Use bazel hermetic toolchain for llvm

[phlax]

if we can switch to using a hermetic bazel toolchain we can eliminate whole classes of (build) issues where people dont have exactly the correct compiler version

its also likely/possible that by doing this we will reduce the CI footprint as we can remove the llvm toolchain from the build container, which is also used by backend RBE workers, and hopefully a lot less will be passed around when building and testing

this has been attempted a couple of times previously but we never quite got it working, but i think it should be doable

[phlax]

cc @krinkinmu @keith

[DemiMarie]

I support this route, but it would be strongly preferred for the hermetic toolchain to itself have a reproducible build using the compiler the user already has installed. Using the binary should be an (on-by-default) optimization, but not required for correctness.

[phlax]

its not really hermetic if its using the host compiler - that said - in this scenario users will be able to use the available published toolchains which covers most version (ymmv as to whether envoy builds tho)

[DemiMarie]

The purpose is so that users can validate that the published toolchains are built from published source code, rather than just being arbitrary binaries.

[DemiMarie]

its not really hermetic if its using the host compiler

I meant “use the host compiler to bootsrap the toolchain, which then builds itself”. For any reasonable host compiler, this will always produce the same output after bootstrapping.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or "no stalebot" or other activity occurs. Thank you for your contributions.