
+    cp ${./cpp-test-MODULE.bazel.lock} $out/MODULE.bazel.lock
+    echo > $out/WORSPACE
+  ''
+  + (lib.optionalString stdenv.isDarwin ''
+    mkdir $out/tools
+    cp ${toolsBazel} $out/tools/bazel
+  ''));
+
+  testBazel = bazelTest {
+    name = "bazel-test-cpp";
+    inherit workspaceDir;
+    bazelPkg = bazel;
+    bazelScript = ''
+      ${bazel}/bin/bazel build //... \
+        --enable_bzlmod \
+        --verbose_failures \
+        --repository_cache=${mergedDistDir} \
+        --curses=no \
+    '' + lib.optionalString (stdenv.isDarwin) ''
+        --cxxopt=-x --cxxopt=c++ \
+        --host_cxxopt=-x --host_cxxopt=c++ \
+    '' + lib.optionalString (stdenv.cc.isClang && stdenv ? cc.libcxx.cxxabi.libName) ''
+        --linkopt=-Wl,-l${stdenv.cc.libcxx.cxxabi.libName} \
+        --linkopt=-L${stdenv.cc.libcxx.cxxabi}/lib \
+        --host_linkopt=-Wl,-l${stdenv.cc.libcxx.cxxabi.libName} \
+        --host_linkopt=-L${stdenv.cc.libcxx.cxxabi}/lib \
+    '' + lib.optionalString (stdenv.isDarwin && Foundation != null) ''
+        --linkopt=-Wl,-F${Foundation}/Library/Frameworks \
+        --linkopt=-L${darwin.libobjc}/lib \
+    '' + ''
+
+    '';
+  };
+
+in testBazel
@@ -0,0 +1,56 @@
+diff --git a/src/main/native/darwin/sleep_prevention_jni.cc b/src/main/native/darwin/sleep_prevention_jni.cc
+index 67c35b201e..e50a58320e 100644
+--- a/src/main/native/darwin/sleep_prevention_jni.cc
+++ b/src/main/native/darwin/sleep_prevention_jni.cc
+@@ -33,31 +33,13 @@ static int g_sleep_state_stack = 0;
+ static IOPMAssertionID g_sleep_state_assertion = kIOPMNullAssertionID;
+ 
+ int portable_push_disable_sleep() {
+-  std::lock_guard<std::mutex> lock(g_sleep_state_mutex);
+-  BAZEL_CHECK_GE(g_sleep_state_stack, 0);
+-  if (g_sleep_state_stack == 0) {
+-    BAZEL_CHECK_EQ(g_sleep_state_assertion, kIOPMNullAssertionID);
+-    CFStringRef reasonForActivity = CFSTR("build.bazel");
+-    IOReturn success = IOPMAssertionCreateWithName(
+-        kIOPMAssertionTypeNoIdleSleep, kIOPMAssertionLevelOn, reasonForActivity,
+-        &g_sleep_state_assertion);
+-    BAZEL_CHECK_EQ(success, kIOReturnSuccess);
+-  }
+-  g_sleep_state_stack += 1;
+-  return 0;
+  // Unreliable, disable for now
+  return -1;
+ }
+ 
+ int portable_pop_disable_sleep() {
+-  std::lock_guard<std::mutex> lock(g_sleep_state_mutex);
+-  BAZEL_CHECK_GT(g_sleep_state_stack, 0);
+-  g_sleep_state_stack -= 1;
+-  if (g_sleep_state_stack == 0) {
+-    BAZEL_CHECK_NE(g_sleep_state_assertion, kIOPMNullAssertionID);
+-    IOReturn success = IOPMAssertionRelease(g_sleep_state_assertion);
+-    BAZEL_CHECK_EQ(success, kIOReturnSuccess);
+-    g_sleep_state_assertion = kIOPMNullAssertionID;
+-  }
+-  return 0;
+  // Unreliable, disable for now
+  return -1;
+ }
+ 
+ }  // namespace blaze_jni
+diff --git a/src/main/native/darwin/system_suspension_monitor_jni.cc b/src/main/native/darwin/system_suspension_monitor_jni.cc
+index 3483aa7935..51782986ec 100644
+--- a/src/main/native/darwin/system_suspension_monitor_jni.cc
+++ b/src/main/native/darwin/system_suspension_monitor_jni.cc
+@@ -83,10 +83,7 @@ void portable_start_suspend_monitoring() {
+     // Register to receive system sleep notifications.
+     // Testing needs to be done manually. Use the logging to verify
+     // that sleeps are being caught here.
+-    suspend_state.connect_port = IORegisterForSystemPower(
+-        &suspend_state, &notifyPortRef, SleepCallBack, &notifierObject);
+-    BAZEL_CHECK_NE(suspend_state.connect_port, MACH_PORT_NULL);
+-    IONotificationPortSetDispatchQueue(notifyPortRef, queue);
+    // XXX: Unreliable, disable for now
+ 
+     // Register to deal with SIGCONT.
+     // We register for SIGCONT because we can't catch SIGSTOP.
@@ -0,0 +1,586 @@
+{ stdenv
+  # nix tooling and utilities
+, callPackage
+, lib
+, fetchurl
+, makeWrapper
+, writeTextFile
+, substituteAll
+, writeShellApplication
+, makeBinaryWrapper
+  # this package (through the fixpoint glass)
+, bazel_self
+  # native build inputs
+, runtimeShell
+, zip
+, unzip
+, bash
+, coreutils
+, which
+, gawk
+, gnused
+, gnutar
+, gnugrep
+, gzip
+, findutils
+, diffutils
+, gnupatch
+, file
+, installShellFiles
+, lndir
+, python3
+  # Apple dependencies
+, cctools
+, libcxx
+, sigtool
+, CoreFoundation
+, CoreServices
+, Foundation
+, IOKit
+  # Allow to independently override the jdks used to build and run respectively
+, buildJdk
+, runJdk
+  # Always assume all markers valid (this is needed because we remove markers; they are non-deterministic).
+  # Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
+, enableNixHacks ? false
+}:
+
+let
+  version = "7.0.0";
+  sourceRoot = ".";
+
+  src = fetchurl {
+    url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
+    hash = "sha256-R35U9jdAAfQ5qUcbod6deCTa8SnblVEISezF4ZzogXA=";
+  };
+
+  # Use builtins.fetchurl to avoid IFD, in particular on hydra
+  #lockfile = builtins.fetchurl {
+  #  url = "https://raw.githubusercontent.com/bazelbuild/bazel/release-${version}/MODULE.bazel.lock";
+  #  sha256 = "sha256-5xPpCeWVKVp1s4RVce/GoW2+fH8vniz5G1MNI4uezpc=";
+  #};
+  # Use a local copy of the above lockfile to make ofborg happy.
+  lockfile = ./MODULE.bazel.lock;
+
+  # Two-in-one format
+  distDir = repoCache;
+  repoCache = callPackage ./bazel-repository-cache.nix {
+    inherit lockfile;
+
+    # We use the release tarball that already has everything bundled so we
+    # should not need any extra external deps. But our nonprebuilt java
+    # toolchains hack needs just one non bundled dep.
+    requiredDepNamePredicate = name:
+      null != builtins.match "rules_java~.*~toolchains~remote_java_tools" name;
+  };
+
+  defaultShellUtils =
+    # Keep this list conservative. For more exotic tools, prefer to use
+    # @rules_nixpkgs to pull in tools from the nix repository. Example:
+    #
+    # WORKSPACE:
+    #
+    #     nixpkgs_git_repository(
+    #         name = "nixpkgs",
+    #         revision = "def5124ec8367efdba95a99523dd06d918cb0ae8",
+    #     )
+    #
+    #     # This defines an external Bazel workspace.
+    #     nixpkgs_package(
+    #         name = "bison",
+    #         repositories = { "nixpkgs": "@nixpkgs//:default.nix" },
+    #     )
+    #
+    # some/BUILD.bazel:
+    #
+    #     genrule(
+    #        ...
+    #        cmd = "$(location @bison//:bin/bison) -other -args",
+    #        tools = [
+    #            ...
+    #            "@bison//:bin/bison",
+    #        ],
+    #     )
+    [
+      bash
+      coreutils
+      diffutils
+      file
+      findutils
+      gawk
+      gnugrep
+      gnupatch
+      gnused
+      gnutar
+      gzip
+      python3
+      unzip
+      which
+      zip
+    ];
+
+  defaultShellPath = lib.makeBinPath defaultShellUtils;
+
+  bashWithDefaultShellUtilsSh = writeShellApplication {
+    name = "bash";
+    runtimeInputs = defaultShellUtils;
+    text = ''
+      if [[ "$PATH" == "/no-such-path" ]]; then
+        export PATH=${defaultShellPath}
+      fi
+      exec ${bash}/bin/bash "$@"
+    '';
+  };
+
+  # Script-based interpreters in shebangs aren't guaranteed to work,
+  # especially on MacOS. So let's produce a binary
+  bashWithDefaultShellUtils = stdenv.mkDerivation {
+    name = "bash";
+    src = bashWithDefaultShellUtilsSh;
+    nativeBuildInputs = [ makeBinaryWrapper ];
+    buildPhase = ''
+      makeWrapper ${bashWithDefaultShellUtilsSh}/bin/bash $out/bin/bash
+    '';
+  };
+
+  platforms = lib.platforms.linux ++ lib.platforms.darwin;
+
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
+
+  system = if isDarwin then "darwin" else "linux";
+
+  # on aarch64 Darwin, `uname -m` returns "arm64"
+  arch = with stdenv.hostPlatform; if isDarwin && isAarch64 then "arm64" else parsed.cpu.name;
+
+  bazelRC = writeTextFile {
+    name = "bazel-rc";
+    text = ''
+      startup --server_javabase=${runJdk}
+
+      # Register nix-specific nonprebuilt java toolchains
+      build --extra_toolchains=@bazel_tools//tools/jdk:all
+      # and set bazel to use them by default
+      build --tool_java_runtime_version=local_jdk
+      build --java_runtime_version=local_jdk
+
+      # load default location for the system wide configuration
+      try-import /etc/bazel.bazelrc
+    '';
+  };
+
+in
+stdenv.mkDerivation rec {
+  pname = "bazel";
+  inherit version src;
+  inherit sourceRoot;
+
+  patches = [
+    # Remote java toolchains do not work on NixOS because they download binaries,
+    # so we need to use the @local_jdk//:jdk
+    # It could in theory be done by registering @local_jdk//:all toolchains,
+    # but these java toolchains still bundle binaries for ijar and stuff. So we
+    # need a nonprebult java toolchain (where ijar and stuff is built from
+    # sources).
+    # There is no such java toolchain, so we introduce one here.
+    # By providing no version information, the toolchain will set itself to the
+    # version of $JAVA_HOME/bin/java, just like the local_jdk does.
+    # To ensure this toolchain gets used, we can set
+    # --{,tool_}java_runtime_version=local_jdk and rely on the fact no java
+    # toolchain registered by default uses the local_jdk, making the selection
+    # unambiguous.
+    # This toolchain has the advantage that it can use any ambiant java jdk,
+    # not only a given, fixed version. It allows bazel to work correctly in any
+    # environment where JAVA_HOME is set to the right java version, like inside
+    # nix derivations.
+    # However, this patch breaks bazel hermeticity, by picking the ambiant java
+    # version instead of the more hermetic remote_jdk prebuilt binaries that
+    # rules_java provide by default. It also requires the user to have a
+    # JAVA_HOME set to the exact version required by the project.
+    # With more code, we could define java toolchains for all the java versions
+    # supported by the jdk as in rules_java's
+    # toolchains/local_java_repository.bzl, but this is not implemented here.
+    # To recover vanilla behavior, non NixOS users can set
+    # --{,tool_}java_runtime_version=remote_jdk, effectively reverting the
+    # effect of this patch and the fake system bazelrc.
+    ./java_toolchain.patch
+
+    # Bazel integrates with apple IOKit to inhibit and track system sleep.
+    # Inside the darwin sandbox, these API calls are blocked, and bazel
+    # crashes. It seems possible to allow these APIs inside the sandbox, but it
+    # feels simpler to patch bazel not to use it at all. So our bazel is
+    # incapable of preventing system sleep, which is a small price to pay to
+    # guarantee that it will always run in any nix context.
+    #
+    # See also ./bazel_darwin_sandbox.patch in bazel_5. That patch uses
+    # NIX_BUILD_TOP env var to conditionnally disable sleep features inside the
+    # sandbox. Oddly, bazel_6 does not need that patch :-/.
+    #
+    # If you want to investigate the sandbox profile path,
+    # IORegisterForSystemPower can be allowed with
+    #
+    #     propagatedSandboxProfile = ''
+    #       (allow iokit-open (iokit-user-client-class "RootDomainUserClient"))
+    #     '';
+    #
+    # I do not know yet how to allow IOPMAssertion{CreateWithName,Release}
+    ./darwin_sleep.patch
+
+    # Fix DARWIN_XCODE_LOCATOR_COMPILE_COMMAND by removing multi-arch support.
+    # Nixpkgs toolcahins do not support that (yet?) and get confused.
+    # Also add an explicit /usr/bin prefix that will be patched below.
+    ./xcode_locator.patch
+
+    # On Darwin, the last argument to gcc is coming up as an empty string. i.e: ''
+    # This is breaking the build of any C target. This patch removes the last
+    # argument if it's found to be an empty string.
+    ../trim-last-argument-to-gcc-if-empty.patch
+
+    # --experimental_strict_action_env (which may one day become the default
+    # see bazelbuild/bazel#2574) hardcodes the default
+    # action environment to a non hermetic value (e.g. "/usr/local/bin").
+    # This is non hermetic on non-nixos systems. On NixOS, bazel cannot find the required binaries.
+    # So we are replacing this bazel paths by defaultShellPath,
+    # improving hermeticity and making it work in nixos.
+    (substituteAll {
+      src = ../strict_action_env.patch;
+      strictActionEnvPatch = defaultShellPath;
+    })
+
+    # bazel reads its system bazelrc in /etc
+    # override this path to a builtin one
+    (substituteAll {
+      src = ../bazel_rc.patch;
+      bazelSystemBazelRCPath = bazelRC;
+    })
+  ]
+  # See enableNixHacks argument above.
+  ++ lib.optional enableNixHacks ./nix-hacks.patch;
+
+  postPatch =
+    let
+      # Workaround for https://github.com/NixOS/nixpkgs/issues/166205
+      nixpkgs166205ldflag = lib.optionalString stdenv.cc.isClang "-l${stdenv.cc.libcxx.cxxabi.libName}";
+      darwinPatches = ''
+        bazelLinkFlags () {
+          eval set -- "$NIX_LDFLAGS"
+          local flag
+          for flag in "$@"; do
+            printf ' -Wl,%s' "$flag"
+          done
+        }
+
+        # Explicitly configure gcov since we don't have it on Darwin, so autodetection fails
+        export GCOV=${coreutils}/bin/false
+
+        # Framework search paths aren't added by bintools hook
+        # https://github.com/NixOS/nixpkgs/pull/41914
+        export NIX_LDFLAGS+=" -F${CoreFoundation}/Library/Frameworks -F${CoreServices}/Library/Frameworks -F${Foundation}/Library/Frameworks -F${IOKit}/Library/Frameworks ${nixpkgs166205ldflag}"
+
+        # libcxx includes aren't added by libcxx hook
+        # https://github.com/NixOS/nixpkgs/pull/41589
+        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${lib.getDev libcxx}/include/c++/v1"
+        # for CLang 16 compatibility in external/upb dependency
+        export NIX_CFLAGS_COMPILE+=" -Wno-gnu-offsetof-extensions"
+
+        # This variable is used by bazel to propagate env vars for homebrew,
+        # which is exactly what we need too.
+        export HOMEBREW_RUBY_PATH="foo"
+
+        # don't use system installed Xcode to run clang, use Nix clang instead
+        sed -i -E \
+          -e "s;/usr/bin/xcrun (--sdk macosx )?clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $(bazelLinkFlags) -framework CoreFoundation;g" \
+          -e "s;/usr/bin/codesign;CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate ${sigtool}/bin/codesign;" \
+          scripts/bootstrap/compile.sh \
+          tools/osx/BUILD
+
+        # nixpkgs's libSystem cannot use pthread headers directly, must import GCD headers instead
+        sed -i -e "/#include <pthread\/spawn.h>/i #include <dispatch/dispatch.h>" src/main/cpp/blaze_util_darwin.cc
+
+        # XXX: What do these do ?
+        sed -i -e 's;"/usr/bin/libtool";_find_generic(repository_ctx, "libtool", "LIBTOOL", overriden_tools);g' tools/cpp/unix_cc_configure.bzl
+        wrappers=( tools/cpp/osx_cc_wrapper.sh.tpl )
+        for wrapper in "''${wrappers[@]}"; do
+          sedVerbose $wrapper \
+            -e "s,/usr/bin/xcrun install_name_tool,${cctools}/bin/install_name_tool,g"
+        done
+      '';
+
+      genericPatches = ''
+        # unzip builtins_bzl.zip so the contents get patched
+        builtins_bzl=src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl
+        unzip ''${builtins_bzl}.zip -d ''${builtins_bzl}_zip >/dev/null
+        rm ''${builtins_bzl}.zip
+        builtins_bzl=''${builtins_bzl}_zip/builtins_bzl
+
+        # md5sum is part of coreutils
+        sed -i 's|/sbin/md5|md5sum|g' src/BUILD third_party/ijar/test/testenv.sh
+
+        echo
+        echo "Substituting */bin/* hardcoded paths in src/main/java/com/google/devtools"
+        # Prefilter the files with grep for speed
+        grep -rlZ /bin/ \
+          src/main/java/com/google/devtools \
+          src/main/starlark/builtins_bzl/common/python \
+          tools \
+        | while IFS="" read -r -d "" path; do
+          # If you add more replacements here, you must change the grep above!
+          # Only files containing /bin are taken into account.
+          sedVerbose "$path" \
+            -e 's!/usr/local/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+            -e 's!/usr/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+            -e 's!/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+            -e 's!/usr/bin/env bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+            -e 's!/usr/bin/env python2!${python3}/bin/python!g' \
+            -e 's!/usr/bin/env python!${python3}/bin/python!g' \
+            -e 's!/usr/bin/env!${coreutils}/bin/env!g' \
+            -e 's!/bin/true!${coreutils}/bin/true!g'
+        done
+
+        # Fixup scripts that generate scripts. Not fixed up by patchShebangs below.
+        sedVerbose scripts/bootstrap/compile.sh \
+          -e 's!/bin/bash!${bashWithDefaultShellUtils}/bin/bash!g' \
+          -e 's!shasum -a 256!sha256sum!g'
+
+        # Augment bundled repository_cache with our extra paths
+        ${lndir}/bin/lndir ${repoCache}/content_addressable \
+          $PWD/derived/repository_cache/content_addressable
+
+        # Add required flags to bazel command line.
+        # XXX: It would suit a bazelrc file better, but I found no way to pass it.
+        #      It seems that bazel bootstrapping ignores it.
+        #      Passing EXTRA_BAZEL_ARGS is tricky due to quoting.
+        sedVerbose compile.sh \
+          -e "/bazel_build /a\  --verbose_failures \\\\" \
+          -e "/bazel_build /a\  --curses=no \\\\" \
+          -e "/bazel_build /a\  --features=-layering_check \\\\" \
+          -e "/bazel_build /a\  --experimental_strict_java_deps=off \\\\" \
+          -e "/bazel_build /a\  --strict_proto_deps=off \\\\" \
+          -e "/bazel_build /a\  --toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type' \\\\" \
+          -e "/bazel_build /a\  --tool_java_runtime_version=local_jdk_17 \\\\" \
+          -e "/bazel_build /a\  --java_runtime_version=local_jdk_17 \\\\" \
+          -e "/bazel_build /a\  --tool_java_language_version=17 \\\\" \
+          -e "/bazel_build /a\  --java_language_version=17 \\\\" \
+          -e "/bazel_build /a\  --extra_toolchains=@bazel_tools//tools/jdk:all \\\\" \
+
+        # Also build parser_deploy.jar with bootstrap bazel
+        # TODO: Turn into a proper patch
+        sedVerbose compile.sh \
+          -e 's!bazel_build !bazel_build src/tools/execlog:parser_deploy.jar !' \
+          -e 's!clear_log!cp $(get_bazel_bin_path)/src/tools/execlog/parser_deploy.jar output\nclear_log!'
+
+        # append the PATH with defaultShellPath in tools/bash/runfiles/runfiles.bash
+        echo "PATH=\$PATH:${defaultShellPath}" >> runfiles.bash.tmp
+        cat tools/bash/runfiles/runfiles.bash >> runfiles.bash.tmp
+        mv runfiles.bash.tmp tools/bash/runfiles/runfiles.bash
+
+        # reconstruct the now patched builtins_bzl.zip
+        pushd src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl_zip &>/dev/null
+          zip ../builtins_bzl.zip $(find builtins_bzl -type f) >/dev/null
+          rm -rf builtins_bzl
+        popd &>/dev/null
+        rmdir src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl_zip
+
+        patchShebangs . >/dev/null
+      '';
+    in
+    ''
+      function sedVerbose() {
+        local path=$1; shift;
+        sed -i".bak-nix" "$path" "$@"
+        diff -U0 "$path.bak-nix" "$path" | sed "s/^/  /" || true
+        rm -f "$path.bak-nix"
+      }
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin darwinPatches
+    + genericPatches;
+
+  meta = with lib; {
+    homepage = "https://github.com/bazelbuild/bazel/";
+    description = "Build tool that builds code quickly and reliably";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode # source bundles dependencies as jars
+    ];
+    license = licenses.asl20;
+    maintainers = lib.teams.bazel.members;
+    inherit platforms;
+  };
+
+  # Bazel starts a local server and needs to bind a local address.
+  __darwinAllowLocalNetworking = true;
+
+  buildInputs = [ buildJdk bashWithDefaultShellUtils ] ++ defaultShellUtils;
+
+  # when a command can’t be found in a bazel build, you might also
+  # need to add it to `defaultShellPath`.
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+    python3
+    unzip
+    which
+    zip
+    python3.pkgs.absl-py # Needed to build fish completion
+  ] ++ lib.optionals (stdenv.isDarwin) [
+    cctools
+    libcxx
+    Foundation
+    CoreFoundation
+    CoreServices
+  ];
+
+  # Bazel makes extensive use of symlinks in the WORKSPACE.
+  # This causes problems with infinite symlinks if the build output is in the same location as the
+  # Bazel WORKSPACE. This is why before executing the build, the source code is moved into a
+  # subdirectory.
+  # Failing to do this causes "infinite symlink expansion detected"
+  preBuildPhases = [ "preBuildPhase" ];
+  preBuildPhase = ''
+    mkdir bazel_src
+    shopt -s dotglob extglob
+    mv !(bazel_src) bazel_src
+  '';
+  buildPhase = ''
+    runHook preBuild
+
+    # Increasing memory during compilation might be necessary.
+    # export BAZEL_JAVAC_OPTS="-J-Xmx2g -J-Xms200m"
+
+    # If EMBED_LABEL isn't set, it'd be auto-detected from CHANGELOG.md
+    # and `git rev-parse --short HEAD` which would result in
+    # "3.7.0- (@non-git)" due to non-git build and incomplete changelog.
+    # Actual bazel releases use scripts/release/common.sh which is based
+    # on branch/tag information which we don't have with tarball releases.
+    # Note that .bazelversion is always correct and is based on bazel-*
+    # executable name, version checks should work fine
+    export EMBED_LABEL="${version}- (@non-git)"
+    echo "Stage 1 - Running bazel bootstrap script"
+    ${bash}/bin/bash ./bazel_src/compile.sh
+
+    # XXX: get rid of this, or move it to another stage.
+    # It is plain annoying when builds fail.
+    echo "Stage 2 - Generate bazel completions"
+    ${bash}/bin/bash ./bazel_src/scripts/generate_bash_completion.sh \
+        --bazel=./bazel_src/output/bazel \
+        --output=./bazel_src/output/bazel-complete.bash \
+        --prepend=./bazel_src/scripts/bazel-complete-header.bash \
+        --prepend=./bazel_src/scripts/bazel-complete-template.bash
+    ${python3}/bin/python3 ./bazel_src/scripts/generate_fish_completion.py \
+        --bazel=./bazel_src/output/bazel \
+        --output=./bazel_src/output/bazel-complete.fish
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    # official wrapper scripts that searches for $WORKSPACE_ROOT/tools/bazel if
+    # it can’t find something in tools, it calls
+    # $out/bin/bazel-{version}-{os_arch} The binary _must_ exist with this
+    # naming if your project contains a .bazelversion file.
+    cp ./bazel_src/scripts/packages/bazel.sh $out/bin/bazel
+    versionned_bazel="$out/bin/bazel-${version}-${system}-${arch}"
+    mv ./bazel_src/output/bazel "$versionned_bazel"
+    wrapProgram "$versionned_bazel" --suffix PATH : ${defaultShellPath}
+
+    mkdir $out/share
+    cp ./bazel_src/output/parser_deploy.jar $out/share/parser_deploy.jar
+    cat <<EOF > $out/bin/bazel-execlog
+    #!${runtimeShell} -e
+    ${runJdk}/bin/java -jar $out/share/parser_deploy.jar \$@
+    EOF
+    chmod +x $out/bin/bazel-execlog
+
+    # shell completion files
+    installShellCompletion --bash \
+      --name bazel.bash \
+      ./bazel_src/output/bazel-complete.bash
+    installShellCompletion --zsh \
+      --name _bazel \
+      ./bazel_src/scripts/zsh_completion/_bazel
+    installShellCompletion --fish \
+      --name bazel.fish \
+      ./bazel_src/output/bazel-complete.fish
+  '';
+
+  installCheckPhase = ''
+    export TEST_TMPDIR=$(pwd)
+
+    hello_test () {
+      $out/bin/bazel test \
+        --test_output=errors \
+        examples/cpp:hello-success_test \
+        examples/java-native/src/test/java/com/example/myproject:hello
+    }
+
+    cd ./bazel_src
+
+    # If .bazelversion file is present in dist files and doesn't match `bazel` version
+    # running `bazel` command within bazel_src will fail.
+    # Let's remove .bazelversion within the test, if present it is meant to indicate bazel version
+    # to compile bazel with, not version of bazel to be built and tested.
+    rm -f .bazelversion
+
+    # test whether $WORKSPACE_ROOT/tools/bazel works
+
+    mkdir -p tools
+    cat > tools/bazel <<"EOF"
+    #!${runtimeShell} -e
+    exit 1
+    EOF
+    chmod +x tools/bazel
+
+    # first call should fail if tools/bazel is used
+    ! hello_test
+
+    cat > tools/bazel <<"EOF"
+    #!${runtimeShell} -e
+    exec "$BAZEL_REAL" "$@"
+    EOF
+
+    # second call succeeds because it defers to $out/bin/bazel-{version}-{os_arch}
+    hello_test
+
+    ## Test that the GSON serialisation files are present
+    gson_classes=$(unzip -l $(bazel info install_base)/A-server.jar | grep GsonTypeAdapter.class | wc -l)
+    if [ "$gson_classes" -lt 10 ]; then
+      echo "Missing GsonTypeAdapter classes in A-server.jar. Lockfile generation will not work"
+      exit 1
+    fi
+
+    runHook postInstall
+  '';
+
+  # Save paths to hardcoded dependencies so Nix can detect them.
+  # This is needed because the templates get tar’d up into a .jar.
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo "${defaultShellPath}" >> $out/nix-support/depends
+    # The string literal specifying the path to the bazel-rc file is sometimes
+    # stored non-contiguously in the binary due to gcc optimisations, which leads
+    # Nix to miss the hash when scanning for dependencies
+    echo "${bazelRC}" >> $out/nix-support/depends
+  '' + lib.optionalString stdenv.isDarwin ''
+    echo "${cctools}" >> $out/nix-support/depends
+  '';
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  passthru = {
+    # Additional tests that check bazel’s functionality. Execute
+    #
+    #     nix-build . -A bazel_7.tests
+    #
+    # in the nixpkgs checkout root to exercise them locally.
+    tests = callPackage ./tests.nix {
+      inherit Foundation bazel_self lockfile repoCache;
+    };
+
+    # For ease of debugging
+    inherit distDir repoCache lockfile;
+  };
+}
@@ -0,0 +1,89 @@
+{ bazel
+, bazelTest
+, bazel-examples
+, stdenv
+, symlinkJoin
+, callPackage
+, darwin
+, extraBazelArgs ? ""
+, lib
+, openjdk8
+, jdk11_headless
+, runLocal
+, runtimeShell
+, writeScript
+, writeText
+, repoCache ? "unused"
+, distDir
+}:
+
+let
+
+  localDistDir = callPackage ./bazel-repository-cache.nix {
+    lockfile = ./cpp-test-MODULE.bazel.lock;
+
+    # Take all the rules_ deps, bazel_ deps and their transitive dependencies,
+    # but none of the platform-specific binaries, as they are large and useless.
+    requiredDepNamePredicate = name:
+      null == builtins.match ".*(macos|osx|linux|win|apple|android|maven).*" name
+      && null != builtins.match "(platforms|com_google_|protobuf|rules_|bazel_).*" name ;
+  };
+
+  mergedDistDir = symlinkJoin {
+    name = "mergedDistDir";
+    paths = [ localDistDir distDir ];
+  };
+
+  toolsBazel = writeScript "bazel" ''
+    #! ${runtimeShell}
+
+    export CXX='${stdenv.cc}/bin/clang++'
+    export LD='${darwin.cctools}/bin/ld'
+    export LIBTOOL='${darwin.cctools}/bin/libtool'
+    export CC='${stdenv.cc}/bin/clang'
+
+    # XXX: hack for macosX, this flags disable bazel usage of xcode
+    # See: https://github.com/bazelbuild/bazel/issues/4231
+    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+
+    exec "$BAZEL_REAL" "$@"
+  '';
+
+  workspaceDir = runLocal "our_workspace" {} (''
+    cp -r ${bazel-examples}/java-tutorial $out
+    find $out -type d -exec chmod 755 {} \;
+    cp ${./cpp-test-MODULE.bazel} $out/MODULE.bazel
+    cp ${./cpp-test-MODULE.bazel.lock} $out/MODULE.bazel.lock
+  ''
+  + (lib.optionalString stdenv.isDarwin ''
+    mkdir $out/tools
+    cp ${toolsBazel} $out/tools/bazel
+  ''));
+
+  testBazel = bazelTest {
+    name = "bazel-test-java";
+    inherit workspaceDir;
+    bazelPkg = bazel;
+    buildInputs = [ (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless) ];
+    bazelScript = ''
+      ${bazel}/bin/bazel \
+        run \
+        --announce_rc \
+        ${lib.optionalString (lib.strings.versionOlder "5.0.0" bazel.version)
+          "--toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type'"
+        } \
+        --distdir=${mergedDistDir} \
+        --repository_cache=${mergedDistDir} \
+        --verbose_failures \
+        --curses=no \
+        --strict_java_deps=off \
+        //:ProjectRunner \
+    '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
+        --host_javabase='@local_jdk//:jdk' \
+        --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
+        --javabase='@local_jdk//:jdk' \
+    '' + extraBazelArgs;
+  };
+
+in testBazel
+
@@ -0,0 +1,30 @@
+diff --git a/tools/jdk/BUILD.tools b/tools/jdk/BUILD.tools
+index a8af76e90c..7f8b030f63 100644
+--- a/tools/jdk/BUILD.tools
+++ b/tools/jdk/BUILD.tools
+@@ -146,6 +146,25 @@ py_test(
+     ],
+ )
+ 
+##### Nonprebuilt toolchains definitions for NixOS and nix build sandboxes ####
+
+load("@rules_java//toolchains:default_java_toolchain.bzl", "default_java_toolchain", "NONPREBUILT_TOOLCHAIN_CONFIGURATION")
+
+[
+    default_java_toolchain(
+        name = "nonprebuilt_toolchain_java" + str(version),
+        configuration = NONPREBUILT_TOOLCHAIN_CONFIGURATION,
+        java_runtime = "@local_jdk//:jdk",
+        source_version = str(version),
+        target_version = str(version),
+    )
+    # Ideally we would only define toolchains for the java versions that the
+    # local jdk supports. But we cannot access this information in a BUILD
+    # file, and this is a hack anyway, so just pick a large enough upper bound.
+    # At the current pace, java <= 30 should cover all realeases until 2028.
+    for version in range(8, 31)
+]
+
+ #### Aliases to rules_java to keep backward-compatibility (begin) ####
+ 
+ TARGET_NAMES = [
@@ -0,0 +1,51 @@
+diff --git a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+index 845c8b6aa3..6f07298bd0 100644
+--- a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+@@ -171,14 +171,8 @@ public final class RepositoryDelegatorFunction implements SkyFunction {
+ 
+     DigestWriter digestWriter = new DigestWriter(directories, repositoryName, rule);
+     if (shouldUseCachedRepos(env, handler, repoRoot, rule)) {
+-      // Make sure marker file is up-to-date; correctly describes the current repository state
+-      byte[] markerHash = digestWriter.areRepositoryAndMarkerFileConsistent(handler, env);
+-      if (env.valuesMissing()) {
+-        return null;
+-      }
+-      if (markerHash != null) {
+-        return RepositoryDirectoryValue.builder().setPath(repoRoot).setDigest(markerHash).build();
+-      }
+      // Nix hack: Always consider cached dirs as up-to-date
+      return RepositoryDirectoryValue.builder().setPath(repoRoot).setDigest(digestWriter.writeMarkerFile()).build();
+     }
+ 
+     /* At this point: This is a force fetch, a local repository, OR The repository cache is old or
+@@ -512,11 +506,12 @@ public final class RepositoryDelegatorFunction implements SkyFunction {
+         builder.append(escape(key)).append(" ").append(escape(value)).append("\n");
+       }
+       String content = builder.toString();
+-      try {
+-        FileSystemUtils.writeContent(markerPath, UTF_8, content);
+-      } catch (IOException e) {
+-        throw new RepositoryFunctionException(e, Transience.TRANSIENT);
+-      }
+      // Nix hack: Do not write these pesky marker files
+      //try {
+      //  FileSystemUtils.writeContent(markerPath, UTF_8, content);
+      //} catch (IOException e) {
+      //  throw new RepositoryFunctionException(e, Transience.TRANSIENT);
+      //}
+       return new Fingerprint().addString(content).digestAndReset();
+     }
+ 
+diff --git a/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java b/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java
+index 649647c5f2..64d05b530c 100644
+--- a/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java
+++ b/src/main/java/com/google/devtools/build/lib/shell/JavaSubprocessFactory.java
+@@ -165,7 +165,6 @@ public class JavaSubprocessFactory implements SubprocessFactory {
+     }
+     builder.command(argv);
+     if (params.getEnv() != null) {
+-      builder.environment().clear();
+       builder.environment().putAll(params.getEnv());
+     }
+ 
@@ -0,0 +1,171 @@
+{ bazel
+, Foundation
+, bazelTest
+, callPackage
+, darwin
+, distDir
+, extraBazelArgs ? ""
+, fetchFromGitHub
+, fetchurl
+, jdk11_headless
+, lib
+, libtool
+, lndir
+, openjdk8
+, repoCache
+, runLocal
+, runtimeShell
+, stdenv
+, symlinkJoin
+, tree
+, writeScript
+, writeText
+}:
+
+# This test uses bzlmod because I could not make it work without it.
+# This is good, because we have at least one test with bzlmod enabled.
+# However, we have to create our own lockfile, wich is quite a big file by
+# itself.
+
+let
+  # To update the lockfile, run
+  #    $ nix-shell -A bazel_7.tests.vanilla.protobuf
+  #    [nix-shell]$ genericBuild # (wait a bit for failure, or kill it)
+  #    [nix-shell]$ rm -f MODULE.bazel.lock
+  #    [nix-shell]$ bazel mod deps --lockfile_mode=update
+  #    [nix-shell]$ cp MODULE.bazel.lock $HERE/protobuf-test.MODULE.bazel.lock
+  lockfile = ./protobuf-test.MODULE.bazel.lock;
+
+  protobufRepoCache = callPackage ./bazel-repository-cache.nix {
+    # We are somewhat lucky that bazel's own lockfile works for our tests.
+    # Use extraDeps if the tests need things that are not in that lockfile.
+    # But most test dependencies are bazel's builtin deps, so that at least aligns.
+    inherit lockfile;
+
+    # Remove platform-specific binaries, as they are large and useless.
+    requiredDepNamePredicate = name:
+      null == builtins.match ".*(macos|osx|linux|win|android|maven).*" name;
+  };
+
+  mergedRepoCache = symlinkJoin {
+    name = "mergedDistDir";
+    paths = [ protobufRepoCache distDir ];
+  };
+
+  MODULE = writeText "MODULE.bazel" ''
+    bazel_dep(name = "rules_proto", version = "5.3.0-21.7")
+    bazel_dep(name = "protobuf", version = "21.7")
+    bazel_dep(name = "zlib", version = "1.3")
+  '';
+
+  WORKSPACE = writeText "WORKSPACE" ''
+    # Empty, we use bzlmod instead
+  '';
+
+  personProto = writeText "person.proto" ''
+    syntax = "proto3";
+
+    package person;
+
+    message Person {
+      string name = 1;
+      int32 id = 2;
+      string email = 3;
+    }
+  '';
+
+  personBUILD = writeText "BUILD" ''
+    load("@rules_proto//proto:defs.bzl", "proto_library")
+
+    proto_library(
+        name = "person_proto",
+        srcs = ["person.proto"],
+        visibility = ["//visibility:public"],
+    )
+
+    java_proto_library(
+        name = "person_java_proto",
+        deps = [":person_proto"],
+    )
+
+    cc_proto_library(
+        name = "person_cc_proto",
+        deps = [":person_proto"],
+    )
+  '';
+
+  toolsBazel = writeScript "bazel" ''
+    #! ${runtimeShell}
+
+    export CXX='${stdenv.cc}/bin/clang++'
+    export LD='${darwin.cctools}/bin/ld'
+    export LIBTOOL='${darwin.cctools}/bin/libtool'
+    export CC='${stdenv.cc}/bin/clang'
+
+    # XXX: hack for macosX, this flags disable bazel usage of xcode
+    # See: https://github.com/bazelbuild/bazel/issues/4231
+    export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+
+    export HOMEBREW_RUBY_PATH="foo"
+
+    exec "$BAZEL_REAL" "$@"
+  '';
+
+  workspaceDir = runLocal "our_workspace" { } (''
+    mkdir $out
+    cp ${MODULE} $out/MODULE.bazel
+    cp ${./protobuf-test.MODULE.bazel.lock} $out/MODULE.bazel.lock
+    #cp ${WORKSPACE} $out/WORKSPACE
+    touch $out/WORKSPACE
+    touch $out/BUILD.bazel
+    mkdir $out/person
+    cp ${personProto} $out/person/person.proto
+    cp ${personBUILD} $out/person/BUILD.bazel
+  ''
+  + (lib.optionalString stdenv.isDarwin ''
+    echo 'tools bazel created'
+    mkdir $out/tools
+    install ${toolsBazel} $out/tools/bazel
+  ''));
+
+  testBazel = bazelTest {
+    name = "bazel-test-protocol-buffers";
+    inherit workspaceDir;
+    bazelPkg = bazel;
+    buildInputs = [
+      (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless)
+      tree
+      bazel
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      Foundation
+      darwin.objc4
+    ];
+
+    bazelScript = ''
+      ${bazel}/bin/bazel \
+        build \
+        --repository_cache=${mergedRepoCache} \
+        ${extraBazelArgs} \
+        --enable_bzlmod \
+        --lockfile_mode=error \
+        --verbose_failures \
+        //... \
+    '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
+        --host_javabase='@local_jdk//:jdk' \
+        --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
+        --javabase='@local_jdk//:jdk' \
+    '' + lib.optionalString (stdenv.isDarwin) ''
+        --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
+    '' + lib.optionalString (stdenv.cc.isClang && stdenv ? cc.libcxx.cxxabi.libName) ''
+        --linkopt=-Wl,-l${stdenv.cc.libcxx.cxxabi.libName} \
+        --linkopt=-L${stdenv.cc.libcxx.cxxabi}/lib \
+        --host_linkopt=-Wl,-l${stdenv.cc.libcxx.cxxabi.libName} \
+        --host_linkopt=-L${stdenv.cc.libcxx.cxxabi}/lib \
+    '' + ''
+
+    '';
+  };
+
+in
+testBazel
@@ -0,0 +1,21 @@
+diff --git a/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl b/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
+index e2118aabea..6a33f03472 100644
+--- a/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
+++ b/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
+@@ -117,6 +117,7 @@ def java_compile_for_protos(ctx, output_jar_suffix, source_jar = None, deps = []
+             deps = deps,
+             exports = exports,
+             output_source_jar = source_jar,
+            strict_deps = ctx.fragments.proto.strict_proto_deps(),
+             injecting_rule_kind = injecting_rule_kind,
+             javac_opts = java_toolchain.compatible_javacopts("proto"),
+             enable_jspecify = False,
+@@ -140,7 +141,7 @@ bazel_java_proto_aspect = aspect(
+     attr_aspects = ["deps", "exports"],
+     required_providers = [ProtoInfo],
+     provides = [JavaInfo, JavaProtoAspectInfo],
+-    fragments = ["java"],
+    fragments = ["java", "proto"],
+ )
+ 
+ def bazel_java_proto_library_rule(ctx):
@@ -0,0 +1,173 @@
+{ lib
+  # tooling
+, callPackage
+, fetchFromGitHub
+, newScope
+, recurseIntoAttrs
+, runCommandCC
+, stdenv
+  # inputs
+, Foundation
+, bazel_self
+, lr
+, xe
+, lockfile
+, ...
+}:
+let
+  inherit (stdenv.hostPlatform) isDarwin;
+
+  testsDistDir = testsRepoCache;
+  testsRepoCache = callPackage ./bazel-repository-cache.nix {
+    # Bazel builtin tools versions are hard-coded in bazel. If the project
+    # lockfile has not been generated by the same bazel version as this one
+    # then it may be missing depeendencies for builtin tools. Export
+    # dependencies from baazel itself here, and let projects also import their
+    # own if need be. It's just a symlinkJoin after all. See ./cpp-test.nix
+    inherit lockfile;
+
+    # Take all the rules_ deps, bazel_ deps and their transitive dependencies,
+    # but none of the platform-specific binaries, as they are large and useless.
+    requiredDepNamePredicate = name:
+      name == "_main~bazel_build_deps~workspace_repo_cache"
+      || null == builtins.match ".*(macos|osx|linux|win|android|maven).*" name
+      && null != builtins.match "(platforms|com_google_|protobuf|rules_|.*bazel_|apple_support).*" name;
+  };
+
+  runLocal = name: attrs: script:
+    let
+      attrs' = removeAttrs attrs [ "buildInputs" ];
+      buildInputs = attrs.buildInputs or [ ];
+    in
+    runCommandCC name
+      ({
+        inherit buildInputs;
+        preferLocalBuild = true;
+        meta.platforms = bazel_self.meta.platforms;
+      } // attrs')
+      script;
+
+  # bazel wants to extract itself into $install_dir/install every time it runs,
+  # so let’s do that only once.
+  extracted = bazelPkg:
+    let
+      install_dir =
+        # `install_base` field printed by `bazel info`, minus the hash.
+        # yes, this path is kinda magic. Sorry.
+        "$HOME/.cache/bazel/_bazel_nixbld";
+    in
+    runLocal "bazel-extracted-homedir" { passthru.install_dir = install_dir; } ''
+      export HOME=$(mktemp -d)
+      touch WORKSPACE # yeah, everything sucks
+      install_base="$(${bazelPkg}/bin/bazel info install_base)"
+      # assert it’s actually below install_dir
+      [[ "$install_base" =~ ${install_dir} ]] \
+        || (echo "oh no! $install_base but we are \
+      trying to copy ${install_dir} to $out instead!"; exit 1)
+      cp -R ${install_dir} $out
+    '';
+
+  bazelTest = { name, bazelScript, workspaceDir, bazelPkg, buildInputs ? [ ] }:
+    runLocal name
+      {
+        inherit buildInputs;
+        # Necessary for the tests to pass on Darwin with sandbox enabled.
+        __darwinAllowLocalNetworking = true;
+      }
+      ''
+        # Bazel needs a real home for self-extraction and internal cache
+        mkdir bazel_home
+        export HOME=$PWD/bazel_home
+
+        ${# Concurrent bazel invocations have the same workspace path.
+          # On darwin, for some reason, it means they access and corrupt the
+          # same outputRoot, outputUserRoot and outputBase
+          # Ensure they use build-local outputRoot by setting TEST_TMPDIR
+          lib.optionalString isDarwin ''
+            export TEST_TMPDIR=$HOME/.cache/bazel
+          ''
+        }
+        ${# Speed-up tests by caching bazel extraction.
+          # Except on Darwin, because nobody knows how Darwin works.
+          let bazelExtracted = extracted bazelPkg;
+          in lib.optionalString (!isDarwin) ''
+            mkdir -p ${bazelExtracted.install_dir}
+            cp -R ${bazelExtracted}/install ${bazelExtracted.install_dir}
+
+            # https://stackoverflow.com/questions/47775668/bazel-how-to-skip-corrupt-installation-on-centos6
+            # Bazel checks whether the mtime of the install dir files
+            # is >9 years in the future, otherwise it extracts itself again.
+            # see PosixFileMTime::IsUntampered in src/main/cpp/util
+            # What the hell bazel.
+            ${lr}/bin/lr -0 -U ${bazelExtracted.install_dir} | ${xe}/bin/xe -N0 -0 touch --date="9 years 6 months" {}
+          ''
+        }
+        ${# Note https://github.com/bazelbuild/bazel/issues/5763#issuecomment-456374609
+          # about why to create a subdir for the workspace.
+          '' cp -r ${workspaceDir} wd && chmod ug+rw -R wd && cd wd ''
+        }
+        ${# run the actual test snippet
+          bazelScript
+        }
+        ${# Try to keep darwin clean of our garbage
+          lib.optionalString isDarwin ''
+            rm -rf $HOME || true
+          ''
+        }
+
+        touch $out
+      '';
+
+  bazel-examples = fetchFromGitHub {
+    owner = "bazelbuild";
+    repo = "examples";
+    rev = "93564e1f1e7a3c39d6a94acee12b8d7b74de3491";
+    hash = "sha256-DaPKp7Sn5uvfZRjdDx6grot3g3B7trqCyL0TRIdwg98=";
+  };
+
+  callBazelTests = bazel:
+    let
+      callBazelTest = newScope {
+        inherit runLocal bazelTest bazel-examples;
+        inherit Foundation;
+        inherit bazel;
+        distDir = testsDistDir;
+        extraBazelArgs = "--noenable_bzlmod";
+        repoCache = testsRepoCache;
+      };
+    in
+    recurseIntoAttrs (
+      (lib.optionalAttrs (!isDarwin) {
+        # `extracted` doesn’t work on darwin
+        shebang = callBazelTest ../shebang-test.nix {
+          inherit extracted;
+          extraBazelArgs = "--noenable_bzlmod";
+        };
+      }) // {
+        bashTools = callBazelTest ../bash-tools-test.nix { };
+        cpp = callBazelTest ./cpp-test.nix {
+          extraBazelArgs = "";
+        };
+        java = callBazelTest ./java-test.nix { };
+        pythonBinPath = callBazelTest ../python-bin-path-test.nix { };
+        protobuf = callBazelTest ./protobuf-test.nix { };
+      }
+    );
+
+  bazelWithNixHacks = bazel_self.override { enableNixHacks = true; };
+
+in
+recurseIntoAttrs {
+  distDir = testsDistDir;
+  testsRepoCache = testsRepoCache;
+
+  vanilla = callBazelTests bazel_self;
+  withNixHacks = callBazelTests bazelWithNixHacks;
+
+  # add some downstream packages using buildBazelPackage
+  downstream = recurseIntoAttrs ({
+    # TODO: fix bazel-watcher build with bazel 7, or find other packages
+    #inherit bazel-watcher;
+  });
+}
+
@@ -0,0 +1,17 @@
+diff --git a/tools/cpp/osx_cc_wrapper.sh.tpl b/tools/cpp/osx_cc_wrapper.sh.tpl
+index 8264090c29..b7b9e8537a 100644
+--- a/tools/cpp/osx_cc_wrapper.sh.tpl
+++ b/tools/cpp/osx_cc_wrapper.sh.tpl
+@@ -64,7 +64,11 @@ done
+ %{env}
+ 
+ # Call the C++ compiler
+-%{cc} "$@"
+if [[ ${*: -1} = "" ]]; then
+    %{cc} "${@:0:$#}"
+else
+    %{cc} "$@"
+fi
+ 
+ function get_library_path() {
+     for libdir in ${LIB_DIRS}; do
@@ -0,0 +1,13 @@
+--- a/tools/osx/BUILD
+++ b/tools/osx/BUILD
+@@ -28,8 +28,8 @@ exports_files([
+ 
+ DARWIN_XCODE_LOCATOR_COMPILE_COMMAND = """
+   /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.13 -fobjc-arc -framework CoreServices \
+-      -framework Foundation -arch arm64 -arch x86_64 -Wl,-no_adhoc_codesign -Wl,-no_uuid -o $@ $< && \
+      -framework Foundation                          -Wl,-no_adhoc_codesign -Wl,-no_uuid -o $@ $< && \
+-  env -i codesign --identifier $@ --force --sign - $@
+  /usr/bin/env -i /usr/bin/codesign --identifier $@ --force --sign - $@
+ """
+ 
+ genrule(
@@ -4,12 +4,14 @@
 , bazel-examples
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , runLocal
 , runtimeShell
 , writeScript
 , writeText
 , distDir
+, Foundation ? null
 }:

 let
@@ -43,15 +45,17 @@ let
    inherit workspaceDir;
    bazelPkg = bazel;
    bazelScript = ''
-      ${bazel}/bin/bazel \
-        build --verbose_failures \
+      ${bazel}/bin/bazel build //... \
+        --verbose_failures \
        --distdir=${distDir} \
        --curses=no \
-        --sandbox_debug \
-        //... \
+        ${extraBazelArgs} \
    '' + lib.optionalString (stdenv.isDarwin) ''
        --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
        --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
+    '' + lib.optionalString (stdenv.isDarwin && Foundation != null) ''
+        --linkopt=-Wl,-F${Foundation}/Library/Frameworks \
+        --linkopt=-L${darwin.libobjc}/lib \
    '';
  };

@@ -1,9 +1,9 @@
-{
-  bazel
+{ bazel
 , bazelTest
 , bazel-examples
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , openjdk8
 , jdk11_headless
@@ -48,17 +48,20 @@ let
    bazelScript = ''
      ${bazel}/bin/bazel \
        run \
+        --announce_rc \
+        ${lib.optionalString (lib.strings.versionOlder "5.0.0" bazel.version)
+          "--toolchain_resolution_debug='@bazel_tools//tools/jdk:(runtime_)?toolchain_type'"
+        } \
        --distdir=${distDir} \
        --verbose_failures \
        --curses=no \
-        --sandbox_debug \
        --strict_java_deps=off \
        //:ProjectRunner \
    '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
        --host_javabase='@local_jdk//:jdk' \
        --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
        --javabase='@local_jdk//:jdk' \
-    '';
+    '' + extraBazelArgs;
  };

 in testBazel
@@ -170,7 +170,7 @@ let
        --distdir=${distDir} \
        --verbose_failures \
        --curses=no \
-        --sandbox_debug \
+        --subcommands \
        --strict_java_deps=off \
        --strict_proto_deps=off \
        //... \
@@ -3,6 +3,7 @@
 , bazelTest
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , runLocal
 , runtimeShell
@@ -77,6 +78,7 @@ let
      ${bazel}/bin/bazel \
        run \
        --distdir=${distDir} \
+        ${extraBazelArgs} \
        //python:bin
    '';
  };
@@ -1,10 +1,11 @@
 {
  bazel
 , bazelTest
-, distDir
 , extracted
+, ripgrep
 , runLocal
 , unzip
+, ...
 }:

 # Tests that all shebangs are patched appropriately.
@@ -24,18 +25,26 @@ let
      FAIL=
      check_shebangs() {
        local dir="$1"
-        { grep -Re '#!/usr/bin' $dir && FAIL=1; } || true
-        { grep -Re '#![^[:space:]]*/bin/env' $dir && FAIL=1; } || true
+        { rg -e '#!/usr/bin' -e '#![^[:space:]]*/bin/env' $dir -e && echo && FAIL=1; } || true
      }
-      BAZEL_EXTRACTED=${extracted bazel}/install
-      check_shebangs $BAZEL_EXTRACTED
-      while IFS= read -r -d "" zip; do
-        unzipped="./$zip/UNPACKED"
-        mkdir -p "$unzipped"
-        unzip -qq $zip -d "$unzipped"
-        check_shebangs "$unzipped"
-        rm -rf unzipped
-      done < <(find $BAZEL_EXTRACTED -type f -name '*.zip' -or -name '*.jar' -print0)
+      extract() {
+        local dir="$1"
+        find "$dir" -type f '(' -name '*.zip' -or -name '*.jar' ')' -print0 \
+        | while IFS="" read -r -d "" zip ; do
+          echo "Extracting $zip"
+          local unzipped="$zip-UNPACKED"
+          mkdir -p "$unzipped"
+          unzip -qq $zip -d "$unzipped"
+          extract "$unzipped"
+          rm -rf "$unzipped" "$zip" || true
+        done
+        check_shebangs "$dir"
+      }
+
+      mkdir install_root
+      cp --no-preserve=all -r ${extracted bazel}/install/*/* install_root/
+      extract ./install_root
+
      if [[ $FAIL = 1 ]]; then
        echo "Found files in the bazel distribution with illegal shebangs." >&2
        echo "Replace those by explicit Nix store paths." >&2
@@ -43,7 +52,7 @@ let
        exit 1
      fi
    '';
-    buildInputs = [ unzip ];
+    buildInputs = [ unzip ripgrep ];
  };

 in testBazel
@@ -18566,6 +18566,17 @@ with pkgs;
    bazel_self = bazel_6;
  };

+  bazel_7 = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_7 {
+    inherit (darwin) cctools sigtool;
+    inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation CoreServices Foundation IOKit;
+    buildJdk = jdk17_headless;
+    runJdk = jdk17_headless;
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv
+      else if stdenv.cc.isClang then llvmPackages.stdenv
+      else stdenv;
+    bazel_self = bazel_7;
+  };
+
  bazel-buildtools = callPackage ../development/tools/build-managers/bazel/buildtools { };
  buildifier = bazel-buildtools;
  buildozer = bazel-buildtools;