Replace git_sha_rewriter.py with a generated linker option.

bazel/BUILD

@@ -7,6 +7,34 @@ exports_files([
     "sh_test_wrapper.sh",
 ])
 
+genrule(
+    name = "gnu_build_id",
+    outs = ["gnu_build_id.ldscript"],
+    cmd = """
+      echo --build-id=0x$$(
+          grep BUILD_SCM_REVISION bazel-out/volatile-status.txt \\
+        | sed 's/^BUILD_SCM_REVISION //') \\
+        > $@
+    """,
+    # Undocumented attr to depend on workspace status files.
+    # https://github.com/bazelbuild/bazel/issues/4942
+    stamp = 1,
+)
+
+# For MacOS, which doesn't have GNU ld's `--build-id` flag.
+genrule(
+    name = "raw_build_id",
+    outs = ["raw_build_id.ldscript"],
+    cmd = """
+      grep BUILD_SCM_REVISION bazel-out/volatile-status.txt \\
+    | sed 's/^BUILD_SCM_REVISION //' \\
+    > $@
+    """,
+    # Undocumented attr to depend on workspace status files.
+    # https://github.com/bazelbuild/bazel/issues/4942
+    stamp = 1,
+)
+
 config_setting(
     name = "opt_build",
     values = {"compilation_mode": "opt"},
@@ -22,6 +50,11 @@ config_setting(
     values = {"compilation_mode": "dbg"},
 )
 
+config_setting(
+    name = "coverage_build",
+    values = {"define": "ENVOY_CONFIG_COVERAGE=1"},
+)
+
 config_setting(
     name = "disable_tcmalloc",
     values = {"define": "tcmalloc=disabled"},

bazel/envoy_build_system.bzl

@@ -37,9 +37,6 @@ def envoy_linkopts():
     return select({
         # OSX provides system and stdc++ libraries dynamically, so they can't be linked statically.
         # Further, the system library transitively links common libraries (e.g., pthread).
-        # TODO(zuercher): build id could be supported via "-sectcreate __TEXT __build_id <file>"
-        # The file could should contain the current git SHA (or enough placeholder data to allow
-        # it to be rewritten by tools/git_sha_rewriter.py).
         "@bazel_tools//tools/osx:darwin": [
             # See note here: http://luajit.org/install.html
             "-pagezero_size 10000", "-image_base 100000000",
@@ -48,15 +45,6 @@ def envoy_linkopts():
             "-pthread",
             "-lrt",
             "-ldl",
-            # Force MD5 hash in build. This is part of the workaround for
-            # https://github.com/bazelbuild/bazel/issues/2805. Bazel actually
-            # does this by itself prior to
-            # https://github.com/bazelbuild/bazel/commit/724706ba4836c3366fc85b40ed50ccf92f4c3882.
-            # Ironically, forcing it here so that in future releases we will
-            # have the same behavior. When everyone is using an updated version
-            # of Bazel, we can use linkopts to set the git SHA1 directly in the
-            # --build-id and avoid doing the following.
-            '-Wl,--build-id=md5',
             '-Wl,--hash-style=gnu',
             "-static-libstdc++",
             "-static-libgcc",
@@ -65,6 +53,35 @@ def envoy_linkopts():
                                    ["-static-libstdc++", "-static-libgcc"]) \
     + envoy_select_exported_symbols(["-Wl,-E"])
 
+def _envoy_stamped_linkopts():
+  return select({
+    # Coverage builds in CI are failing to link when setting a build ID.
+    #
+    # /usr/bin/ld.gold: internal error in write_build_id, at ../../gold/layout.cc:5419
+    "@envoy//bazel:coverage_build": [],
+
+    # MacOS doesn't have an official equivalent to the `.note.gnu.build-id`
+    # ELF section, so just stuff the raw ID into a new text section.
+    "@bazel_tools//tools/osx:darwin": [
+        "-sectcreate __TEXT __build_id", "$(location //bazel:raw_build_id.ldscript)"
+    ],
+
+    # Note: assumes GNU GCC (or compatible) handling of `--build-id` flag.
+    "//conditions:default": [
+        "-Wl,@$(location //bazel:gnu_build_id.ldscript)",
+    ],
+  })
+
+def _envoy_stamped_deps():
+  return select({
+    "@bazel_tools//tools/osx:darwin": [
+        "//bazel:raw_build_id.ldscript"
+    ],
+    "//conditions:default": [
+        "//bazel:gnu_build_id.ldscript",
+    ],
+  })
+
 # Compute the test linkopts based on various options.
 def envoy_test_linkopts():
     return select({
@@ -149,21 +166,6 @@ def envoy_cc_library(name,
         strip_include_prefix = strip_include_prefix,
    )
 
-def _git_stamped_genrule(repository, name):
-    # To workaround https://github.com/bazelbuild/bazel/issues/2805, we
-    # do binary rewriting to replace the linker produced MD5 hash with the
-    # version_generated.cc git SHA1 hash (truncated).
-    rewriter = repository + "//tools:git_sha_rewriter.py"
-    native.genrule(
-        name = name + "_stamped",
-        srcs = [name],
-        outs = [name + ".stamped"],
-        cmd = "cp $(location " + name + ") $@ && " +
-              "chmod u+w $@ && " +
-              "$(location " + rewriter + ") $@",
-        tools = [rewriter],
-    )
-
 # Envoy C++ binary targets should be specified with this function.
 def envoy_cc_binary(name,
                     srcs = [],
@@ -178,11 +180,9 @@ def envoy_cc_binary(name,
 
     if not linkopts:
         linkopts = envoy_linkopts()
-
-    # Implicit .stamped targets to obtain builds with the (truncated) git SHA1.
     if stamped:
-        _git_stamped_genrule(repository, name)
-        _git_stamped_genrule(repository, name + ".stripped")
+        linkopts = linkopts + _envoy_stamped_linkopts()
+        deps = deps + _envoy_stamped_deps()
     deps = deps + [envoy_external_dep_path(dep) for dep in external_deps]
     native.cc_binary(
         name = name,
@@ -194,8 +194,6 @@ def envoy_cc_binary(name,
         linkstatic = 1,
         visibility = visibility,
         malloc = tcmalloc_external_dep(repository),
-        # See above comment on MD5 hash, this is another "force MD5 stamps" to make sure our
-        # rewriting is robust.
         stamp = 1,
         deps = deps,
     )

bazel/get_workspace_status

@@ -12,12 +12,18 @@
 # If the script exits with non-zero code, it's considered as a failure
 # and the output will be discarded.
 
+# For Envoy in particular, we want to force binaries to relink when the Git
+# SHA changes (https://github.com/envoyproxy/envoy/issues/2551). This can be
+# done by prefixing keys with "STABLE_". To avoid breaking compatibility with
+# other status scripts, this one still echos the non-stable ("volatile") names.
+
 # If this SOURCE_VERSION file exists then it must have been placed here by a
 # distribution doing a non-git, source build.
 # Distributions would be expected to echo the commit/tag as BUILD_SCM_REVISION
 if [ -f SOURCE_VERSION ]
 then
     echo "BUILD_SCM_REVISION $(cat SOURCE_VERSION)"
+    echo "STABLE_BUILD_SCM_REVISION $(cat SOURCE_VERSION)"
     echo "BUILD_SCM_STATUS Distribution"
     exit 0
 fi
@@ -29,6 +35,7 @@ then
     exit 1
 fi
 echo "BUILD_SCM_REVISION ${git_rev}"
+echo "STABLE_BUILD_SCM_REVISION ${git_rev}"
 
 # Check whether there are any uncommited changes
 git diff-index --quiet HEAD --
@@ -39,3 +46,4 @@ else
     tree_status="Modified"
 fi
 echo "BUILD_SCM_STATUS ${tree_status}"
+echo "STABLE_BUILD_SCM_STATUS ${tree_status}"

ci/do_ci.sh

@@ -10,11 +10,11 @@ echo "building using ${NUM_CPUS} CPUs"
 function bazel_release_binary_build() {
   echo "Building..."
   cd "${ENVOY_CI_DIR}"
-  bazel --batch build ${BAZEL_BUILD_OPTIONS} -c opt //source/exe:envoy-static.stamped
+  bazel --batch build ${BAZEL_BUILD_OPTIONS} -c opt //source/exe:envoy-static
   # Copy the envoy-static binary somewhere that we can access outside of the
   # container.
   cp -f \
-    "${ENVOY_CI_DIR}"/bazel-genfiles/source/exe/envoy-static.stamped \
+    "${ENVOY_CI_DIR}"/bazel-bin/source/exe/envoy-static \
     "${ENVOY_DELIVERY_DIR}"/envoy
 
   # TODO(mattklein123): Replace this with caching and a different job which creates images.
@@ -28,11 +28,11 @@ function bazel_release_binary_build() {
 function bazel_debug_binary_build() {
   echo "Building..."
   cd "${ENVOY_CI_DIR}"
-  bazel --batch build ${BAZEL_BUILD_OPTIONS} -c dbg //source/exe:envoy-static.stamped
+  bazel --batch build ${BAZEL_BUILD_OPTIONS} -c dbg //source/exe:envoy-static
   # Copy the envoy-static binary somewhere that we can access outside of the
   # container.
   cp -f \
-    "${ENVOY_CI_DIR}"/bazel-genfiles/source/exe/envoy-static.stamped \
+    "${ENVOY_CI_DIR}"/bazel-bin/source/exe/envoy-static \
     "${ENVOY_DELIVERY_DIR}"/envoy-debug
 }
 
@@ -146,7 +146,7 @@ elif [[ "$1" == "bazel.coverity" ]]; then
   echo "Building..."
   cd "${ENVOY_CI_DIR}"
   /build/cov-analysis/bin/cov-build --dir "${ENVOY_BUILD_DIR}"/cov-int bazel --batch build --action_env=LD_PRELOAD ${BAZEL_BUILD_OPTIONS} \
-    -c opt //source/exe:envoy-static.stamped
+    -c opt //source/exe:envoy-static
   # tar up the coverity results
   tar czvf "${ENVOY_BUILD_DIR}"/envoy-coverity-output.tgz -C "${ENVOY_BUILD_DIR}" cov-int
   # Copy the Coverity results somewhere that we can access outside of the container.

tools/BUILD

@@ -10,7 +10,6 @@ envoy_package()
 
 exports_files([
     "gen_git_sha.sh",
-    "git_sha_rewriter.py",
     "stack_decode.py",
     "check_format.py",
     "header_order.py",