chore: upgrade rules_rust to 0.71.3 (#10632)

Upgrades `rules_rust` from 0.69.0 to 0.71.3.

- Drops `bazel/rules_rust_package_alias.patch`: the `package_alias`
attribute is upstreamed in 0.71.3
([rules_rust#3742](bazelbuild/rules_rust#3742)).
- Regenerates `bazel/rules_rust_strip_level.patch` for 0.71.3: still
needed because the native `rust.toolchain` `strip_level` tag attribute
is a flat `string_dict` that cannot express the per-compilation-mode
config (and is looked up by target triple downstream)
([rules_rust#3730](bazelbuild/rules_rust#3730)).
- Adds `bazel/rules_rust_dep_env.patch`: rules_rust 0.71.x redacts the
producer's out_dir to a generic `${out_dir}` token in dep env files, but
those files are consumed by *downstream* crates' build scripts whose
`--out-dir` differs, leaving the token unresolved (e.g. `libssh2-sys`
failing to find `zlib.h` from `libz-sys`'s `DEP_Z_INCLUDE`).
- Updates `bazel/hermetic_cc_toolchain_strip.patch`: the zig-wrapper now
invokes `strip` via an absolute path (`/usr/bin/strip` or `/bin/strip`,
failing with a clear error if neither exists), because rules_rust 0.71.x
runs the wrapper at rustdoc doc-test time with a cleared environment (no
`PATH`), where a bare `strip` fails to resolve.
- Repins the Cargo Bazel lockfile (checksum-only change).
- Switches test `env` attributes from `$(locations ...)` to `$(rootpaths
...)`: since
[rules_rust#4088](bazelbuild/rules_rust#4088)
(0.71.x) the plural `$(locations ...)`/`$(execpaths ...)` forms are
`${pwd}`-prefixed like the singular forms; that token is only
substituted during build actions, so test runtime envs saw literal
`${pwd}/...` paths. `$(rootpaths ...)` is deliberately left unmodified
for runtime use.

---------

Co-authored-by: IDX GitHub Automation <infra+github-automation@dfinity.org>

Author: basvandijk

Cargo.Bazel.json.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "c19078f9cd882fc228f7bb8d94437446b00320b3fe2bf5dd342d438fcf79b8f3",
+  "checksum": "f78d53f7469ce9942ae6b5291f59924ee6a7937f946111f9b53c1cbbb9e83e25",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",

bazel/hermetic_cc_toolchain_strip.patch

@@ -59,7 +59,7 @@ index 5584f44..42f84d5 100644
          },
      }
  }
-@@ -152,13 +152,53 @@ fn spawnWindows(arena: mem.Allocator, params: ExecParams) u8 {
+@@ -152,13 +152,59 @@ fn spawnWindows(arena: mem.Allocator, params: ExecParams) u8 {
      }
  }
 
@@ -71,10 +71,16 @@ index 5584f44..42f84d5 100644
 -    );
 -    return 1;
 +fn spawnAndStripUnix(arena: mem.Allocator, params: ExecParams) u8 {
-+    // Build a strip command
++    // Build a strip command. Use an absolute path: this wrapper also runs at
++    // rustdoc doc-test time where the environment is cleared (no PATH), so a
++    // bare "strip" would fail to resolve with error.FileNotFound.
++    const strip_bin = for ([_][]const u8{ "/usr/bin/strip", "/bin/strip" }) |p| {
++        std.fs.accessAbsolute(p, .{}) catch continue;
++        break p;
++    } else return fatal("strip binary not found (checked /usr/bin/strip and /bin/strip)\n", .{});
 +    const strip_cmd = blk: {
 +        var list = ArrayListUnmanaged([]const u8){};
-+        list.appendSlice(arena, &[_][]const u8{ "strip", "-S" }) catch |err| {
++        list.appendSlice(arena, &[_][]const u8{ strip_bin, "-S" }) catch |err| {
 +            return fatal("error building strip cmd: {s}\n", .{@errorName(err)});
 +        };
 +

bazel/rules_rust_dep_env.patch

@@ -0,0 +1,34 @@
+# Fix cross-crate DEP_* env vars: rules_rust 0.71.x redacts the producer's out_dir
+# to a generic ${out_dir} token in dep env files, but those files are consumed by
+# downstream crates' build scripts whose --out-dir differs, leaving the token
+# unresolved (e.g. libssh2-sys failing to find zlib.h from libz-sys's DEP_Z_INCLUDE).
+# Upstream issue: the 'env files are only consumed by the direct owner' assumption
+# in redact_paths() does not hold for outputs_to_dep_env().
+# Fixed upstream by https://github.com/bazelbuild/rules_rust/pull/4124:
+# drop this patch when upgrading to a release that includes it.
+diff --git a/cargo/private/cargo_build_script_runner/lib.rs b/cargo/private/cargo_build_script_runner/lib.rs
+--- a/cargo/private/cargo_build_script_runner/lib.rs
++++ b/cargo/private/cargo_build_script_runner/lib.rs
+@@ -181,7 +181,7 @@
+         outputs: &[BuildScriptOutput],
+         crate_links: &str,
+         exec_root: &str,
+-        out_dir: &str,
++        _out_dir: &str,
+     ) -> String {
+         let prefix = format!("DEP_{}_", crate_links.replace('-', "_").to_uppercase());
+         outputs
+@@ -191,7 +191,12 @@
+                     Some(format!(
+                         "{}{}",
+                         prefix,
+-                        Self::escape_for_serializing(Self::redact_paths(env, exec_root, out_dir))
++                        // Do NOT redact the producer's out_dir to the generic `${out_dir}`
++                        // token here: DEP_* env vars are consumed by *downstream* crates'
++                        // build scripts, whose process_wrapper `--out-dir` points to a
++                        // different directory, so the token would resolve incorrectly
++                        // (or not at all). Only the exec root is safe to substitute.
++                        Self::escape_for_serializing(Self::redact_exec_root(env, exec_root))
+                     ))
+                 } else {
+                     None

bazel/rules_rust_package_alias.patch

@@ -1,17 +1,21 @@
 # support for per-platform strip levels: https://github.com/bazelbuild/rules_rust/issues/3730
+# rules_rust 0.71.3 added a `strip_level` attribute to the `rust.toolchain` tag, but it is a flat
+# `attr.string_dict` that cannot express the per-compilation-mode config, and it is passed
+# unwrapped to `rust_register_toolchains` which looks it up by target triple. Override it here.
 diff --git a/rust/extensions.bzl b/rust/extensions.bzl
-index 99868b0df..5932b0760 100644
+index da2830f08..b7665652e 100644
 --- a/rust/extensions.bzl
 +++ b/rust/extensions.bzl
-@@ -122,6 +122,11 @@ def _rust_impl(module_ctx):
-                 toolchain_triples = toolchain_triples,
-                 target_settings = [str(v) for v in toolchain.target_settings],
-                 extra_toolchain_infos = extra_toolchain_infos,
+@@ -140,7 +140,11 @@ def _rust_impl(module_ctx):
+                 sha256s = toolchain.sha256s,
+                 extra_target_triples = toolchain.extra_target_triples,
+                 opt_level = toolchain.opt_level if toolchain.opt_level else None,
+-                strip_level = toolchain.strip_level if toolchain.strip_level else None,
 +                strip_level = {"x86_64-unknown-linux-gnu": {
 +                    "dbg": "none",
 +                    "fastbuild": "none",
 +                    "opt": "none",
 +                }},
-             )
-     metadata_kwargs = {}
-     if bazel_features.external_deps.extension_metadata_has_reproducible:
+                 urls = toolchain.urls,
+                 versions = toolchain.versions,
+                 compact_windows_names = True,

bazel/rules_rust_strip_level.patch

@@ -2,16 +2,21 @@
 # Run `./bin/bazel-pin.sh` from the top-level directory of the working tree after changing this file
 # to regenerate Cargo Bazel lockfiles.
 
-bazel_dep(name = "rules_rust", version = "0.69.0")
+bazel_dep(name = "rules_rust", version = "0.71.3")
 archive_override(
     module_name = "rules_rust",
-    integrity = "sha256-u8dkwlLQYSgbI1knek1GSA4tz69yr8HObgCtpYzL/Uw=",
+    integrity = "sha256-h8txtdi9xcNfgjdTBYX+R9CEsxKDucJx+OPvezmkTQM=",
     patch_strip = 1,
     patches = [
+        # Configure per-compilation-mode strip levels, which the native
+        # `rust.toolchain` tag's flat `strip_level` string_dict cannot express
+        # (https://github.com/bazelbuild/rules_rust/issues/3730).
         "//bazel:rules_rust_strip_level.patch",
-        "//bazel:rules_rust_package_alias.patch",
+        # Fix cross-crate DEP_* env vars being redacted to an `${out_dir}` token
+        # that downstream crates' build scripts cannot resolve (see patch header).
+        "//bazel:rules_rust_dep_env.patch",
     ],
-    urls = ["https://github.com/bazelbuild/rules_rust/releases/download/0.69.0/rules_rust-0.69.0.tar.gz"],
+    urls = ["https://github.com/bazelbuild/rules_rust/releases/download/0.71.3/rules_rust-0.71.3.tar.gz"],
 )
 
 rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")

bazel/rust.MODULE.bazel

@@ -48,7 +48,7 @@ rust_test(
     crate = ":ckdoge_minter_lib",
     data = [":test_vectors"],
     env = {
-        "TEST_VECTORS": "$(locations :test_vectors)",
+        "TEST_VECTORS": "$(rootpaths :test_vectors)",
     },
     proc_macro_deps = [
         # Keep sorted.

rs/dogecoin/ckdoge/minter/BUILD.bazel

@@ -458,7 +458,7 @@ rust_ic_test(
     env = {
         "NEURON_CSV_PATH": "$(rootpath :tests/neurons.csv)",
         "TLA_APALACHE_BIN": "$(rootpath @tla_apalache//:bin/apalache-mc)",
-        "TLA_MODULES": "$(locations :tla_models)",
+        "TLA_MODULES": "$(rootpaths :tla_models)",
     },
     proc_macro_deps = MACRO_DEPENDENCIES + ["//rs/tla_instrumentation:proc_macros"],
     tags = ["long_test"],
@@ -487,7 +487,7 @@ rust_ic_test(
     env = {
         "NEURON_CSV_PATH": "$(rootpath :tests/neurons.csv)",
         "TLA_APALACHE_BIN": "$(rootpath @tla_apalache//:bin/apalache-mc)",
-        "TLA_MODULES": "$(locations :tla_models)",
+        "TLA_MODULES": "$(rootpaths :tla_models)",
     },
     proc_macro_deps = MACRO_DEPENDENCIES + ["//rs/tla_instrumentation:proc_macros"],
     tags = ["long_test"],

rs/nns/governance/BUILD.bazel

@@ -267,7 +267,7 @@ rust_ic_test_suite_with_extra_srcs(
     ],
     env = DEV_ENV | {
         "TLA_APALACHE_BIN": "$(rootpath @tla_apalache//:bin/apalache-mc)",
-        "TLA_MODULES": "$(locations //rs/nns/governance:tla_models)",
+        "TLA_MODULES": "$(rootpaths //rs/nns/governance:tla_models)",
         "JAVABASE": "$(JAVABASE)",
     },
     extra_srcs = ["src/lib.rs"],

rs/nns/integration_tests/BUILD.bazel

@@ -36,7 +36,7 @@ rust_test(
     ],
     env = {
         "TLA_APALACHE_BIN": "$(rootpath @tla_apalache//:bin/apalache-mc)",
-        "TLA_MODULES": "$(locations :tla_models)",
+        "TLA_MODULES": "$(rootpaths :tla_models)",
     },
     proc_macro_deps = [
         ":proc_macros",
@@ -71,7 +71,7 @@ rust_test(
     env = {
         "JAVABASE": "$(JAVABASE)",
         "TLA_APALACHE_BIN": "$(rootpath @tla_apalache//:bin/apalache-mc)",
-        "TLA_MODULES": "$(locations :tla_models)",
+        "TLA_MODULES": "$(rootpaths :tla_models)",
     },
     proc_macro_deps = [
         ":proc_macros",
@@ -99,7 +99,7 @@ rust_test(
     ],
     env = {
         "TLA_APALACHE_BIN": "$(rootpath @tla_apalache//:bin/apalache-mc)",
-        "TLA_MODULES": "$(locations :tla_models)",
+        "TLA_MODULES": "$(rootpaths :tla_models)",
     },
     proc_macro_deps = [
         ":proc_macros",