hermetic llvm

Author: MarcusSorealheis

.bazelrc

@@ -34,6 +34,19 @@ common --@rules_python//python/config_settings:py_linux_libc=musl
 # Don't leak PATH and LD_LIBRARY_PATH into the build.
 build --incompatible_strict_action_env
 
+# hermetic-llvm <-> rules_rs interop. These are harmless when LRE-CC is the
+# active CC toolchain (Nix path) and required when hermetic-llvm provides it
+# (non-Nix path):
+#   - Rust passes -lgcc_s when linking, so libgcc_s must be stubbed.
+#   - cc-rs doesn't honor $AR/$ARFLAGS, so disable llvm-libtool-darwin as the
+#     default macOS archiver.
+# Musl + PIE harmonization (Rust forces -no-pie; hermetic-llvm defaults to
+# -static-pie) is a follow-up: it requires adding @llvm//constraints/pie:off
+# to the lre-rs musl platforms, which are @generated and need a generator-side
+# change.
+build --@llvm//config:experimental_stub_libgcc_s=True
+build --@rules_cc//cc/toolchains/args/archiver_flags:use_libtool_on_macos=False
+
 # Don't use legacy repository rules.
 build --incompatible_disable_native_repo_rules
 

MODULE.bazel

@@ -10,6 +10,15 @@ bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "rules_python", version = "2.0.0")
 bazel_dep(name = "rules_shell", version = "0.6.1")
 
+# hermetic-llvm: zero-sysroot, fully hermetic LLVM cross-compilation toolchain.
+# Inside Nix, lre.bazelrc registers @local-remote-execution//generated-cc/...
+# via --extra_toolchains, which outranks the MODULE.bazel registration below,
+# so Nix users keep getting LRE-CC unchanged. Outside Nix (no lre.bazelrc),
+# these hermetic toolchains replace the host autodetect path.
+bazel_dep(name = "llvm", version = "0.7.7")
+
+register_toolchains("@llvm//toolchain:all")
+
 # We use the Nix Python install, as per https://rules-python.readthedocs.io/en/latest/toolchains.html#local-toolchain
 # Can't use the rules_python download versions as it breaks with the genrule stuff in nativelink-proto
 # Also, this way around we get a Nix-locked Python binary

local-remote-execution/flake-module.nix

@@ -151,6 +151,7 @@
                     # Explicitly duplicate the host as an execution platform. This way
                     # local execution is treated the same as remote execution.
                     "@local-remote-execution//rust/platforms:${nixExecToRustExec pkgs}"
+                    "@local-remote-execution//rust/platforms:${nixExecToDefaultRustTarget pkgs}"
                   ]
                   ++ lib.optionals pkgs.stdenv.isLinux [
                     # TODO(palfrey): Reimplement rbe-configs-gen for C++ so that we

toolchain-examples/MODULE.bazel

@@ -45,9 +45,11 @@ archive_override(
     urls = ["https://github.com/bazel-contrib/rules_go/archive/74199c92e20399b6ef46684b2c6fdd94b50a7892.zip"],
 )
 
+# TODO(marcussorealheis): remove this comment once fully observed and released
 # Rust — see the parent MODULE.bazel for the archive_override that pins
 # rules_rust to the hermeticbuild fork.
-bazel_dep(name = "rules_rust", version = "0.68.1")
+# was bazel_dep(name = "rules_rust", version = "0.68.1"), is:
+bazel_dep(name = "rules_rs", version = "0.0.76")
 
 # C++ toolchain via zig-cc.
 #