Add path to add extra settings to toolchains

toolchain/defs.bzl

@@ -2,6 +2,7 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load("@bazel_tools//tools/build_defs/repo:utils.bzl", "read_user_netrc", "use_netrc")
 load("@hermetic_cc_toolchain//toolchain/private:defs.bzl", "target_structs", "transform_os_name", "zig_tool_path")
 load("@hermetic_cc_toolchain//toolchain/private:repositories.bzl", "zig_sdk_repository")
+load("@hermetic_cc_toolchain//toolchain:utils.bzl", "quote")
 load(
     "@hermetic_cc_toolchain//toolchain/private:zig_sdk.bzl",
     "HOST_PLATFORM_SHA256",
@@ -64,7 +65,8 @@ def toolchains(
         url_formats = [],
         host_platform_sha256 = HOST_PLATFORM_SHA256,
         host_platform_ext = _HOST_PLATFORM_EXT,
-        exec_platforms = {}):
+        exec_platforms = {},
+        extra_target_settings = []):
     """
         Download zig toolchain and declare bazel toolchains.
         The platforms are not registered automatically, that should be done by
@@ -84,6 +86,7 @@ def toolchains(
     zig_sdk_repository(
         name = "zig_sdk",
         exec_platforms = exec_platforms,
+        extra_target_settings = extra_target_settings,
     )
 
     # create configs for the HOST
@@ -115,9 +118,6 @@ def toolchains(
         private = private_repos,
     )
 
-def _quote(s):
-    return "'" + s.replace("'", "'\\''") + "'"
-
 def _zig_repository_impl(repository_ctx):
     exec_os = repository_ctx.attr.exec_os
     exec_arch = repository_ctx.attr.exec_arch
@@ -166,8 +166,8 @@ def _zig_repository_impl(repository_ctx):
             Label(src),
             executable = False,
             substitutions = {
-                "{zig_sdk_path}": _quote("external/zig_sdk"),
-                "{os}": _quote(exec_os),
+                "{zig_sdk_path}": quote("external/zig_sdk"),
+                "{os}": quote(exec_os),
                 "{exec_os}": exec_os,
                 "{exec_cpu}": exec_arch,
             },

toolchain/ext.bzl

@@ -15,11 +15,19 @@ _exec_platform = tag_class(
     doc = "Zig execution platform tuple",
 )
 
+_extra_target_settings = tag_class(
+    attrs = {
+        "settings": attr.label_list(),
+    },
+    doc = "Each setting is added to every toolchain to make them more restrictive",
+)
+
 def _toolchains_impl(mctx):
     exec_platforms = {}
     root_direct_deps = []
     root_direct_dev_deps = []
     is_non_dev_dependency = mctx.root_module_has_non_dev_dependency
+    extra_target_settings = []
 
     for mod in mctx.modules:
         if mod.is_root:
@@ -29,7 +37,10 @@ def _toolchains_impl(mctx):
                     _archs.append(ep.arch)
                 exec_platforms[ep.os] = _archs
 
-            repos = zig_toolchains(exec_platforms = exec_platforms)
+            for tag in mod.tags.extra_target_settings:
+                extra_target_settings += tag.settings
+
+            repos = zig_toolchains(exec_platforms = exec_platforms, extra_target_settings = extra_target_settings)
 
             root_direct_deps = list(repos.public) if is_non_dev_dependency else []
             root_direct_dev_deps = list(repos.public) if not is_non_dev_dependency else []
@@ -46,5 +57,8 @@ def _toolchains_impl(mctx):
 
 toolchains = module_extension(
     implementation = _toolchains_impl,
-    tag_classes = {"exec_platform": _exec_platform},
+    tag_classes = {
+        "exec_platform": _exec_platform,
+        "extra_target_settings": _extra_target_settings,
+    },
 )

toolchain/libc_aware/toolchain/BUILD.bazel.tmpl

@@ -7,4 +7,4 @@ package(
     default_visibility = ["//visibility:public"],
 )
 
-declare_libc_aware_toolchains(configs = {configs})
+declare_libc_aware_toolchains(configs = {configs}, extra_target_settings = {extra_target_settings})

toolchain/private/repositories.bzl

@@ -1,12 +1,16 @@
 load("@hermetic_cc_toolchain//toolchain/private:defs.bzl", "transform_arch_name", "transform_os_name")
+load("@hermetic_cc_toolchain//toolchain:utils.bzl", "quote")
 
 def _define_zig_toolchains(repository_ctx, configs, package = ""):
+    extra_target_settings = "[" + " ".join([quote(str(setting)) + "," for setting in repository_ctx.attr.extra_target_settings]) + "]"
+
     repository_ctx.template(
         "toolchain/{}BUILD".format(package),
         Label("//toolchain/toolchain:BUILD.bazel.tmpl"),
         executable = False,
         substitutions = {
             "{configs}": repr(configs),
+            "{extra_target_settings}": extra_target_settings,
         },
     )
 
@@ -16,6 +20,7 @@ def _define_zig_toolchains(repository_ctx, configs, package = ""):
         executable = False,
         substitutions = {
             "{configs}": repr(configs),
+            "{extra_target_settings}": extra_target_settings,
         },
     )
 
@@ -94,6 +99,9 @@ zig_sdk_repository = repository_rule(
             doc = "Dictionary, where the keys are oses and the values are lists of supported architectures",
             mandatory = True,
         ),
+        "extra_target_settings": attr.label_list(
+            doc = "Additional settings to add to the generated toolchains, to make them more restrictive",
+        ),
     },
     implementation = _zig_sdk_repository_impl,
 )

toolchain/toolchain/BUILD.bazel.tmpl

@@ -4,4 +4,4 @@ package(
     default_visibility = ["//visibility:public"],
 )
 
-declare_toolchains(configs = {configs})
+declare_toolchains(configs = {configs}, extra_target_settings = {extra_target_settings})

toolchain/toolchain/defs.bzl

@@ -1,6 +1,6 @@
 load("@hermetic_cc_toolchain//toolchain/private:defs.bzl", "target_structs")
 
-def declare_toolchains(configs = ""):
+def declare_toolchains(configs = "", extra_target_settings = []):
     for target_config in target_structs():
         gotarget = target_config.gotarget
         zigtarget = target_config.zigtarget
@@ -12,11 +12,11 @@ def declare_toolchains(configs = ""):
         if hasattr(target_config, "libc_constraint"):
             extra_constraints = ["@zig_sdk//libc:unconstrained"]
 
-        _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + extra_constraints, configs)
+        _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + extra_constraints, configs, extra_target_settings)
 
     _declare_zig_toolchain("zig", configs)
 
-def declare_libc_aware_toolchains(configs = ""):
+def declare_libc_aware_toolchains(configs = "", extra_target_settings = []):
     for target_config in target_structs():
         gotarget = target_config.gotarget
         zigtarget = target_config.zigtarget
@@ -25,15 +25,16 @@ def declare_libc_aware_toolchains(configs = ""):
         # is only selected if libc is not expicitly set and another one that is
         # only selected if the specific libc variant is selected.
         if hasattr(target_config, "libc_constraint"):
-            _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + [target_config.libc_constraint], configs)
+            _declare_toolchain(gotarget, zigtarget, target_config.constraint_values + [target_config.libc_constraint], configs, extra_target_settings)
 
-def _declare_toolchain(gotarget, zigtarget, target_compatible_with, configs):
+def _declare_toolchain(gotarget, zigtarget, target_compatible_with, configs, extra_target_settings):
     # register two kinds of toolchain targets: Go and Zig conventions.
     # Go convention: amd64/arm64, linux/darwin
     native.toolchain(
         name = gotarget,
         exec_compatible_with = ["{}//:exec_os".format(configs), "{}//:exec_cpu".format(configs)],
         target_compatible_with = target_compatible_with,
+        target_settings = extra_target_settings,
         toolchain = "{}//:{}_cc".format(configs, zigtarget),
         toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
     )
@@ -43,6 +44,7 @@ def _declare_toolchain(gotarget, zigtarget, target_compatible_with, configs):
         name = zigtarget,
         exec_compatible_with = ["{}//:exec_os".format(configs), "{}//:exec_cpu".format(configs)],
         target_compatible_with = target_compatible_with,
+        target_settings = extra_target_settings,
         toolchain = "{}//:{}_cc".format(configs, zigtarget),
         toolchain_type = "@bazel_tools//tools/cpp:toolchain_type",
     )

toolchain/utils.bzl

@@ -0,0 +1,2 @@
+def quote(s):
+    return "'" + s.replace("'", "'\\''") + "'"