bazel: support select() for cache_entries in envoy_cmake by wdauchy · Pull Request #42461 · envoyproxy/envoy

wdauchy · 2025-12-08T11:09:28Z

Commit Message:
Allow envoy_cmake to accept cache_entries as either a dict or a select() statement. This enables conditional CMake cache entries based on build configuration, which is required for FIPS builds where different library paths must be used for FIPS vs non-FIPS builds.

When cache_entries is a dict (the common case), the function continues to merge default_cache_entries and wrap the result in a select() for debug builds. When cache_entries is already a select(), it is passed through directly to avoid nested select() statements, which Bazel does not support.

This change enables targets like ipp-crypto to use selects.with_or() to
conditionally set OPENSSL_CRYPTO_LIBRARY based on whether the build is
FIPS-compliant (using libcrypto.a) or non-FIPS (using libcrypto_internal.a).

Additional Description:

without this patch the build fails with:

-- Found OpenSSL: /build/.cache/bazel/_bazel_envoybuild/5510e63bd001cefa746eb005f1949cb5/sandbox/processwrapper-sandbox/6607/execroot/envoy/bazel-out/k8-opt/bin/contrib/cryptomb/private_key_providers/source/ipp-crypto.ext_build_deps/lib/libcrypto_internal.a (found version "")
-- Configuring done (6.3s)
CMake Error at src/CMakeLists.txt:235 (target_link_libraries):
  Target "crypto_mb_s" links to:
    OpenSSL::Crypto
  but the target was not found.  Possible reasons include:
    * There is a typo in the target name.
    * A find_package call is missing for an IMPORTED target.
    * An ALIAS target is missing.
CMake Error at src/CMakeLists.txt:273 (target_link_libraries):
  Target "crypto_mb" links to:
    OpenSSL::Crypto
  but the target was not found.  Possible reasons include:
    * There is a typo in the target name.
    * A find_package call is missing for an IMPORTED target.
    * An ALIAS target is missing.
-- Generating done (0.4s)

Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

repokitteh-read-only · 2025-12-08T11:09:34Z

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #42461 was opened by wdauchy.

see: more, trace.

wdauchy · 2025-12-08T11:47:56Z

@phlax is it something you may review?

phlax

thanks for this @wdauchy

im a bit unsure whether this is a good idea as i think it would make it harder to use select on the actual cache_entries - ie iirc you cant nest selects

phlax · 2025-12-08T15:43:57Z

+        # FIPS builds (both not_ppc and ppc) use libcrypto.a/libssl.a
+        (
+            "//bazel:boringssl_fips_not_ppc",
+            "//bazel:boringssl_fips_ppc",


do we need a with_or here? porobably it would be cleaner to just have //bazel:boringssl_fips that was arch agnostic

its already there in fact

could you address this please - there is no need for the with_or just use the constraint i posted above

right, thanks for the reminder
now fixed

Allow envoy_cmake to accept cache_entries as either a dict or a select() statement. This enables conditional CMake cache entries based on build configuration, which is required for FIPS builds where different library paths must be used for FIPS vs non-FIPS builds. When cache_entries is a dict (the common case), the function continues to merge default_cache_entries and wrap the result in a select() for debug builds. When cache_entries is already a select(), it is passed through directly to avoid nested select() statements, which Bazel does not support. without this patch the build fails with: ``` -- Found OpenSSL: /build/.cache/bazel/_bazel_envoybuild/5510e63bd001cefa746eb005f1949cb5/sandbox/processwrapper-sandbox/6607/execroot/envoy/bazel-out/k8-opt/bin/contrib/cryptomb/private_key_providers/source/ipp-crypto.ext_build_deps/lib/libcrypto_internal.a (found version "") -- Configuring done (6.3s) CMake Error at src/CMakeLists.txt:235 (target_link_libraries): Target "crypto_mb_s" links to: OpenSSL::Crypto but the target was not found. Possible reasons include: * There is a typo in the target name. * A find_package call is missing for an IMPORTED target. * An ALIAS target is missing. CMake Error at src/CMakeLists.txt:273 (target_link_libraries): Target "crypto_mb" links to: OpenSSL::Crypto but the target was not found. Possible reasons include: * There is a typo in the target name. * A find_package call is missing for an IMPORTED target. * An ALIAS target is missing. -- Generating done (0.4s) ``` Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

phlax

lgtm, thanks @wdauchy

im still wondering whether the name inconsistency this address might be an issue elsewhere - but defo out of scope for this pr

wdauchy · 2025-12-12T10:26:41Z

im still wondering whether the name inconsistency this address might be an issue elsewhere - but defo out of scope for this pr

I agree it is a bit weird. we can work together to address other issues

phlax · 2025-12-12T10:34:35Z

/retest transients

wdauchy · 2025-12-12T11:09:38Z

/retest transients

…42461) Allow envoy_cmake to accept cache_entries as either a dict or a select() statement. This enables conditional CMake cache entries based on build configuration, which is required for FIPS builds where different library paths must be used for FIPS vs non-FIPS builds. When cache_entries is a dict (the common case), the function continues to merge default_cache_entries and wrap the result in a select() for debug builds. When cache_entries is already a select(), it is passed through directly to avoid nested select() statements, which Bazel does not support. This change enables targets like ipp-crypto to use selects.with_or() to conditionally set OPENSSL_CRYPTO_LIBRARY based on whether the build is FIPS-compliant (using libcrypto.a) or non-FIPS (using libcrypto_internal.a). without this patch the build fails with: ``` -- Found OpenSSL: /build/.cache/bazel/_bazel_envoybuild/5510e63bd001cefa746eb005f1949cb5/sandbox/processwrapper-sandbox/6607/execroot/envoy/bazel-out/k8-opt/bin/contrib/cryptomb/private_key_providers/source/ipp-crypto.ext_build_deps/lib/libcrypto_internal.a (found version "") -- Configuring done (6.3s) CMake Error at src/CMakeLists.txt:235 (target_link_libraries): Target "crypto_mb_s" links to: OpenSSL::Crypto but the target was not found. Possible reasons include: * There is a typo in the target name. * A find_package call is missing for an IMPORTED target. * An ALIAS target is missing. CMake Error at src/CMakeLists.txt:273 (target_link_libraries): Target "crypto_mb" links to: OpenSSL::Crypto but the target was not found. Possible reasons include: * There is a typo in the target name. * A find_package call is missing for an IMPORTED target. * An ALIAS target is missing. -- Generating done (0.4s) ``` Signed-off-by: William Dauchy <william.dauchy@datadoghq.com> Signed-off-by: MayorFaj <mayorfaj@gmail.com>

…42461) Allow envoy_cmake to accept cache_entries as either a dict or a select() statement. This enables conditional CMake cache entries based on build configuration, which is required for FIPS builds where different library paths must be used for FIPS vs non-FIPS builds. When cache_entries is a dict (the common case), the function continues to merge default_cache_entries and wrap the result in a select() for debug builds. When cache_entries is already a select(), it is passed through directly to avoid nested select() statements, which Bazel does not support. This change enables targets like ipp-crypto to use selects.with_or() to conditionally set OPENSSL_CRYPTO_LIBRARY based on whether the build is FIPS-compliant (using libcrypto.a) or non-FIPS (using libcrypto_internal.a). without this patch the build fails with: ``` -- Found OpenSSL: /build/.cache/bazel/_bazel_envoybuild/5510e63bd001cefa746eb005f1949cb5/sandbox/processwrapper-sandbox/6607/execroot/envoy/bazel-out/k8-opt/bin/contrib/cryptomb/private_key_providers/source/ipp-crypto.ext_build_deps/lib/libcrypto_internal.a (found version "") -- Configuring done (6.3s) CMake Error at src/CMakeLists.txt:235 (target_link_libraries): Target "crypto_mb_s" links to: OpenSSL::Crypto but the target was not found. Possible reasons include: * There is a typo in the target name. * A find_package call is missing for an IMPORTED target. * An ALIAS target is missing. CMake Error at src/CMakeLists.txt:273 (target_link_libraries): Target "crypto_mb" links to: OpenSSL::Crypto but the target was not found. Possible reasons include: * There is a typo in the target name. * A find_package call is missing for an IMPORTED target. * An ALIAS target is missing. -- Generating done (0.4s) ``` Signed-off-by: William Dauchy <william.dauchy@datadoghq.com> Signed-off-by: Gustavo <grnmeira@gmail.com>

wdauchy marked this pull request as ready for review December 8, 2025 11:30

phlax reviewed Dec 8, 2025

View reviewed changes

phlax self-assigned this Dec 8, 2025

wdauchy force-pushed the fips-build branch from fd8820f to 136abbb Compare December 12, 2025 10:08

phlax reviewed Dec 12, 2025

View reviewed changes

Comment thread contrib/cryptomb/private_key_providers/source/BUILD

address comments

589017f

Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

phlax approved these changes Dec 12, 2025

View reviewed changes

phlax enabled auto-merge (squash) December 12, 2025 10:25

phlax merged commit 330072a into envoyproxy:main Dec 12, 2025
25 checks passed

Conversation

wdauchy commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repokitteh-read-only Bot commented Dec 8, 2025

Uh oh!

wdauchy commented Dec 8, 2025

Uh oh!

phlax left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

phlax Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

phlax Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

phlax Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

wdauchy Dec 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

phlax left a comment

Choose a reason for hiding this comment

Uh oh!

wdauchy commented Dec 12, 2025

Uh oh!

phlax commented Dec 12, 2025

Uh oh!

wdauchy commented Dec 12, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

wdauchy commented Dec 8, 2025 •

edited

Loading

wdauchy Dec 12, 2025 •

edited

Loading