Merge pull request #30187 from travisdowns/td-hermetic

bazel: make build byte-for-byte reproducible

Author: travisdowns

MODULE.bazel.lock

@@ -133,6 +133,8 @@ def data_dependency():
     http_archive(
         name = "openssl",
         build_file = "//bazel/thirdparty:openssl.BUILD",
+        patches = ["//bazel/thirdparty:openssl-reproducible-buildinf.patch"],
+        patch_args = ["-p1"],
         sha256 = "deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736",
         strip_prefix = "openssl-3.5.6",
         url = "https://vectorized-public.s3.amazonaws.com/dependencies/openssl-3.5.6.tar.gz",

bazel/repositories.bzl

@@ -33,9 +33,17 @@ configure_make(
         # Build a static library
         "--disable-shared",
         "--enable-static",
+
+        # Use a fixed runstatedir so the autoconf-derived path doesn't embed
+        # the sandbox directory into compiled objects.
+        "--runstatedir=/var/run/hwloc",
     ],
     env = {
         "HWLOC_BUILD_JOBS": "$(BUILD_JOBS)",
+        # Remap the sandbox root in __FILE__ expansions so that inlined
+        # headers (helper.h, plugins.h) produce deterministic assert strings.
+        "CFLAGS": "-ffile-prefix-map=$$EXT_BUILD_ROOT=.",
+        "CXXFLAGS": "-ffile-prefix-map=$$EXT_BUILD_ROOT=.",
     },
     lib_source = ":srcs",
     out_binaries = [

bazel/thirdparty/hwloc.BUILD

@@ -0,0 +1,21 @@
+diff --git a/util/mkbuildinf.pl b/util/mkbuildinf.pl
+index abcdef1..1234567 100644
+--- a/util/mkbuildinf.pl
++++ b/util/mkbuildinf.pl
+@@ -11,6 +11,16 @@ use warnings;
+ my $platform = pop @ARGV;
+ my $cflags = join(' ', @ARGV);
+ $cflags =~ s(\\)(\\\\)g;
++
++# Strip sandbox/build-root absolute paths so the output is reproducible
++# across different Bazel output bases and sandbox instances. Note: the
++# cflags modified here are only embedded as a diagnostic string (shown by
++# `openssl version -a`), not used for actual compilation.
++my $ebr = $ENV{'EXT_BUILD_ROOT'} // '';
++if ($ebr ne '') {
++    $cflags =~ s/\Q$ebr\E\/?/./g;
++}
++
+ $cflags = "compiler: $cflags";
+
+ # Use the value of the envvar SOURCE_DATE_EPOCH, even if it's

bazel/thirdparty/openssl-reproducible-buildinf.patch

@@ -67,6 +67,10 @@ configure_make(
     }),
     env = {
         "OPENSSL_BUILD_JOBS": "$(BUILD_JOBS)",
+        # Pin the build timestamp to epoch 0 for reproducible builds.
+        # Without this, mkbuildinf.pl embeds the current time into
+        # crypto/buildinf.h.
+        "SOURCE_DATE_EPOCH": "0",
     },
     lib_source = ":srcs",
     out_binaries = [