Update toolchains for bazel 7

* rules_python -> 1.6.1,
* rust toolchain -> 1.91,
* python toolchain -> 3.11,
* rules_cc -> 0.1.5,
* rules_foreign_cc -> 0.15.1,
* rules_rust -> 0.68.1

Signed-off-by: Matt Leon <[email protected]>

Author: leonm1

.bazelrc

@@ -60,6 +60,7 @@ build:clang-tsan --test_env=TSAN_OPTIONS=suppressions=bazel/tsan_suppressions.tx
 # Use Clang-Tidy tool.
 build:clang-tidy --aspects //tools/lint:linters.bzl%clang_tidy
 build:clang-tidy --output_groups=rules_lint_report
+build:clang-tidy --config=hermetic-llvm
 
 # Use GCC compiler.
 build:gcc --action_env=BAZEL_COMPILER=gcc

.github/workflows/format.yml

@@ -122,9 +122,6 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
-    - name: Install dependencies (Linux)
-      run: sudo apt update -y && sudo apt install -y clang-tidy-18 lld-18 && sudo ln -sf /usr/bin/lld-18 /usr/bin/lld
-
     - name: set cache name
       id: vars
       # The cache tag consists of the following parts:
@@ -150,6 +147,7 @@ jobs:
     - name: Bazel build
       run: >
         bazel build
+        --config=hermetic-llvm
         --config clang-tidy
         --define engine=multi
         --disk_cache /tmp/bazel/cache

.github/workflows/test.yml

@@ -76,6 +76,7 @@ jobs:
         --test_output=errors
         --config=clang
         --disk_cache /tmp/bazel/cache
+        --config=hermetic-llvm
         -c opt
         $(bazel query 'kind(was.*_rust_binary, //test/test_data/...)')
         $(bazel query 'kind(_optimized_wasm_cc_binary, //test/test_data/...)')
@@ -137,13 +138,13 @@ jobs:
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang-asan --define=crypto=system
+          flags: --config=hermetic-llvm --config=clang-asan --define=crypto=system
         - name: 'NullVM on Linux/x86_64 with TSan'
           engine: 'null'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang-tsan
+          flags: --config=hermetic-llvm --config=clang-tsan
         - name: 'NullVM on Windows/x86_64'
           engine: 'null'
           os: windows-2022
@@ -205,20 +206,21 @@ jobs:
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang
+          flags: --config=hermetic-llvm
         - name: 'WAMR interp on macOS/x86_64'
           engine: 'wamr-interp'
           repo: 'com_github_bytecodealliance_wasm_micro_runtime'
           os: macos-15
           arch: x86_64
           action: test
+          flags: --config=hermetic-llvm-macos
         - name: 'WAMR jit on Linux/x86_64'
           engine: 'wamr-jit'
           repo: 'com_github_bytecodealliance_wasm_micro_runtime'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang
+          flags: --config=hermetic-llvm
           deps: lld-18
           cache: true
         - name: 'WAMR jit on macOS/x86_64'
@@ -228,33 +230,35 @@ jobs:
           arch: x86_64
           action: test
           cache: true
+          flags: --config=hermetic-llvm-macos
         - name: 'WasmEdge on Linux/x86_64'
           engine: 'wasmedge'
           repo: 'com_github_wasmedge_wasmedge'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang
+          flags: --config=hermetic-llvm
         - name: 'WasmEdge on macOS/x86_64'
           engine: 'wasmedge'
           repo: 'com_github_wasmedge_wasmedge'
           os: macos-15
           arch: x86_64
           action: test
+          flags: --config=hermetic-llvm
         - name: 'Wasmtime on Linux/x86_64'
           engine: 'wasmtime'
           repo: 'com_github_bytecodealliance_wasmtime'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang -c opt
+          flags: --config=hermetic-llvm -c opt
         - name: 'Wasmtime on Linux/x86_64 with ASan'
           engine: 'wasmtime'
           repo: 'com_github_bytecodealliance_wasmtime'
           os: ubuntu-24.04-16core
           arch: x86_64
           action: test
-          flags: --config=clang-asan --define=crypto=system
+          flags: --config=hermetic-llvm --config=clang-asan --define=crypto=system
         - name: 'Wasmtime on Linux/aarch64'
           engine: 'wasmtime'
           repo: 'com_github_bytecodealliance_wasmtime'
@@ -278,6 +282,7 @@ jobs:
           os: macos-15
           arch: x86_64
           action: test
+          flags: --config=hermetic-llvm-macos
 
     steps:
     - uses: actions/checkout@v2

bazel/dependencies.bzl

@@ -18,26 +18,25 @@ load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
 load("@envoy_toolshed//sysroot:sysroot.bzl", "setup_sysroots")
 load("@proxy_wasm_cpp_host//bazel/cargo/wasmsign/remote:crates.bzl", wasmsign_crate_repositories = "crate_repositories")
 load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime/remote:crates.bzl", wasmtime_crate_repositories = "crate_repositories")
-load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
+load("@rules_python//python:repositories.bzl", "py_repositories" )
 load("@rules_rust//crate_universe:repositories.bzl", "crate_universe_dependencies")
 load("@rules_rust//rust:repositories.bzl", "rust_repositories", "rust_repository_set")
 load("@toolchains_llvm//toolchain:deps.bzl", "bazel_toolchain_dependencies")
 load("@toolchains_llvm//toolchain:rules.bzl", "llvm_toolchain")
+load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")
+load("@com_google_googletest//:googletest_deps.bzl", "googletest_deps")
 
 def proxy_wasm_cpp_host_dependencies():
     # Bazel extensions.
+    googletest_deps()
+    rules_foreign_cc_dependencies()
 
     rules_lint_dependencies()
 
     bazel_lib_dependencies()
     bazel_lib_register_toolchains()
 
     py_repositories()
-    python_register_toolchains(
-        name = "python_3_9",
-        python_version = "3.9",
-        ignore_root_user_error = True,  # for docker run
-    )
 
     rust_repositories()
     rust_repository_set(
@@ -46,18 +45,25 @@ def proxy_wasm_cpp_host_dependencies():
         extra_target_triples = [
             "aarch64-unknown-linux-gnu",
             "wasm32-unknown-unknown",
-            "wasm32-wasi",  # TODO: Change to wasm32-wasip1 once https://github.com/bazelbuild/rules_rust/issues/2782 is fixed
+            "wasm32-wasip1",
         ],
-        versions = ["1.77.2"],
+        versions = ["1.91.0"],
+        sha256s = {
+            "rustc-1.91.0-x86_64-unknown-linux-gnu.tar.xz": "a7169e8cb6174af2f45717703370363d8de82ce55f6ccba185893045b9370874",
+            "clippy-1.91.0-x86_64-unknown-linux-gnu.tar.xz": "0087c3d58d2fdeafa89830c299b1026c9f981b49835db89c922b3c6a299b3225",
+            "cargo-1.91.0-x86_64-unknown-linux-gnu.tar.xz": "7103c03fb8abe85b23307005a9dfe4f01c826a89945d84b96fa2d03fd4d2d138",
+            "llvm-tools-1.91.0-x86_64-unknown-linux-gnu.tar.xz": "3d7756e0ce1ee18d20399aef770f09c55a4134f5a0f18e4e3c018aa1b3919a70",
+            "rust-std-1.91.0-x86_64-unknown-linux-gnu.tar.xz": "89e6520b16c12b43526440298d2da0dcb70747c5cc2d0b8e47d39b5da9aeef49",
+        },
     )
     rust_repository_set(
         name = "rust_linux_s390x",
         exec_triple = "s390x-unknown-linux-gnu",
         extra_target_triples = [
             "wasm32-unknown-unknown",
-            "wasm32-wasi",
+            "wasm32-wasip1",
         ],
-        versions = ["1.77.2"],
+        versions = ["1.91.0"],
     )
     crate_universe_dependencies(bootstrap = True)
 

bazel/dependencies_import.bzl

@@ -17,11 +17,21 @@ load("@llvm_toolchain//:toolchains.bzl", "llvm_register_toolchains")
 load("@rules_foreign_cc//foreign_cc:repositories.bzl", "rules_foreign_cc_dependencies")
 load("@rules_fuzzing//fuzzing:repositories.bzl", "rules_fuzzing_dependencies")
 load("@v8_python_deps//:requirements.bzl", pip_v8_dependencies = "install_deps")
+load("@bazel_skylib//:workspace.bzl", "bazel_skylib_workspace")
+load("@bazel_features//:deps.bzl", "bazel_features_deps")
+load("@rules_python//python:repositories.bzl", "python_register_toolchains")
 
 def proxy_wasm_cpp_host_dependencies_import():
+    python_register_toolchains(
+        name = "python_3_11",
+        python_version = "3.11",
+        ignore_root_user_error = True,  # for docker run
+    )
+    bazel_skylib_workspace()
+    bazel_features_deps()
+
     llvm_register_toolchains()
 
-    rules_foreign_cc_dependencies()
     rules_fuzzing_dependencies()
 
     pip_fuzzing_dependencies()

bazel/external/rules_rust.patch

@@ -1,13 +1,13 @@
 # https://github.com/bazelbuild/rules_rust/pull/1315
 
 diff --git a/rust/private/rustc.bzl b/rust/private/rustc.bzl
-index bfd96ed9..d7e38658 100644
+index f2fe58c2c..6e55c2c35 100644
 --- a/rust/private/rustc.bzl
 +++ b/rust/private/rustc.bzl
-@@ -1507,7 +1507,7 @@ def rustc_compile_action(
-         })
-         crate_info = rust_common.create_crate_info(**crate_info_dict)
-
+@@ -1634,7 +1634,7 @@ def rustc_compile_action(
+             **crate_info_dict
+         )
+ 
 -    if crate_info.type in ["staticlib", "cdylib"]:
 +    if crate_info.type in ["staticlib", "cdylib"] and not out_binary:
          # These rules are not supposed to be depended on by other rust targets, and

bazel/external/wamr.patch

@@ -0,0 +1,26 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index c33b211e..d04d0cc8 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -178,8 +178,6 @@ set (WAMR_PUBLIC_HEADERS
+ )
+ set_target_properties (vmlib PROPERTIES PUBLIC_HEADER "${WAMR_PUBLIC_HEADERS}")
+ 
+-set_version_info (vmlib)
+-
+ install (TARGETS vmlib
+   EXPORT iwasmTargets
+   LIBRARY DESTINATION lib
+diff --git a/build-scripts/config_common.cmake b/build-scripts/config_common.cmake
+index cb15b8b0..b71cf077 100644
+--- a/build-scripts/config_common.cmake
++++ b/build-scripts/config_common.cmake
+@@ -140,7 +140,7 @@ else ()
+ endif ()
+ 
+ # Version
+-include (${WAMR_ROOT_DIR}/build-scripts/version.cmake)
++# include (${WAMR_ROOT_DIR}/build-scripts/version.cmake)
+ 
+ # Package
+ include (${WAMR_ROOT_DIR}/build-scripts/package.cmake)

bazel/external/wamr_llvm.BUILD

@@ -59,9 +59,6 @@ cmake(
     }),
     lib_source = ":srcs",
     out_data_dirs = [
-        "bin",
-        "include",
-        "lib",
         "libexec",
         "share",
     ],

bazel/repositories.bzl

@@ -51,9 +51,9 @@ def proxy_wasm_cpp_host_repositories():
     maybe(
         http_archive,
         name = "rules_cc",
-        sha256 = "2037875b9a4456dce4a79d112a8ae885bbc4aad968e6587dca6e64f3a0900cdf",
-        strip_prefix = "rules_cc-0.0.9",
-        urls = ["https://github.com/bazelbuild/rules_cc/releases/download/0.0.9/rules_cc-0.0.9.tar.gz"],
+        sha256 = "b8b918a85f9144c01f6cfe0f45e4f2838c7413961a8ff23bc0c6cdf8bb07a3b6",
+        strip_prefix = "rules_cc-0.1.5",
+        url = "https://github.com/bazelbuild/rules_cc/releases/download/0.1.5/rules_cc-0.1.5.tar.gz",
     )
 
     # aspect_rules_lint v1.12.0 for modern clang-tidy integration
@@ -113,9 +113,9 @@ def proxy_wasm_cpp_host_repositories():
     maybe(
         http_archive,
         name = "rules_foreign_cc",
-        sha256 = "bcd0c5f46a49b85b384906daae41d277b3dc0ff27c7c752cc51e43048a58ec83",
-        strip_prefix = "rules_foreign_cc-0.7.1",
-        url = "https://github.com/bazelbuild/rules_foreign_cc/archive/0.7.1.tar.gz",
+        sha256 = "32759728913c376ba45b0116869b71b68b1c2ebf8f2bcf7b41222bc07b773d73",
+        strip_prefix = "rules_foreign_cc-0.15.1",
+        url = "https://github.com/bazel-contrib/rules_foreign_cc/releases/download/0.15.1/rules_foreign_cc-0.15.1.tar.gz",
     )
 
     maybe(
@@ -129,17 +129,16 @@ def proxy_wasm_cpp_host_repositories():
     maybe(
         http_archive,
         name = "rules_python",
-        sha256 = "778aaeab3e6cfd56d681c89f5c10d7ad6bf8d2f1a72de9de55b23081b2d31618",
-        strip_prefix = "rules_python-0.34.0",
-        url = "https://github.com/bazelbuild/rules_python/releases/download/0.34.0/rules_python-0.34.0.tar.gz",
+        sha256 = "f2e80f97f9c0b82e2489e61e725df1e6bdaf16c4dacf5e26b95668787164baff",
+        strip_prefix = "rules_python-1.6.1",
+        url = "https://github.com/bazel-contrib/rules_python/releases/download/1.6.1/rules_python-1.6.1.tar.gz",
     )
 
     maybe(
         http_archive,
         name = "rules_rust",
-        integrity = "sha256-JLN47ZcAbx9wEr5Jiib4HduZATGLiDgK7oUi/fvotzU=",
-        # NOTE: Update Rust version in bazel/dependencies.bzl.
-        url = "https://github.com/bazelbuild/rules_rust/releases/download/0.42.1/rules_rust-v0.42.1.tar.gz",
+        integrity = "sha256-yKqAbPYGZnmsI0YyQe6ArWkiZdrQRl9RERy74wuJA1I=",
+        urls = ["https://github.com/bazelbuild/rules_rust/releases/download/0.68.1/rules_rust-0.68.1.tar.gz"],
         patches = ["@proxy_wasm_cpp_host//bazel/external:rules_rust.patch"],
         patch_args = ["-p1"],
     )
@@ -194,16 +193,22 @@ def proxy_wasm_cpp_host_repositories():
         sha256 = "65fab701d9829d38cb77c14acdc431d2108bfdbf8979e40eb8ae567edf10b27c",
         strip_prefix = "googletest-1.17.0",
         urls = ["https://github.com/google/googletest/releases/download/v1.17.0/googletest-1.17.0.tar.gz"],
+        repo_mapping = {
+            "@abseil-cpp": "@com_google_absl",
+        },
     )
 
     # NullVM dependencies.
 
     maybe(
         http_archive,
         name = "com_google_protobuf",
-        sha256 = "77ad26d3f65222fd96ccc18b055632b0bfedf295cb748b712a98ba1ac0b704b2",
-        strip_prefix = "protobuf-3.17.3",
-        url = "https://github.com/protocolbuffers/protobuf/releases/download/v3.17.3/protobuf-all-3.17.3.tar.gz",
+        sha256 = "3d32940e975c4ad9b8ba69640e78f5527075bae33ca2890275bf26b853c0962c",
+        strip_prefix = "protobuf-29.1",
+        url = "https://github.com/protocolbuffers/protobuf/releases/download/v29.1/protobuf-29.1.tar.gz",
+        repo_mapping = {
+            "@abseil-cpp": "@com_google_absl",
+        },
     )
 
     # V8 with dependencies.
@@ -301,6 +306,8 @@ def proxy_wasm_cpp_host_repositories():
         sha256 = "ca18bbf304f47287bf43707564db63b8908dd6d0d6ac40bb39271a7144def4cc",
         strip_prefix = "wasm-micro-runtime-WAMR-2.4.1",
         url = "https://github.com/bytecodealliance/wasm-micro-runtime/archive/refs/tags/WAMR-2.4.1.zip",
+        patches = ["@proxy_wasm_cpp_host//bazel/external:wamr.patch"],
+        patch_args = ["-p1"],
     )
 
     maybe(

bazel/wasm.bzl

@@ -64,7 +64,7 @@ def _wasm_attrs(transition):
         "binary": attr.label(mandatory = True, cfg = transition),
         "signing_key": attr.label_list(allow_files = True),
         "_wasmsign_tool": attr.label(default = "//bazel/cargo/wasmsign/remote:wasmsign__wasmsign", executable = True, cfg = "exec"),
-        "_whitelist_function_transition": attr.label(default = "@bazel_tools//tools/whitelists/function_transition_whitelist"),
+        "_allowlist_function_transition": attr.label(default = "@bazel_tools//tools/allowlists/function_transition_allowlist"),
     }
 
 wasm_rust_binary_rule = rule(