Skip to content

[ABLD-395] MVP macos .pkg file rule. - #54115

Open
aiuto wants to merge 8 commits into
mainfrom
aiuto/macos_pkg
Open

[ABLD-395] MVP macos .pkg file rule.#54115
aiuto wants to merge 8 commits into
mainfrom
aiuto/macos_pkg

Conversation

@aiuto

@aiuto aiuto commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

What does this PR do?

Adds an MVP rule to create Mac PKG files.

  • bazel/rules/macos/pkg/pkg_mac_pkg.bzl

    • materialize srcs to diesk via a pkg_install-generated installer. sub-optimal but equivalent to what omnibus does today. Future work will improve that.
    • bazel/rules/macos/pkg/build_mac_pkg.sh — the pkgbuild wrapper

  • Adds packages/agent/macos/BUILD.bazel, to create a .pkg file for datadog-agent. This is obviously incomplete because //cmd/agent:agent is not ready yet.

  • packages/agent/product/BUILD.bazel — fixed a pre-existing bug where //cmd/loader:trace_loader (Linux-only target_compatible_with) was listed unconditionally, breaking any non-Linux consumer of :all_files.

Motivation

Describe how you validated your changes

Claude's used lsbom to verify that the pkg format was valid.

Hand compare the DMG built from the omnibus job to this output.

$ tree_size_compare --save pkg.json bazel-bin/packages/agent/macos/pkg.pkg
$ tree_size_compare --save=dmg.json $HOME/Downloads/datadog-agent-7.83.0-devel.git.371.359005d.pipeline.126858256-1.arm64.dmg
$ grep PKG@ dmg.json | sed -e 's/@PKG@/opt\/datadog-agent/' >/tmp/dmg.files
$ grep path pkg.json >/tmp/pkg.files
$ grep system-prob /tmp/*.files
/tmp/dmg.files:    "path": "opt/datadog-agent/bin/agent/dist/system-probe.yaml",
/tmp/dmg.files:    "path": "opt/datadog-agent/embedded/bin/system-probe",
/tmp/dmg.files:    "path": "opt/datadog-agent/etc/system-probe.yaml",
/tmp/dmg.files:    "path": "opt/datadog-agent/etc/system-probe.yaml.example",
/tmp/pkg.files:    "path": "opt/datadog-agent/etc/system-probe.yaml",

The missing files are expected right now, because we have not done serious work at wiring up the dependencies.

Next steps

  • tweak dependencies and config until we have fidelity with the omnibus packager. Brew the omnibus jobs to do this.
  • replace use of pkg_install to manifest the tree with a direct reader/writer. That is probably upstreamable to rules_pkg in a contrib section. I think I want a pkg_instantiate rule that will return a tree artifact.
  • Add signing (blocked on ABLD-386)

@aiuto
aiuto requested a review from a team as a code owner July 24, 2026 18:59
@aiuto aiuto added changelog/no-changelog No changelog entry needed qa/no-code-change No code change in Agent code requiring validation labels Jul 24, 2026
@aiuto
aiuto marked this pull request as draft July 24, 2026 18:59
@aiuto
aiuto removed the request for review from a team July 24, 2026 18:59
@dd-octo-sts dd-octo-sts Bot added internal Identify a non-fork PR team/agent-build labels Jul 24, 2026
@github-actions github-actions Bot added the medium review PR review might take time label Jul 24, 2026
chatgpt-codex-connector[bot]

This comment was marked as outdated.

Sign in to view

@dd-octo-sts

dd-octo-sts Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Files inventory check summary

File checks results against ancestor 03a26c27:

Results for datadog-agent_7.84.0~devel.git.160.e9808be.pipeline.130580558-1_amd64.deb:

No change detected

Results for datadog-iot-agent_7.84.0~devel.git.160.e9808be.pipeline.130580558-1_amd64.deb:

No change detected

@dd-octo-sts

dd-octo-sts Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 03a26c2
📊 Static Quality Gates Dashboard
🔗 SQG Job

33 successful checks with minimal change (< 2 KiB)
Quality gate Current Size
✅ agent_deb_amd64 760.058 MiB
✅ agent_deb_amd64_fips 712.926 MiB
✅ agent_heroku_amd64 312.396 MiB
✅ agent_msi 643.510 MiB
✅ agent_rpm_amd64 760.041 MiB
✅ agent_rpm_amd64_fips 712.910 MiB
✅ agent_rpm_arm64 735.941 MiB
✅ agent_rpm_arm64_fips 692.132 MiB
✅ agent_suse_amd64 760.041 MiB
✅ agent_suse_amd64_fips 712.910 MiB
✅ agent_suse_arm64 735.941 MiB
✅ agent_suse_arm64_fips 692.132 MiB
✅ docker_agent_amd64 818.669 MiB
✅ docker_agent_arm64 819.617 MiB
✅ docker_agent_jmx_amd64 1009.567 MiB
✅ docker_agent_jmx_arm64 999.167 MiB
✅ docker_cluster_agent_amd64 210.475 MiB
✅ docker_cluster_agent_arm64 223.455 MiB
✅ docker_cws_instrumentation_amd64 7.439 MiB
✅ docker_cws_instrumentation_arm64 6.877 MiB
✅ docker_dogstatsd_amd64 39.482 MiB
✅ docker_dogstatsd_arm64 37.560 MiB
✅ docker_host_profiler_amd64 305.816 MiB
✅ docker_host_profiler_arm64 317.125 MiB
✅ dogstatsd_deb_amd64 30.224 MiB
✅ dogstatsd_deb_arm64 28.251 MiB
✅ dogstatsd_rpm_amd64 30.224 MiB
✅ dogstatsd_suse_amd64 30.224 MiB
✅ iot_agent_deb_amd64 46.448 MiB
✅ iot_agent_deb_arm64 43.104 MiB
✅ iot_agent_deb_armhf 43.887 MiB
✅ iot_agent_rpm_amd64 46.448 MiB
✅ iot_agent_suse_amd64 46.447 MiB

@cit-pr-commenter-54b7da

cit-pr-commenter-54b7da Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: 58043093-36de-426b-8c26-3b0539c2314d

Baseline: 7a0dfc5
Comparison: e9808be
Diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment

perf experiment goal Δ mean % Δ mean % CI trials links
➖ quality_gate_security_mean_fs_load memory utilization +0.18 [+0.11, +0.26] 1 Logs bounds checks dashboard
➖ quality_gate_idle_all_features memory utilization +0.08 [+0.03, +0.12] 1 Logs bounds checks dashboard
➖ quality_gate_logs % cpu utilization +0.01 [-0.85, +0.87] 1 Logs bounds checks dashboard
➖ quality_gate_security_no_fs_load memory utilization -0.10 [-0.25, +0.04] 1 Logs bounds checks dashboard
➖ quality_gate_idle memory utilization -0.30 [-0.42, -0.18] 1 Logs bounds checks dashboard
➖ quality_gate_private_action_runner memory utilization -0.43 [-0.55, -0.31] 1 Logs bounds checks dashboard
➖ quality_gate_security_idle memory utilization -0.48 [-0.57, -0.38] 1 Logs bounds checks dashboard
➖ quality_gate_metrics_logs memory utilization -1.01 [-1.26, -0.76] 1 Logs bounds checks dashboard

Bounds Checks: ❌ Failed

perf experiment bounds_check_name replicates_passed observed_value links
✅ quality_gate_idle intake_connections 10/10 4 = 4 bounds checks dashboard
❌ quality_gate_idle memory_usage 0/10 173.59MiB > 154MiB bounds checks dashboard
✅ quality_gate_idle total_bytes_received 10/10 731.95KiB ≤ 819.20KiB bounds checks dashboard
✅ quality_gate_idle_all_features intake_connections 10/10 4 = 4 bounds checks dashboard
❌ quality_gate_idle_all_features memory_usage 9/10 513.12MiB > 512MiB bounds checks dashboard
✅ quality_gate_idle_all_features total_bytes_received 10/10 1.13MiB ≤ 1.25MiB bounds checks dashboard
✅ quality_gate_logs intake_connections 10/10 17 ≤ 40 bounds checks dashboard
❌ quality_gate_logs memory_usage 3/10 206.50MiB > 195MiB bounds checks dashboard
✅ quality_gate_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_logs total_bytes_received 10/10 264.18MiB ≤ 292MiB bounds checks dashboard
✅ quality_gate_metrics_logs cpu_usage 10/10 356.64 ≤ 2000 bounds checks dashboard
✅ quality_gate_metrics_logs intake_connections 10/10 19 ≤ 40 bounds checks dashboard
✅ quality_gate_metrics_logs memory_usage 10/10 375.01MiB ≤ 430MiB bounds checks dashboard
✅ quality_gate_metrics_logs missed_bytes 10/10 0B = 0B bounds checks dashboard
✅ quality_gate_metrics_logs total_bytes_received 10/10 0.94GiB ≤ 1.04GiB bounds checks dashboard
✅ quality_gate_private_action_runner memory_usage 10/10 72.04MiB ≤ 75MiB bounds checks dashboard
✅ quality_gate_security_idle cpu_usage 10/10 26.42 ≤ 100 bounds checks dashboard
✅ quality_gate_security_idle memory_usage 10/10 326.48MiB ≤ 330MiB bounds checks dashboard
✅ quality_gate_security_mean_fs_load cpu_usage 10/10 62.37 ≤ 200 bounds checks dashboard
✅ quality_gate_security_mean_fs_load memory_usage 10/10 301.21MiB ≤ 310MiB bounds checks dashboard
✅ quality_gate_security_no_fs_load cpu_usage 10/10 20.77 ≤ 100 bounds checks dashboard
✅ quality_gate_security_no_fs_load memory_usage 10/10 310.66MiB ≤ 320MiB bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

  • ✅ = significantly better comparison variant performance
  • ❌ = significantly worse comparison variant performance
  • ➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

  1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

  2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

  3. Its configuration does not mark it "erratic".

Replicate Execution Details

We run multiple replicates for each experiment/variant. However, we allow replicates to be automatically retried if there are any failures, up to 8 times, at which point the replicate is marked dead and we are unable to run analysis for the entire experiment. We call each of these attempts at running replicates a replicate execution. This section lists all replicate executions that failed due to the target crashing or being oom killed.

Note: In the below tables we bucket failures by experiment, variant, and failure type. For each of these buckets we list out the replicate indexes that failed with an annotation signifying how many times said replicate failed with the given failure mode. In the below example the baseline variant of the experiment named experiment_with_failures had two replicates that failed by oom kills. Replicate 0, which failed 8 executions, and replicate 1 which failed 6 executions, all with the same failure mode.

Experiment Variant Replicates Failure Logs Debug Dashboard
experiment_with_failures baseline 0 (x8) 1 (x6) Oom killed Debug Dashboard

The debug dashboard links will take you to a debugging dashboard specifically designed to investigate replicate execution failures.

❌ Retried Profiling Replicate Execution Failures (ddprof)

Note: Profiling replicas may still be executing. See the debug dashboard for up to date status.

Experiment Variant Replicates Failure Debug Dashboard
quality_gate_idle baseline 10 Oom killed Debug Dashboard
quality_gate_idle_all_features baseline 10 Oom killed Debug Dashboard
quality_gate_idle_all_features comparison 10 Oom killed Debug Dashboard
quality_gate_logs comparison 10 Oom killed Debug Dashboard
quality_gate_security_no_fs_load baseline 10 Oom killed Debug Dashboard
quality_gate_security_no_fs_load comparison 10 Crashed (exit code: 134) Debug Dashboard

CI Pass/Fail Decision

❌ Failed. Some Quality Gates were violated.

  • quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check memory_usage: 0/10 replicas passed. Failed 10 which is > 0. Gate FAILED.
  • quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check memory_usage: 3/10 replicas passed. Failed 7 which is > 0. Gate FAILED.
  • quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
  • quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
  • quality_gate_idle_all_features, bounds check memory_usage: 9/10 replicas passed. Failed 1 which is > 0. Gate FAILED.
  • quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.

This was referenced Jul 28, 2026
Closed
Merged
gh-worker-dd-mergequeue-cf854d Bot pushed a commit that referenced this pull request Aug 5, 2026
@aiuto
[ABLD-395] Framework to create toolchains for OS provided tools (#54177)
c2cf4c2 
### What does this PR do?

- Creates a tiny framework for finding an OS provided tool and telling Bazel it is a toolchain.
- Use it for macos pkgbuild and codesign.

The important feature of the way this is implemented is that the toolchain always safely resolves on all platforms, so you can `bazel cquery` across platforms, even though you will fail if you try to `build`. Combined with `exec_compatible_with` you can make targets that only build if the required tools are available. This is important when there are different tools available as OSes evolve (or are simply different by vendor, like debian and redhat) and we need to create paths that can gracefully use different tools depending on what is available.

There is also a capability to use a bazel target as the tool implementation instead of looking it up in $PATH. That is useful for building alternate implementations (let's say a windows tool on linux). That will come into use in full remote execution mode, when the target and exec hosts can be different architectures.

**Examples:**
- I'm building a tarball, see if I have the xz toolchain and use that if available, otherwise fall back to a slower compresser
- The OS is evolving a tool, if we have version 1, it might have one name. In version 2, there might be a better tool. We want to make rules that can do the right thing regardless of what OS we have. This is a huge win for external users who may be using a different base linux to build.


### Motivation

This is an important part of our supply chain security posture. We want to account for every binary we use to build the product. Ideally that would include even basic low level things, like bash and cat. In practice we can make the tradeoff to stop at declaring the things that might vary across OSes or from OS release to release.

Eventually, we will expand this the framework to include package metadata (https://github.com/bazel-contrib/supply-chain/tree/main/metadata) that can be easily gathered into a workspace BOM.

The more immediate need is to create toolchains for pkgbuild and codesign to create rules to make macos packages. #54115

### Describe how you validated your changes
With the BUILD file
```
genrule(
    name = "test",
    cmd = select({
        "@macos_codesign//:have_codesign": "echo GOT IT",
        "//conditions:default": "echo wump, wump, wump",
    }),
    outs = ["test.out"],
)
```

macos:
```
$ bazel cquery --output=build  //ztony:test
genrule(
  name = "test",
  outs = ["//ztony:test.out"],
  cmd = "echo GOT IT",
)
$ bazel cquery @macos_codesign//:all
INFO: Analyzed 7 targets (0 packages loaded, 6 targets configured).
INFO: Found 7 targets...
@macos_codesign//:codesign_auto (eab6d8f)
@macos_codesign//:codesign_toolchain (eab6d8f)
@macos_codesign//:codesign_toolchain_type (eab6d8f)
@macos_codesign//:have_codesign (eab6d8f)
@macos_codesign//:is_codesign_available (eab6d8f)
@macos_codesign//:no_codesign (eab6d8f)
@macos_codesign//:zzz_codesign_missing_toolchain (eab6d8f)
```
linux:
```
$ bazel cquery --output=build  //ztony:test
genrule(
  name = "test",
  outs = ["//ztony:test.out"],
  cmd = "echo wump, wump, wump",
)
$ bazel cquery @macos_codesign//:all
@macos_codesign//:codesign_auto (a938602)
@macos_codesign//:codesign_toolchain (a938602)
@macos_codesign//:codesign_toolchain_type (a938602)
@macos_codesign//:have_codesign (a938602)
@macos_codesign//:is_codesign_available (a938602)
@macos_codesign//:no_codesign (a938602)
@macos_codesign//:zzz_codesign_missing_toolchain (a938602)
```



### Additional
This is an alternate version of #54154. I think I like it better.
[ABLD-386]: https://datadoghq.atlassian.net/browse/ABLD-386



Co-authored-by: tony.aiuto <tony.aiuto@datadoghq.com>
aiuto added 2 commits August 11, 2026 00:23
@aiuto
[ABLD-395] MVP .pkg file rule.
ed2d5e0 
WHAT IT DOE

Creates a rule to create Mac PKG files.
- bazel/rules/macos/pkg/pkg_mac_pkg.bzl
  - materialize srcs to diesk via a pkg_install-generated installer. sub-optimal but equivalent to what omnibus does today. Future work will improve that.
  - bazel/rules/macos/pkg/build_mac_pkg.sh — the pkgbuild wrapper
- Adds packages/agent/macos/BUILD.bazel, to create a .pkg file for datadog-agent. This is obviously incomplete because //cmd/agent:agent is not ready yet.

- packages/agent/product/BUILD.bazel — fixed a pre-existing bug where //cmd/loader:trace_loader (Linux-only target_compatible_with) was listed unconditionally, breaking any non-Linux consumer of :all_files.

TESTING

Claude's words:
Both targets build successfully and produce well-formed .pkg files. Not yet done: version/package_variables substitution (still a hardcoded "7", matching the same gap that exists in pkg_deb/pkg_rpm today), and productbuild/signing are out of v1 scope as planned. Want me to update ~/mac_package.md to reflect current status, or move on to wiring version substitution next?

NEXT
- tweak until we have fidelity with the omnibus packager.
- replace use of pkg_install to manifest the tree tree with a direct reader/writer. That is probably upstreamable to rules_pkg in a contrib section.
- Add signing (blocked on ABLD-386)
@aiuto
pretty
6b1c91c
@aiuto
aiuto marked this pull request as ready for review August 12, 2026 04:36
@aiuto aiuto changed the title [ABLD-395] MVP .pkg file rule. [ABLD-395] MVP macos .pkg file rule. Aug 12, 2026
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Aug 12, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f92770e82

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread bazel/rules/macos/pkg/pkg_mac_pkg.bzl
@aiuto aiuto added the ask-review Ask in slack required teams to review this PR label Aug 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

ask-review Ask in slack required teams to review this PR changelog/no-changelog No changelog entry needed internal Identify a non-fork PR medium review PR review might take time qa/no-code-change No code change in Agent code requiring validation team/agent-build

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@aiuto