Use toolchain for tree artifact rpath rewriting (#53580)

### What does this PR do?

Adds a TreeArtifact/directory tool to the `rpath_rewriter` toolchains and applies it to replace explicit os-based switching.

### Motivation

Continuation of #53450 work to leverage toolchains for adapting rpath rewriting to each platform.

### Describe how you validated your changes

Green CI, including passing health check and no visible package changes.

### Additional Notes

This drops the `otool` toolchain entirely, as these changes have moved the `otool` portion of the rewriting to simply calling the tool from the full path where the tool is meant to exist on macos systems. If we ever want to bring it back it should probably be included with the macos rewriting tool and not be made into a separate toolchain.

This change also made the remapping semantics of `dd_cc_packaged` consistent for files and for directories, simplifying the logic of the implementation and also making it easier to understand at the call site – this explains the changes to openssl and cpython BUILD files.

Co-authored-by: alex.lopez <alex.lopez@datadoghq.com>

Author: alopezz

MODULE.bazel

@@ -159,15 +159,6 @@ multitool.hub(lockfile = "//bazel:prebuilt_buildtools.json")
 multitool.hub(lockfile = "//bazel:prebuilt_jq.json")
 use_repo(multitool, "multitool")
 
-## Use local object file tools
-find_system_otool = use_extension("//bazel/toolchains/otool:otool_configure.bzl", "find_system_otool", dev_dependency = True)
-use_repo(find_system_otool, "otool")
-
-register_toolchains(
-    "@otool//:all",
-    dev_dependency = True,
-)
-
 register_toolchains(
     "//bazel/toolchains/patchelf:patchelf_built_toolchain",
     dev_dependency = True,

MODULE.bazel.lock

@@ -7,33 +7,15 @@ load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
 load("@rules_pkg//pkg:providers.bzl", "PackageFilegroupInfo", "PackageFilesInfo")
 load("//bazel/rules:so_symlink.bzl", "so_symlink")
 load("//bazel/rules/dd_packaging:dd_packaging_info.bzl", "DdPackagingInfo")
-load("//bazel/rules/rewrite_rpath:rewrite_rpath.bzl", "otool_dir_action", "patchelf_dir_action", "rewrite_rpath", "rewrite_rpaths_for_files")
-
-def _is_os(ctx, constraint):
-    return ctx.target_platform_has_constraint(constraint[platform_common.ConstraintValueInfo])
+load("//bazel/rules/rewrite_rpath:rewrite_rpath.bzl", "rewrite_rpath", "rewrite_rpaths")
 
 def _dd_packaged_files_impl(ctx):
-    is_linux = _is_os(ctx, ctx.attr._linux_constraint)
-    is_macos = _is_os(ctx, ctx.attr._macos_constraint)
-
     rpath = ctx.attr.rpath.format(install_dir = ctx.attr._install_dir[BuildSettingInfo].value)
     dest_src_map = {}
 
     for src, prefix in ctx.attr.srcs.items():
-        for f in src.files.to_list():
-            if f.is_directory:
-                if is_linux:
-                    out = ctx.actions.declare_directory("patched_dirs/" + f.basename)
-                    patchelf_dir_action(ctx, f, out, rpath)
-                elif is_macos:
-                    out = ctx.actions.declare_directory("patched_dirs/" + f.basename)
-                    otool_dir_action(ctx, f, out, rpath)
-                else:
-                    out = f
-                dest = prefix
-            else:
-                out = rewrite_rpaths_for_files(ctx, inputs = [f], rpath = rpath)[0]
-                dest = (prefix + "/" + f.basename) if prefix else f.basename
+        for out in rewrite_rpaths(ctx, inputs = src.files.to_list(), rpath = rpath):
+            dest = (prefix + "/" + out.basename) if prefix else out.basename
             dest_src_map[dest] = out
 
     return [PackageFilesInfo(
@@ -51,29 +33,10 @@ _dd_packaged_files_rule = rule(
         "rpath": attr.string(
             default = "{install_dir}/embedded/lib",
         ),
-        "_linux_constraint": attr.label(default = "@platforms//os:linux"),
-        "_macos_constraint": attr.label(default = "@platforms//os:macos"),
-        "_script": attr.label(
-            default = "@@//bazel/rules/rewrite_rpath:macos.sh",
-            allow_single_file = True,
-            cfg = "exec",
-        ),
-        "_dir_script": attr.label(
-            default = "@@//bazel/rules/rewrite_rpath:macos_dir.sh",
-            allow_single_file = True,
-            cfg = "exec",
-        ),
-        "_install_name_tool": attr.label(
-            default = "@@//bazel/tools:install_name_tool",
-            executable = True,
-            cfg = "exec",
-        ),
         "_install_dir": attr.label(default = "@@//:install_dir"),
     },
     toolchains = [
         "//bazel/toolchains/rpath_rewriter",
-        "@@//bazel/toolchains/patchelf:patchelf_toolchain_type",
-        "@@//bazel/toolchains/otool:otool_toolchain_type",
     ],
 )
 
@@ -175,10 +138,9 @@ dd_cc_packaged = macro(
     depends, directly or indirectly, on the wrapped binary.
 
     If installed_executables is provided, each entry is rpath-patched and
-    installed with mode 0755. Individual files are installed as prefix/basename;
-    directory artifacts are installed as the prefix itself (contents copied into it).
-    Use this instead of wrapping files in pkg_files and passing them via
-    installed_files, so that rpath rewriting is not skipped.
+    installed with mode 0755. Files and directory artifacts are installed as
+    prefix/basename. Use this instead of wrapping files in pkg_files and passing
+    them via installed_files, so that rpath rewriting is not skipped.
 
     If a version is provided and the input is a cc_shared_library, the library
     will be installed along with the versioned symlink (see so_symlink).

bazel/rules/dd_packaging/dd_cc_packaged.bzl

@@ -1,9 +1,10 @@
 """Tests for dd_collect_dependencies and dd_cc_packaged."""
 
+load("@bazel_lib//lib:copy_to_directory.bzl", "copy_to_directory_bin_action")
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library", "cc_shared_library")
 load("@rules_cc//cc/common:cc_shared_library_info.bzl", "CcSharedLibraryInfo")
 load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
-load("@rules_pkg//pkg:providers.bzl", "PackageFilegroupInfo")
+load("@rules_pkg//pkg:providers.bzl", "PackageFilegroupInfo", "PackageFilesInfo")
 load("@rules_testing//lib:analysis_test.bzl", "analysis_test", "test_suite")
 load("@rules_testing//lib:truth.bzl", "matching")
 load("@rules_testing//lib:util.bzl", "util")
@@ -60,6 +61,24 @@ _duplicate_destinations = rule(
     attrs = {"dep": attr.label(providers = [PackageFilegroupInfo])},
 )
 
+def _tree_artifact_impl(ctx):
+    tree = ctx.actions.declare_directory("tree_dir")
+    placeholder = ctx.actions.declare_file("tree_artifact_placeholder/file")
+    ctx.actions.write(placeholder, "")
+    copy_to_directory_bin_action(
+        ctx,
+        name = ctx.label.name,
+        dst = tree,
+        copy_to_directory_bin = ctx.toolchains["@bazel_lib//lib:copy_to_directory_toolchain_type"].copy_to_directory_info.bin,
+        files = [placeholder],
+    )
+    return DefaultInfo(files = depset([tree]))
+
+_tree_artifact = rule(
+    implementation = _tree_artifact_impl,
+    toolchains = ["@bazel_lib//lib:copy_to_directory_toolchain_type"],
+)
+
 # ── Test cases ───────────────────────────────────────────────────────────────
 
 # Test 1: a cc_shared_library without a dd_cc_packaged wrapper has no
@@ -434,6 +453,42 @@ def _test_diamond_no_duplicates(name):
 def _test_diamond_no_duplicates_impl(env, target):
     _outputs_of(env, target).contains_exactly([])
 
+# Test 10: installed_executables treats the dict value as a prefix for both
+# files and TreeArtifacts, so artifacts land under prefix/basename.
+def _test_installed_executables_use_prefix(name):
+    cc_binary(
+        name = name + "_bin",
+        srcs = ["testdata/main.c"],
+    )
+    native.genrule(
+        name = name + "_file",
+        outs = ["installed_executable_file"],
+        cmd = "touch $@",
+    )
+    _tree_artifact(
+        name = name + "_tree",
+    )
+    dd_cc_packaged(
+        name = name + "_packaged",
+        input = ":" + name + "_bin",
+        installed_executables = {
+            ":" + name + "_file": "bin",
+            ":" + name + "_tree": "share",
+        },
+    )
+    analysis_test(
+        name = name,
+        impl = _test_installed_executables_use_prefix_impl,
+        target = name + "_packaged_exec_files",
+    )
+
+def _test_installed_executables_use_prefix_impl(env, target):
+    dest_src_map = target[PackageFilesInfo].dest_src_map
+    env.expect.that_dict(dest_src_map).keys().contains_exactly([
+        "bin/installed_executable_file",
+        "share/tree_dir",
+    ])
+
 # ── Suite ────────────────────────────────────────────────────────────────────
 
 def dd_packaging_test_suite(name):
@@ -449,5 +504,6 @@ def dd_packaging_test_suite(name):
             _test_cc_binary_collected,
             _test_cc_binary_no_cc_shared_library_info,
             _test_diamond_no_duplicates,
+            _test_installed_executables_use_prefix,
         ],
     )

bazel/rules/dd_packaging/dd_packaging_test.bzl

@@ -1,4 +0,0 @@
-exports_files([
-    "macos.sh",
-    "macos_dir.sh",
-])

bazel/rules/rewrite_rpath/BUILD.bazel

@@ -2,100 +2,60 @@
 
 load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 
-def patchelf_dir_action(ctx, input_dir, output_dir, rpath):
-    """Registers a patchelf action to rewrite the rpath of all shared libraries inside a directory.
+_RPATH_REWRITER_TOOLCHAIN = "//bazel/toolchains/rpath_rewriter"
 
-    Args:
-      ctx: the rule context.
-      input_dir: the source directory artifact to patch.
-      output_dir: the output directory artifact to write.
-      rpath: the rpath string to set.
-    """
-    toolchain = ctx.toolchains["@@//bazel/toolchains/patchelf:patchelf_toolchain_type"].patchelf
-    patchelf = toolchain.label[DefaultInfo].files_to_run
-    ctx.actions.run_shell(
-        inputs = [input_dir],
-        tools = [patchelf],
-        outputs = [output_dir],
-        # /. copies the contents of input rather than nesting it under output
-        # (Bazel pre-creates output via declare_directory). chmod restores
-        # owner-write so patchelf can rewrite files installed as 0555.
-        command = (
-            "cp -rL '{input}/.' '{output}' && " +
-            "chmod -R u+w '{output}' && " +
-            "find '{output}' -type f \\( -name '*.so' -o -name '*.so.*' \\) " +
-            "-exec '{patchelf}' --set-rpath '{rpath}' --force-rpath {{}} \\;"
-        ).format(
-            input = input_dir.path,
-            output = output_dir.path,
-            patchelf = patchelf.executable.path,
-            rpath = rpath,
-        ),
-    )
+def rewrite_rpaths(ctx, inputs, rpath):
+    """Creates actions to apply an rpath rewriter to files and TreeArtifacts.
 
-def otool_dir_action(ctx, input_dir, output_dir, rpath):
-    """Registers install_name_tool actions to rewrite the rpath of all dylibs inside a directory.
+    The selected rpath rewriter toolchain provides separate tools for regular
+    files and TreeArtifacts. A `None` tool means rpath rewriting is not
+    applicable for that artifact kind on the target platform; in that case, the
+    original input is returned unchanged and no copy action is registered.
 
     Args:
       ctx: the rule context.
-      input_dir: the source directory artifact to patch.
-      output_dir: the output directory artifact to write.
-      rpath: the rpath string to set.
-    """
-    otool = ctx.toolchains["@@//bazel/toolchains/otool:otool_toolchain_type"].otool
-    args = ctx.actions.args()
-    args.add(ctx.file._script.path)
-    args.add(ctx.executable._install_name_tool.path)
-    args.add(otool.path)
-    args.add(rpath)
-    args.add(input_dir.path)
-    args.add(output_dir.path)
-    ctx.actions.run(
-        inputs = [input_dir, ctx.file._script],
-        tools = [ctx.executable._install_name_tool],
-        outputs = [output_dir],
-        executable = ctx.file._dir_script,
-        arguments = [args],
-    )
-
-def rewrite_rpaths_for_files(ctx, inputs, rpath):
-    """Creates actions to apply an rpath rewriter to the inputs.
-
-    Args:
-      ctx: the rule context.
-      inputs: the files to patch.
+      inputs: the files or TreeArtifacts to patch.
       rpath: the rpath to set.
 
     Returns:
-      A list of the generated outputs
+      A list of rewritten outputs, in the same order as inputs. Rewritten
+      artifacts preserve the input basename. On platforms where rewriting is a
+      no-op, some or all entries may be the original inputs.
     """
-    toolchain = ctx.toolchains["//bazel/toolchains/rpath_rewriter"]
-
-    # No-op: just pass the inputs through.
-    if toolchain.rewriter_tool == None:
-        return inputs
+    toolchain = ctx.toolchains[_RPATH_REWRITER_TOOLCHAIN]
 
     outputs = []
     for input in inputs:
-        output = ctx.actions.declare_file("patched/" + input.basename)
+        tool = toolchain.tree_rewriter_tool if input.is_directory else toolchain.rewriter_tool
+
+        # No-op: just pass this input through.
+        if tool == None:
+            outputs.append(input)
+            continue
+
+        if input.is_directory:
+            output = ctx.actions.declare_directory("patched_dirs/" + input.basename)
+        else:
+            output = ctx.actions.declare_file("patched/" + input.basename)
+
         args = ctx.actions.args()
-        args.add(input)
+        args.add(input.path)
         args.add(rpath)
-        args.add(output)
+        args.add(output.path)
         ctx.actions.run(
             inputs = [input],
             outputs = [output],
             arguments = [args],
-            executable = toolchain.rewriter_tool,
-            toolchain = "//bazel/toolchains/rpath_rewriter",
+            executable = tool,
+            toolchain = _RPATH_REWRITER_TOOLCHAIN,
         )
         outputs.append(output)
 
     return outputs
 
 def _rewrite_rpath_impl(ctx):
     rpath = ctx.attr.rpath.format(install_dir = ctx.attr._install_dir[BuildSettingInfo].value)
-    return DefaultInfo(files = depset(rewrite_rpaths_for_files(ctx, inputs = ctx.files.inputs, rpath = rpath)))
+    return DefaultInfo(files = depset(rewrite_rpaths(ctx, inputs = ctx.files.inputs, rpath = rpath)))
 
 rewrite_rpath = rule(
     implementation = _rewrite_rpath_impl,
@@ -117,5 +77,5 @@ rewrite_rpath = rule(
             default = "@@//:install_dir",
         ),
     },
-    toolchains = ["//bazel/toolchains/rpath_rewriter"],
+    toolchains = [_RPATH_REWRITER_TOOLCHAIN],
 )