cc-wrapper: use -fmacro-prefix-map to scrub __FILE__ references (#429880)

pkgs/build-support/cc-wrapper/default.nix

@@ -365,6 +365,22 @@ let
     else
       targetPlatform.darwinPlatform
   );
+
+  # Header files that use `__FILE__` (e.g., for error reporting) lead
+  # to unwanted references to development packages and outputs in built
+  # binaries, like C++ programs depending on GCC and Boost at runtime.
+  #
+  # We use `-fmacro-prefix-map` to avoid the store references in these
+  # situations while keeping them in compiler diagnostics and debugging
+  # and profiling output.
+  #
+  # Unfortunately, doing this with GCC runs into issues with compiler
+  # argument length limits due to <https://gcc.gnu.org/PR111527>, so we
+  # disable it there in favour of our existing patch.
+  #
+  # TODO: Drop `mangle-NIX_STORE-in-__FILE__.patch` from GCC and make
+  # this unconditional once the upstream bug is fixed.
+  useMacroPrefixMap = !isGNU;
 in
 
 assert includeFortifyHeaders' -> fortify-headers != null;
@@ -457,6 +473,14 @@ stdenvNoCC.mkDerivation {
       substituteAll "$wrapper" "$out/bin/$dst"
       chmod +x "$out/bin/$dst"
     }
+
+    include() {
+      printf -- '%s %s\n' "$1" "$2"
+      ${lib.optionalString useMacroPrefixMap ''
+        local scrubbed="$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-''${2#"$NIX_STORE"/*-}"
+        printf -- '-fmacro-prefix-map=%s=%s\n' "$2" "$scrubbed"
+      ''}
+    }
   ''
 
   + (
@@ -675,13 +699,13 @@ stdenvNoCC.mkDerivation {
         echo "-B${libc_lib}${libc.libdir or "/lib/"}" >> $out/nix-support/libc-crt1-cflags
       ''
       + optionalString (!(cc.langD or false)) ''
-        echo "-${
+        include "-${
           if isArocc then "I" else "idirafter"
-        } ${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
+        }" "${libc_dev}${libc.incdir or "/include"}" >> $out/nix-support/libc-cflags
       ''
       + optionalString (isGNU && (!(cc.langD or false))) ''
         for dir in "${cc}"/lib/gcc/*/*/include-fixed; do
-          echo '-idirafter' ''${dir} >> $out/nix-support/libc-cflags
+          include '-idirafter' ''${dir} >> $out/nix-support/libc-cflags
         done
       ''
       + ''
@@ -697,7 +721,7 @@ stdenvNoCC.mkDerivation {
       # like option that forces the libc headers before all -idirafter,
       # hence -isystem here.
       + optionalString includeFortifyHeaders' ''
-        echo "-isystem ${fortify-headers}/include" >> $out/nix-support/libc-cflags
+        include -isystem "${fortify-headers}/include" >> $out/nix-support/libc-cflags
       ''
     )
 
@@ -720,19 +744,19 @@ stdenvNoCC.mkDerivation {
     # https://github.com/NixOS/nixpkgs/pull/209870#issuecomment-1500550903)
     + optionalString (libcxx == null && isClang && (useGccForLibs && gccForLibs.langCC or false)) ''
       for dir in ${gccForLibs}/include/c++/*; do
-        echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
+        include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
       for dir in ${gccForLibs}/include/c++/*/${targetPlatform.config}; do
-        echo "-isystem $dir" >> $out/nix-support/libcxx-cxxflags
+        include -isystem "$dir" >> $out/nix-support/libcxx-cxxflags
       done
     ''
     + optionalString (libcxx.isLLVM or false) ''
-      echo "-isystem ${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
+      include -isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
     ''
     # GCC NG friendly libc++
     + optionalString (libcxx != null && libcxx.isGNU or false) ''
-      echo "-isystem ${getDev libcxx}/include" >> $out/nix-support/libcxx-cxxflags
+      include -isystem "${getDev libcxx}/include" >> $out/nix-support/libcxx-cxxflags
     ''
 
     ##
@@ -951,6 +975,7 @@ stdenvNoCC.mkDerivation {
     inherit libc_bin libc_dev libc_lib;
     inherit darwinPlatformForCC;
     default_hardening_flags_str = builtins.toString defaultHardeningFlags;
+    inherit useMacroPrefixMap;
   }
   // lib.mapAttrs (_: lib.optionalString targetPlatform.isDarwin) {
     # These will become empty strings when not targeting Darwin.

pkgs/build-support/cc-wrapper/setup-hook.sh

@@ -68,12 +68,21 @@ ccWrapper_addCVars () {
     local role_post
     getHostRoleEnvHook
 
+    local found=
+
     if [ -d "$1/include" ]; then
         export NIX_CFLAGS_COMPILE${role_post}+=" -isystem $1/include"
+        found=1
     fi
 
     if [ -d "$1/Library/Frameworks" ]; then
         export NIX_CFLAGS_COMPILE${role_post}+=" -iframework $1/Library/Frameworks"
+        found=1
+    fi
+
+    if [[ -n "@useMacroPrefixMap@" && -n ${NIX_STORE:-} && -n $found ]]; then
+        local scrubbed="$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-${1#"$NIX_STORE"/*-}"
+        export NIX_CFLAGS_COMPILE${role_post}+=" -fmacro-prefix-map=$1=$scrubbed"
     fi
 }
 

pkgs/by-name/ed/edencommon/package.nix

@@ -6,7 +6,6 @@
 
   cmake,
   ninja,
-  sanitiseHeaderPathsHook,
 
   glog,
   gflags,
@@ -46,7 +45,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     ninja
-    sanitiseHeaderPathsHook
   ];
 
   buildInputs = [

pkgs/by-name/fb/fbthrift/package.nix

@@ -7,7 +7,6 @@
 
   cmake,
   ninja,
-  sanitiseHeaderPathsHook,
 
   openssl,
   gflags,
@@ -64,7 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     ninja
-    sanitiseHeaderPathsHook
   ];
 
   buildInputs = [

pkgs/by-name/fi/fizz/package.nix

@@ -6,7 +6,6 @@
 
   cmake,
   ninja,
-  sanitiseHeaderPathsHook,
 
   openssl,
   glog,
@@ -48,7 +47,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     ninja
-    sanitiseHeaderPathsHook
   ];
 
   buildInputs = [

pkgs/by-name/fo/folly/package.nix

@@ -8,7 +8,6 @@
   cmake,
   ninja,
   pkg-config,
-  sanitiseHeaderPathsHook,
 
   double-conversion,
   fast-float,
@@ -59,7 +58,6 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     pkg-config
-    sanitiseHeaderPathsHook
   ];
 
   # See CMake/folly-deps.cmake in the Folly source tree.

pkgs/by-name/gt/gtest/package.nix

@@ -4,7 +4,6 @@
   fetchFromGitHub,
   cmake,
   ninja,
-  sanitiseHeaderPathsHook,
   # Enable C++17 support
   #     https://github.com/google/googletest/issues/3081
   # Projects that require a higher standard can override this package.
@@ -48,7 +47,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     ninja
-    sanitiseHeaderPathsHook
   ];
 
   cmakeFlags = [

pkgs/by-name/mv/mvfst/package.nix

@@ -6,7 +6,6 @@
 
   cmake,
   ninja,
-  sanitiseHeaderPathsHook,
 
   folly,
   gflags,
@@ -43,7 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     ninja
-    sanitiseHeaderPathsHook
   ];
 
   buildInputs = [

pkgs/by-name/sa/sanitiseHeaderPathsHook/package.nix

@@ -1,18 +0,0 @@
-{
-  lib,
-  makeSetupHook,
-  removeReferencesTo,
-}:
-
-makeSetupHook {
-  name = "sanitise-header-paths-hook";
-
-  substitutions = {
-    removeReferencesTo = lib.getExe removeReferencesTo;
-  };
-
-  meta = {
-    description = "Setup hook to sanitise header file paths to avoid leaked references through `__FILE__`";
-    maintainers = [ lib.maintainers.emily ];
-  };
-} ./sanitise-header-paths-hook.bash

pkgs/by-name/sa/sanitiseHeaderPathsHook/sanitise-header-paths-hook.bash

@@ -1,10 +0,0 @@
-sanitiseHeaderPaths() {
-  local header
-  while IFS= read -r -d '' header; do
-    nixLog "sanitising header path in $header"
-    sed -i "1i#line 1 \"$header\"" "$header"
-    @removeReferencesTo@ -t "${!outputInclude}" "$header"
-  done < <(find "${!outputInclude}/include" -type f -print0)
-}
-
-preFixupHooks+=(sanitiseHeaderPaths)

pkgs/by-name/wa/wangle/package.nix

@@ -6,7 +6,6 @@
 
   cmake,
   ninja,
-  sanitiseHeaderPathsHook,
 
   folly,
   fizz,
@@ -44,7 +43,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     ninja
-    sanitiseHeaderPathsHook
   ];
 
   buildInputs = [

pkgs/development/compilers/gcc/common/dependencies.nix

@@ -12,7 +12,6 @@
   gmp,
   mpfr,
   libmpc,
-  sanitiseHeaderPathsHook,
   libucontext ? null,
   libxcrypt ? null,
   isSnapshot ? false,
@@ -42,10 +41,6 @@ in
     texinfo
     which
     gettext
-
-    # Prevent GCC leaking into the runtime closure of C++ packages
-    # through headers using `__FILE__`.
-    sanitiseHeaderPathsHook
   ]
   ++ optionals (perl != null) [ perl ]
   ++ optionals (with stdenv.targetPlatform; isVc4 || isRedox || isSnapshot && flex != null) [ flex ]

pkgs/development/compilers/gcc/default.nix

@@ -49,7 +49,6 @@
     !enablePlugin
     || (stdenv.targetPlatform.isAvr && stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64),
   nukeReferences,
-  sanitiseHeaderPathsHook,
   callPackage,
   majorMinorVersion,
   apple-sdk,
@@ -184,7 +183,6 @@ let
       pkgsBuildTarget
       profiledCompiler
       reproducibleBuild
-      sanitiseHeaderPathsHook
       staticCompiler
       stdenv
       targetPackages

pkgs/development/compilers/gcc/patches/default.nix

@@ -83,6 +83,10 @@ in
         # Do not try looking for binaries and libraries in /lib and /usr/lib
         ./13/no-sys-dirs-riscv.patch
         # Mangle the nix store hash in __FILE__ to prevent unneeded runtime references
+        #
+        # TODO: Remove these and the `useMacroPrefixMap` conditional
+        # in `cc-wrapper` once <https://gcc.gnu.org/PR111527>
+        # is fixed.
         ./13/mangle-NIX_STORE-in-__FILE__.patch
       ];
       "14" = [

pkgs/development/libraries/boost/generic.nix

@@ -10,7 +10,6 @@
   fixDarwinDylibNames,
   libiconv,
   libxcrypt,
-  sanitiseHeaderPathsHook,
   makePkgconfigItem,
   copyPkgconfigItems,
   boost-build,
@@ -348,7 +347,6 @@ stdenv.mkDerivation {
     which
     boost-build
     copyPkgconfigItems
-    sanitiseHeaderPathsHook
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
   buildInputs = [
@@ -396,12 +394,6 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  preFixup = ''
-    # Strip UTF‐8 BOMs for `sanitiseHeaderPathsHook`.
-    cd "$dev" && find include \( -name '*.hpp' -or -name '*.h' -or -name '*.ipp' \) \
-      -exec sed '1s/^\xef\xbb\xbf//' -i '{}' \;
-  '';
-
   postFixup = lib.optionalString stdenv.hostPlatform.isMinGW ''
     $RANLIB "$out/lib/"*.a
   '';