Follow-up to #5490: preserve sysroot compatibility and validate GCC runtimes

.github/workflows/_release.yml

@@ -63,6 +63,11 @@ on:
               fi
           done
           OUTPUT=$(printf '%s\n' "${_OUTPUT[@]}")
+      stdcc-versions:
+        description: Sysroot hash variants (deprecated variants are pinned and never updated)
+        type: string
+        default: |
+          ["base", "13"]
       template-version-update:
         type: string
         default: |
@@ -193,6 +198,7 @@ jobs:
           current: ${{ steps.bins-deps.outputs.output }}
           shas: ${{ steps.bins-shas.outputs.shas }}
           glibc_versions: ${{ inputs.glibc-versions }}
+          stdcc_versions: ${{ inputs.stdcc-versions }}
           arches: ${{ inputs.arches }}
           glint_version: ${{ inputs.glint-version }}
           versions_file: ${{ inputs.bazel-versions-file }}
@@ -206,6 +212,7 @@ jobs:
           | .shas as $shas
           | .current as $current
           | .glibc_versions as $glibc_versions
+          | .stdcc_versions as $stdccs
           | .arches as $arches
           | .san as $san
           | .glint_version as $glint_version
@@ -244,13 +251,17 @@ jobs:
                   else "" end] as $glint_updates
              | [$glibc_versions[]
                 | . as $glibc
+                | $stdccs[]
+                | . as $stdcc
+                | select($stdcc == "base")
                 | "sysroot-glibc\($glibc)-\($arch).tar.xz" as $sysroot
-                | ($shas[$sysroot]
-                   | split(":")
-                   | .[1]) as $new_sha
-                | $current.sysroot_hashes[$glibc][$arch] as $current_sha
-                | if $current_sha != $new_sha then
-                    "sed -i s/\($current_sha)/\($new_sha)/g \($versions_file)"
+                | ($shas[$sysroot] // null) as $sha_entry
+                | if $sha_entry then
+                    ($sha_entry | split(":") | .[1]) as $new_sha
+                    | $current.sysroot_hashes[$glibc][$stdcc][$arch] as $current_sha
+                    | if $current_sha != $new_sha then
+                        "sed -i s/\($current_sha)/\($new_sha)/g \($versions_file)"
+                      else "" end
                   else "" end] as $sysroot_updates
               | $glint_updates + $sysroot_updates] as $arch_updates
           | [

.github/workflows/bazel.yml

@@ -214,15 +214,21 @@ jobs:
           bazel_args: >-
             --config=ci
             --config=gcc
+            --skip_incompatible_explicit_targets
           privileged: false
           rbe: true
           runner: ubuntu-24.04
           targets: >-
             //compile/test:check_glibc_test
             //compile/test:stdlib_libstdcxx_test
             //compile/test:gcc_runtime_test
+            //compile/test:wee8_prebuilt_link_test
             //toolchains/gcc:linux_x64_paths_test
             //toolchains/gcc:linux_arm64_paths_test
+            //toolchains/gcc:linux_x86_64_runtime_test
+            //toolchains/gcc:linux_aarch64_runtime_test
+            //toolchains/gcc:linux_x86_64_runtime_abi_test
+            //toolchains/gcc:linux_aarch64_runtime_abi_test
         - name: x86-to-arm
           action: test
           bazel_args: >-

bazel/.bazelrc

@@ -93,8 +93,10 @@ common:remote-exec --define=engflow_rbe=true
 # This is safe for ordinary (libcxx) targets: gcc requires //compile:libstdcxx
 # on the target platform, so it is not a candidate at all, and the gcc platforms
 # yield no toolchain and are skipped.
+# Both GCC 13.4.0 archives are x86_64-hosted: aarch64 GCC builds cross-compile
+# on linux_x64_gcc workers, not the native arm64 pool.
 common:remote-exec --host_platform=//platforms/rbe:linux_x64
-common:remote-exec --extra_execution_platforms=//platforms/rbe:linux_x64_gcc,//platforms/rbe:linux_arm64_gcc,//platforms/rbe:linux_x64,//platforms/rbe:linux_arm64
+common:remote-exec --extra_execution_platforms=//platforms/rbe:linux_x64_gcc,//platforms/rbe:linux_x64,//platforms/rbe:linux_arm64
 
 
 #############################################################################

bazel/MODULE.bazel

@@ -116,6 +116,10 @@ sysroot_ext = use_extension("//sysroot:extensions.bzl", "sysroot_extension", dev
 sysroot_ext.setup()
 use_repo(sysroot_ext, "sysroot_linux_amd64", "sysroot_linux_arm64")
 
+# Exercise deprecated downloads without changing the toolchains' base sysroots.
+sysroot_ext.setup(stdcc_version = "13", name_prefix = "legacy")
+use_repo(sysroot_ext, "legacy_sysroot_linux_amd64", "legacy_sysroot_linux_arm64")
+
 macos_sysroot_test_repo = use_repo_rule("//sysroot:sysroot.bzl", "macos_sysroot")
 
 macos_sysroot_test_repo(
@@ -185,6 +189,7 @@ use_repo(gcc, "gcc_linux_aarch64", "gcc_linux_x86_64")
 register_toolchains(
     "//toolchains/gcc:linux_x64_toolchain",
     "//toolchains/gcc:linux_arm64_toolchain",
+    dev_dependency = True,
 )
 
 # Configure LLVM toolchain

bazel/compile/test/BUILD.bazel

@@ -1,10 +1,21 @@
 load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 load("@rules_cc//cc:defs.bzl", "cc_binary")
 load("@rules_shell//shell:sh_test.bzl", "sh_test")
+load("//:versions.bzl", "VERSIONS")
 load(":clang_version_test.bzl", "clang_version_test")
 
 package(default_visibility = ["//visibility:public"])
 
+# TODO: remove the hash gate after the next bins release rebuilds libstdcxx wee8.
+# This published prebuilt used host glibc 2.39; changing its hash activates CI.
+_WEE8_LINK_COMPATIBLE = select({
+    "//compile:gcc_build": [],
+    "//conditions:default": ["@platforms//:incompatible"],
+}) if VERSIONS["wee8_sha256"]["x86_64"]["libstdcxx"] not in [
+    "",
+    "ad9895c550bdf8f4de931c0143c99cc28ae38aa0b475bc4602e494eedac46e90",
+] else ["@platforms//:incompatible"]
+
 exports_files([
     "assert_llvm_minimal_bins_layout.sh",
     "assert_llvm_minimal_manifest.sh",
@@ -325,3 +336,32 @@ sh_test(
         "//conditions:default": ["@platforms//:incompatible"],
     }),
 )
+
+# Unlike archive symbol-name filtering, this link resolves wee8's libc references
+# against the base sysroot and produces an ELF with actual GLIBC version tags.
+cc_binary(
+    name = "wee8_link_probe",
+    srcs = ["wee8_link_probe.cc"],
+    tags = ["manual"],
+    target_compatible_with = _WEE8_LINK_COMPATIBLE,
+    deps = ["//v8:wee8"],
+)
+
+sh_test(
+    name = "wee8_prebuilt_link_test",
+    size = "small",
+    srcs = ["check_glibc.sh"],
+    data = [
+        ":wee8_link_probe",
+        "@llvm_toolchain_llvm//:nm",
+        "@llvm_toolchain_llvm//:readelf",
+    ],
+    env = {
+        "BINARY": "$(rootpath :wee8_link_probe)",
+        "CHECK_STATIC_RUNTIME": "true",
+        "NM": "$(rootpath @llvm_toolchain_llvm//:nm)",
+        "READELF": "$(rootpath @llvm_toolchain_llvm//:readelf)",
+    },
+    tags = ["manual"],
+    target_compatible_with = _WEE8_LINK_COMPATIBLE,
+)

bazel/compile/test/wee8_link_probe.cc

@@ -0,0 +1,9 @@
+#include "wasm-api/wasm.h"
+
+int main() {
+  wasm_engine_t *engine = wasm_engine_new();
+  wasm_store_t *store = wasm_store_new(engine);
+  wasm_store_delete(store);
+  wasm_engine_delete(engine);
+  return 0;
+}

bazel/platforms/rbe/BUILD

@@ -13,6 +13,10 @@ WORKER_IMAGE = "docker://gcr.io/envoy-ci/envoy-build:worker-v0.1.8@sha256:934b50
 # GCC worker container image used by EngFlow RBE for gcc builds.
 #
 # Image produced by this repo at release docker-v0.1.3.
+# GCC is now hermetic: GCC_WORKER_IMAGE and //compile:gcc_worker are no longer
+# required for correctness and can be collapsed into the general worker later.
+# Both GCC 13.4.0 archives are x86_64-hosted; aarch64 targets cross-compile on
+# linux_x64_gcc rather than the arm64 RBE pool. Native sibling releases omit GCC 13.
 GCC_WORKER_IMAGE = "docker://gcr.io/envoy-ci/envoy-build:gcc-v0.1.8@sha256:342d7eaccb753e8efb2aa171dccfd3bd7e531a22730ecb72372ab64c5967681b"
 
 platform(
@@ -47,24 +51,10 @@ platform(
     constraint_values = [
         "@platforms//os:linux",
         "@platforms//cpu:x86_64",
-        "//compile:gcc_worker"
+        "//compile:gcc_worker",
     ],
     exec_properties = {
         "container-image": GCC_WORKER_IMAGE,
         "OSFamily": "Linux",
     },
 )
-
-platform(
-    name = "linux_arm64_gcc",
-    constraint_values = [
-        "@platforms//os:linux",
-        "@platforms//cpu:aarch64",
-        "//compile:gcc_worker"
-    ],
-    exec_properties = {
-        "container-image": GCC_WORKER_IMAGE,
-        "OSFamily": "Linux",
-        "Pool": "arm",
-    },
-)

bazel/sysroot/README.md

@@ -32,31 +32,73 @@ Linux x86_64 (including aarch64 cross-compilation). GCC supplies its own
 libstdc++, libgcc, libgcc_eh, and crtbegin/crtend objects; glibc supplies
 crt1/crti/crtn from this sysroot. GCC links its C++ runtime statically.
 LLVM continues to supply compiler-rt and libc++ from its own toolchain.
+The GCC 13.4.0 release has no aarch64-hosted archive (native sibling releases
+start at newer GCC versions), so there is no `linux_arm64_gcc` execution
+platform: aarch64 GCC actions run on x86_64 workers.
 
 The pinned archives come from
 [f0rmiga/gcc-builds release 18082025](https://github.com/f0rmiga/gcc-builds/releases/tag/18082025),
-the same source used by envoyproxy/envoy#39632. Its
-[build recipe](https://github.com/f0rmiga/gcc-builds/blob/3fcca92fd993788a88af150cd4c885e4860e0055/Dockerfile)
-builds the target runtime against glibc 2.26. The repository rule removes the
-archive's bundled libc sysroot and explicitly uses toolshed's glibc 2.31 sysroot.
+the same source used by envoyproxy/envoy#39632. Empirical inspection of the
+SHA-pinned archives measured maximum GLIBC requirements of **2.26 (x86_64)**
+and **2.25 (aarch64)** in the shared libstdc++ siblings. The static archives'
+`nm -u` output contains no GLIBC version tags, `__isoc23_*`, or
+`__libc_single_threaded`; absence of version tags alone is not proof of
+compatibility. `//toolchains/gcc:linux_{x86_64,aarch64}_runtime_abi_test` also
+resolves every strong undefined name in libstdc++.a/libgcc.a/libgcc_eh.a against
+the other runtimes, GCC CRT, and base-sysroot exports at or below GLIBC_2.31
+(1,383 x86_64 and 1,365 aarch64 names in the pinned archives). The existing
+stdlib fixture linked with these inputs on both architectures with a measured
+maximum GLIBC_2.25 and no dynamic libstdc++/libgcc_s dependencies.
+The repository rule removes the archive's bundled libc sysroot and explicitly
+uses toolshed's glibc 2.31 sysroot.
 Replacement GCC archives **must build their target runtimes against glibc
 <= 2.31**; changing `--sysroot` cannot lower the glibc requirement of an
 already-built libstdc++.
 
 Downstreams can instantiate the downloads with `gcc_extension` from
 `//toolchains/gcc:extensions.bzl`, using a `toolchain(name = ..., arch =
 "x86_64" | "aarch64", sysroot = "@sysroot_linux_...//sysroot")` tag per target.
-Each generated repository exports `:cc_toolchain`, `:config`, and `:files`.
+Downstreams must instantiate this extension and register their own toolchains;
+toolshed's registrations are dev-only. Register GCC before LLVM, as in
+toolshed's `MODULE.bazel`.
+Each generated repository exports `:cc_toolchain`, `:config`, `:files`,
+`:libstdcxx` (headers and static library), and `:libgcc` (static runtime archives).
 The sysroot label must point directly into the `sysroot` package, not its
 root-package alias.
 
+Consumers compiling with a non-GCC toolchain but needing the libstdc++ ABI
+(for example, Envoy's `compat/openssl/prefixer` linking against prebuilt
+`libclang-cpp.so`) should use the GCC repository rather than a second sysroot:
+
+```starlark
+cc_binary(
+    name = "prefixer",
+    srcs = ["prefixer.cpp"],
+    copts = ["-nostdinc++", "-stdlib=libstdc++"],
+    deps = [
+        "@gcc_linux_x86_64//:libstdcxx",
+        # ... clang-tooling dependencies ...
+    ],
+)
+```
+
+Use the appropriate `@<gcc_repo>//:libstdcxx` for the compilation architecture.
+Its `CcInfo` supplies headers as compile inputs, include directories, and the
+static archive as a link input, including on RBE. Keep libc/CRT from the base
+sysroot: adding `-L` for a legacy sysroot's entire `usr/lib/<triple>` can mix
+libc/libpthread versions and produce `GLIBC_PRIVATE` and `__libc_csu_*` errors.
+
 **Release TODO:** the next `bins-v*` release must regenerate both wee8
 libstdcxx archives and refresh `VERSIONS["wee8_sha256"][arch]["libstdcxx"]`
 before downstream consumption (including envoyproxy/envoy#39632). Existing
 x86_64 libstdcxx artifacts were built against host glibc 2.39 and are not
 compatible with this floor; aarch64 libstdcxx remains an incompatible prebuilt
 stub until its first archive/hash is published. `//v8:wee8_packages` builds
 all four arch/stdlib combinations without consuming these prebuilts.
+`//compile/test:wee8_prebuilt_link_test` links wasm C-API entry points against
+`//v8:wee8`, then checks the executable's GLIBC versions and static C++ runtime.
+The GCC CI leg includes it, but the known-incompatible x86_64 hash gates it off
+until replaced; the archive symbol-name scan remains an early pre-filter.
 
 ## Architecture Support
 
@@ -175,16 +217,22 @@ The setup will automatically validate your configuration:
 - **Missing hashes** (e.g., for unreleased configurations) will fail with a helpful message
 
 All SHA256 hashes are centrally managed in `versions.bzl` as
-`sysroot_hashes[glibc_version][arch]`.
+`sysroot_hashes[glibc_version][variant][arch]`, where variant is `"base"` or `"13"`.
 
 ### Migrating existing configurations
 
-Sysroots no longer bundle libstdc++. Remove `stdcc_version` from repository-rule,
-`setup_sysroots`, and module-extension calls, and remove `variant`, `ppa_toolchain`,
-and `stdcc_version` arguments from `sysrootfs` calls. The script no longer accepts
-`--variant`, `--ppa-toolchain`, or `--stdcc`. Use the unsuffixed sysroot build
-targets below and supply any C++ standard library through the toolchain.
-Existing unsuffixed archives and their SHA256 hashes are unchanged.
+New sysroots no longer bundle libstdc++. Downloads with `stdcc_version = "13"`
+on repository-rule, `setup_sysroots`, and module-extension calls remain supported
+for already-published `sysroot-glibc{2.28,2.31}-libstdc++13-{amd64,arm64}.tar.xz`
+archives. **This variant is deprecated and will not be rebuilt in future
+`bins-v*` releases.** Its default download remains pinned to the legacy release;
+an explicit `version` overrides that pin. Consumers must migrate to
+`@<gcc_repo>//:libstdcxx` and remove `stdcc_version`.
+
+For sysroot *builds*, remove `variant`, `ppa_toolchain`, and `stdcc_version`
+arguments from `sysrootfs` calls. The script no longer accepts `--variant`,
+`--ppa-toolchain`, or `--stdcc`. Use the unsuffixed build targets below.
+Existing unsuffixed archive names and hashes are unchanged.
 
 ## Building Sysroots with Bazel
 

bazel/sysroot/extensions.bzl

@@ -27,13 +27,14 @@ def _sysroot_impl(module_ctx):
                 setup_sysroots(
                     version = setup_tag.version if setup_tag.version else None,
                     glibc_version = setup_tag.glibc_version,
+                    stdcc_version = setup_tag.stdcc_version if setup_tag.stdcc_version else None,
                     name_prefix = setup_tag.name_prefix,
                 )
 
 _setup = tag_class(
     attrs = {
         "version": attr.string(
-            doc = "Version of sysroot release to use (default: uses VERSIONS['bins_release'])",
+            doc = "Release to use (default: VERSIONS['bins_release'] for base sysroots, VERSIONS['sysroot_stdcc_release'] for deprecated variants)",
         ),
         "glibc_version": attr.string(
             default = "2.31",
@@ -45,6 +46,10 @@ _setup = tag_class(
                     Allows multiple sysroot setups, e.g., name_prefix='old' creates
                     @old_sysroot_linux_amd64 and @old_sysroot_linux_arm64""",
         ),
+        "stdcc_version": attr.string(
+            default = "",
+            doc = "Deprecated libstdc++ sysroot variant (e.g., '13'). Use the base sysroot and hermetic GCC toolchain instead.",
+        ),
     },
 )