fix: Use target tar toolchain for cross-platform execution (#844)

sfc-gh-dbieliaiev · web-flow · commit 07e93d12891e · 2025-12-03T09:09:27.000-08:00
Hi @thesayyn, @alexeagle. I'd like to help solve the cross-platform remote execution issue described in [#769](#769), which significantly affects us. I see this is connected to the fundamental Bazel limitation described in [bazelbuild/bazel#19645](bazelbuild/bazel#19645). I've noticed that a similar issue was addressed for crane and yq toolchains in [#590](#590), but the same transition-based solution for tar toolchain ([#762](#762)) got stuck because it doesn't work well in other cases. ## Proposal I'm suggesting to use target_toolchain which was [recently implemented](bazel-contrib/tar.bzl#65) instead of toolchain to determine it correctly. As a prerequisite we need to migrate to tar.bzl. ## Changes summary 1. tar.bzl was used instead of `aspect_bazel_lib/tar.bzl` 2. target toolchain was used instead of toolchainl.
diff --git a/MODULE.bazel b/MODULE.bazel
@@ -9,6 +9,7 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.7.2")
 bazel_dep(name = "bazel_features", version = "1.10.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "tar.bzl", version = "0.7.0")
 
 oci = use_extension("//oci:extensions.bzl", "oci")
 oci.toolchains()
@@ -25,8 +26,12 @@ register_toolchains("@zstd_toolchains//:all")
 
 bazel_lib = use_extension("@aspect_bazel_lib//lib:extensions.bzl", "toolchains")
 bazel_lib.jq()
-bazel_lib.tar()
-use_repo(bazel_lib, "bsd_tar_toolchains", "jq_toolchains")
+use_repo(bazel_lib, "jq_toolchains")
+
+tar = use_extension("@tar.bzl//tar:extensions.bzl", "toolchains")
+use_repo(tar, "bsd_tar_toolchains")
+
+register_toolchains("@bsd_tar_toolchains//:all")
 
 # Dev dependencies
 
diff --git a/docs/compare_dockerfile.md b/docs/compare_dockerfile.md
@@ -65,7 +65,7 @@ oci_pull(
 2. Replace `COPY` with `tar`.
 
 ```starlark
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@tar.bzl", "tar")
 
 tar(
     name = "web_assets",
@@ -77,7 +77,7 @@ tar(
 3. The resulting `BUILD` file would look like:
 
 ```starlark
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@tar.bzl", "tar")
 
 tar(
     name = "web_assets",
diff --git a/docs/cpp.md b/docs/cpp.md
@@ -76,7 +76,7 @@ use_repo(oci, "docker_lib_ubuntu")
 ```
 
 ```python
-bazel_dep(name = "tar.bzl", version = "0.3.0")
+bazel_dep(name = "tar.bzl", version = "0.7.0")
 ```
 
 To load the image, execute:
diff --git a/docs/scala.md b/docs/scala.md
@@ -133,7 +133,7 @@ scala_binary(
 After that, we can package that binary into a layer using `tar`
 
 ```python
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@tar.bzl", "tar")
 
 tar(
     name = "layer",
@@ -181,7 +181,7 @@ Complete `BUILD.bazel` file
 
 ```python
 load("@io_bazel_rules_scala//scala:scala.bzl", "scala_binary")
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@tar.bzl", "tar")
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load")
 
 scala_binary(
diff --git a/e2e/wasm/BUILD.bazel b/e2e/wasm/BUILD.bazel
@@ -1,8 +1,8 @@
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@aspect_bazel_lib//lib:transitions.bzl", "platform_transition_filegroup")
 load("@bazel_skylib//rules:build_test.bzl", "build_test")
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load")
 load("@rules_rust//rust:defs.bzl", "rust_binary")
+load("@tar.bzl", "tar")
 
 package(default_visibility = ["//visibility:public"])
 
diff --git a/e2e/wasm/MODULE.bazel b/e2e/wasm/MODULE.bazel
@@ -2,6 +2,7 @@ bazel_dep(name = "rules_oci", version = "0.0.0")
 bazel_dep(name = "aspect_bazel_lib", version = "2.7.2")
 bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "tar.bzl", version = "0.7.0")
 bazel_dep(name = "rules_rust", version = "0.45.1")
 bazel_dep(name = "hermetic_cc_toolchain", version = "3.1.0")
 
diff --git a/examples/assertion/BUILD.bazel b/examples/assertion/BUILD.bazel
@@ -1,9 +1,9 @@
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@aspect_bazel_lib//lib:testing.bzl", "assert_json_matches")
 load("@aspect_bazel_lib//lib:transitions.bzl", "platform_transition_filegroup")
 load("@bazel_skylib//rules:build_test.bzl", "build_test")
 load("@bazel_skylib//rules:write_file.bzl", "write_file")
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load")
+load("@tar.bzl", "tar")
 load("//examples:assert.bzl", "assert_oci_config")
 
 # Case 1: image name containing a capital case.
diff --git a/examples/assertion/big_image/BUILD.bazel b/examples/assertion/big_image/BUILD.bazel
@@ -1,4 +1,4 @@
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@tar.bzl", "tar")
 load("//oci:defs.bzl", "oci_image", "oci_load")
 
 # These numbers were gathered on a `Apple M2 Pro`
diff --git a/examples/cmd_location_expansion/BUILD.bazel b/examples/cmd_location_expansion/BUILD.bazel
@@ -1,5 +1,5 @@
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@tar.bzl", "tar")
 load("//examples:assert.bzl", "assert_oci_config", "assert_oci_image_command")
 
 tar(
@@ -40,8 +40,8 @@ assert_oci_image_command(
         "y",
         "l1\nl2",
     ],
-    image = ":image",
     exit_code_eq = 0,
+    image = ":image",
     output_eq = """\
 hello world!
 arg 0:x
diff --git a/examples/env/BUILD.bazel b/examples/env/BUILD.bazel
@@ -1,6 +1,6 @@
 load("@aspect_bazel_lib//lib:expand_template.bzl", "expand_template")
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@tar.bzl", "tar")
 load("//examples:assert.bzl", "assert_oci_image_command")
 
 tar(
@@ -27,7 +27,7 @@ oci_image(
 
 assert_oci_image_command(
     name = "assert_version_is_correct",
+    exit_code_eq = 0,
     image = ":image",
     output_eq = "version: 1.2.3",
-    exit_code_eq = 0
 )
diff --git a/examples/image_index/BUILD.bazel b/examples/image_index/BUILD.bazel
@@ -1,6 +1,6 @@
 load("@aspect_bazel_lib//lib:copy_file.bzl", "copy_file")
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@rules_oci//oci:defs.bzl", "oci_image", "oci_image_index")
+load("@tar.bzl", "tar")
 
 platform(
     name = "linux_arm64",
diff --git a/examples/just_tar/BUILD.bazel b/examples/just_tar/BUILD.bazel
@@ -1,4 +1,4 @@
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@tar.bzl", "tar")
 
 # See `Case 3` in examples/assertion
 genrule(
diff --git a/examples/labels/BUILD.bazel b/examples/labels/BUILD.bazel
@@ -1,6 +1,6 @@
 load("@aspect_bazel_lib//lib:expand_template.bzl", "expand_template")
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@rules_oci//oci:defs.bzl", "oci_image")
+load("@tar.bzl", "tar")
 load("//examples:assert.bzl", "assert_oci_config")
 
 tar(
diff --git a/examples/multi_architecture_image/BUILD.bazel b/examples/multi_architecture_image/BUILD.bazel
@@ -1,5 +1,5 @@
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
 load("@aspect_bazel_lib//lib:testing.bzl", "assert_contains")
+load("@tar.bzl", "tar")
 load("//oci:defs.bzl", "oci_image", "oci_image_index", "oci_load")
 load(":transition.bzl", "multi_arch")
 
@@ -34,9 +34,9 @@ oci_image_index(
 
 oci_load(
     name = "load",
+    format = "oci",
     image = ":index",
     repo_tags = ["my-repository:latest"],
-    format = "oci",
 )
 
 assert_contains(
diff --git a/examples/sign/BUILD.bazel b/examples/sign/BUILD.bazel
@@ -1,4 +1,4 @@
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@tar.bzl", "tar")
 load("//cosign:defs.bzl", "cosign_sign")
 load("//oci:defs.bzl", "oci_image")
 
diff --git a/examples/tarball_incremental_loader/BUILD.bazel b/examples/tarball_incremental_loader/BUILD.bazel
@@ -1,4 +1,4 @@
-load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@tar.bzl", "tar")
 load("//oci:defs.bzl", "oci_image", "oci_load")
 
 tar(
diff --git a/oci/dependencies.bzl b/oci/dependencies.bzl
@@ -11,6 +11,13 @@ def http_archive(**kwargs):
     maybe(_http_archive, **kwargs)
 
 def rules_oci_dependencies():
+    http_archive(
+        name = "tar.bzl",
+        sha256 = "a0d64064a598d7a1e58196d17de0deed6d3d2d8bfe1407ed9e68b24c31c38e8d",
+        strip_prefix = "tar.bzl-0.7.0",
+        url = "https://github.com/bazel-contrib/tar.bzl/releases/download/v0.7.0/tar.bzl-v0.7.0.tar.gz",
+    )
+
     http_archive(
         name = "bazel_skylib",
         sha256 = "c6966ec828da198c5d9adbaa94c05e3a1c7f21bd012a0b29ba8ddbccb2c93b0d",
diff --git a/oci/private/load.bzl b/oci/private/load.bzl
@@ -151,7 +151,8 @@ def _get_workspace_root_path(ctx, file):
 def _load_impl(ctx):
     jq = ctx.toolchains["@aspect_bazel_lib//lib:jq_toolchain_type"]
     coreutils = ctx.toolchains["@aspect_bazel_lib//lib:coreutils_toolchain_type"]
-    bsdtar = ctx.toolchains["@aspect_bazel_lib//lib:tar_toolchain_type"]
+    bsdtar = ctx.toolchains["@tar.bzl//tar/toolchain:type"]
+    bsdtar_target = ctx.toolchains["@tar.bzl//tar/toolchain:target_type"]
 
     image = ctx.file.image
     repo_tags = ctx.file.repo_tags
@@ -200,7 +201,7 @@ def _load_impl(ctx):
     # This action produces a large output and should rarely be used as it puts load on the cache.
     # It will only run if the "tarball" output_group is explicitly requested
     tarball = ctx.actions.declare_file("{}/tarball.tar".format(ctx.label.name))
-    tar_inputs = depset(direct = mtree_outputs, transitive = [mtree_inputs])
+    tar_inputs = depset(direct = mtree_outputs, transitive = [mtree_inputs, bsdtar_target.default.files])
     tar_args = ctx.actions.args()
     tar_args.add_all(["--create", "--no-xattr", "--no-mac-metadata"])
     tar_args.add("--file", tarball)
@@ -231,7 +232,7 @@ def _load_impl(ctx):
         output = runnable_loader,
         substitutions = {
             "{{BASH_RLOCATION_FUNCTION}}": BASH_RLOCATION_FUNCTION,
-            "{{tar}}": to_rlocation_path(ctx, bsdtar.tarinfo.binary),
+            "{{tar}}": to_rlocation_path(ctx, bsdtar_target.tarinfo.binary),
             "{{mtree_path}}": to_rlocation_path(ctx, mtree_spec),
             "{{loader}}": to_rlocation_path(ctx, ctx.executable.loader) if ctx.executable.loader else "",
             # This rule could be declared in external workspace than current execution context(e.g. main_wksp -> external_wksp -> rules_oci).
@@ -260,7 +261,8 @@ oci_load = rule(
         "@bazel_tools//tools/sh:toolchain_type",
         "@aspect_bazel_lib//lib:coreutils_toolchain_type",
         "@aspect_bazel_lib//lib:jq_toolchain_type",
-        "@aspect_bazel_lib//lib:tar_toolchain_type",
+        "@tar.bzl//tar/toolchain:type",
+        "@tar.bzl//tar/toolchain:target_type",
     ],
     executable = True,
 )
diff --git a/oci/repositories.bzl b/oci/repositories.bzl
@@ -5,10 +5,10 @@ load(
     "register_copy_to_directory_toolchains",
     "register_coreutils_toolchains",
     "register_jq_toolchains",
-    "register_tar_toolchains",
     "register_zstd_toolchains",
 )
 load("@bazel_features//:deps.bzl", "bazel_features_deps")
+load("@tar.bzl//tar:extensions.bzl", tar_toolchains_setup = "create_repositories")
 load("//oci/private:toolchains_repo.bzl", "PLATFORMS", "toolchains_repo")
 load("//oci/private:versions.bzl", "CRANE_VERSIONS", "REGCTL_VERSIONS")
 
@@ -111,10 +111,11 @@ def oci_register_toolchains(name, register = True):
     if register:
         bazel_features_deps()
         register_jq_toolchains(register = register)
-        register_tar_toolchains(register = register)
         register_coreutils_toolchains(register = register)
         register_copy_to_directory_toolchains(register = register)
         register_zstd_toolchains(register = register)
+        tar_toolchains_setup()
+        native.register_toolchains("@bsd_tar_toolchains//:all")
     register_crane_toolchains(name, register = register)
     register_regctl_toolchains(name, register = register)
 

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-load("@aspect_bazel_lib//lib:tar.bzl", "tar")`
	`1`	`+load("@tar.bzl", "tar")`
`2`	`2`	`load("//oci:defs.bzl", "oci_image", "oci_load")`
`3`	`3`
`4`	`4`	# These numbers were gathered on a `Apple M2 Pro`