bazel_7: fix bazelDeps build on darwin under sandbox=true

pkgs/by-name/ba/bazel_7/darwin_hacks/BlazeModule.java

@@ -0,0 +1,7 @@
+package com.google.devtools.build.lib.runtime;
+
+// We only need to capture enough details from Bazel source code
+// to make our modules compile and be binary-compatible.
+// This BlazeModule won't be injected into Bazel classpath.
+public abstract class BlazeModule {
+}

pkgs/by-name/ba/bazel_7/darwin_hacks/SleepPreventionModule.java

@@ -0,0 +1,9 @@
+package com.google.devtools.build.lib.platform;
+
+import com.google.devtools.build.lib.runtime.BlazeModule;
+
+// This class can fail in Nix sandbox on Darwin so we replace
+// it with a stub version
+public final class SleepPreventionModule extends BlazeModule {
+  // do nothing
+}

pkgs/by-name/ba/bazel_7/darwin_hacks/SystemSuspensionModule.java

@@ -0,0 +1,15 @@
+package com.google.devtools.build.lib.platform;
+
+import com.google.devtools.build.lib.runtime.BlazeModule;
+
+// This class can fail in Nix sandbox on Darwin so we replace
+// it with a stub version
+public final class SystemSuspensionModule extends BlazeModule {
+  // do nothing
+
+  // this method is part of module interface
+  synchronized void suspendCallback(int reason) {
+    // do nothing
+  }
+}
+

pkgs/by-name/ba/bazel_7/darwin_hacks/default.nix

@@ -0,0 +1,75 @@
+{
+  stdenv,
+  buildJdk,
+  runJdk,
+  version,
+  writeScript,
+}:
+let
+  fakeBazelModules = stdenv.mkDerivation {
+    pname = "fakeBazelModules";
+    inherit version;
+    dontUnpack = true;
+    buildPhase = "
+      # Java file name needs to match class name so we need to copy
+      cp ${./BlazeModule.java} ./BlazeModule.java
+      cp ${./SystemSuspensionModule.java} ./SystemSuspensionModule.java
+      cp ${./SleepPreventionModule.java} ./SleepPreventionModule.java
+
+      # compile all sources
+      ${buildJdk}/bin/javac -d . BlazeModule.java SystemSuspensionModule.java SleepPreventionModule.java
+
+      # don't package BlazeModule.class as we want to use real base class, but a stub compatible version was needed to make
+      # fake modules compile
+      ${buildJdk}/bin/jar cf output.jar ./com/google/devtools/build/lib/platform/{SystemSuspension,SleepPrevention}Module.class
+    ";
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/
+      install -Dm755 output.jar $out/output.jar
+
+      runHook postInstall
+    '';
+
+  };
+  # bin/java wrapper that injects fake modules into classpath
+  jvmInterceptSh = writeScript "java" ''
+    #!/usr/bin/env bash
+
+    # replaces
+    # .. -jar foo.jar ..
+    # with
+    # .. -cp ..overrides..:foo.jar MainClass ..
+    # to inject fake modules classes into Bazel
+
+    for (( i=2; i <= "$#"; i++ )); do
+      if [[ "''${!i}" == "-jar" ]]; then
+        prev=$(( i - 1 ))
+        jar=$(( i + 1 ))
+        MAIN_CLASS=$(unzip -qc "''${!jar}" META-INF/MANIFEST.MF | grep "^Main-Class: " | cut -d " " -f 2- | tr -d "\r")
+        next=$(( jar + 1 ))
+        exec "${runJdk}/bin/java" "''${@:1:prev}" -cp "${fakeBazelModules}/output.jar:''${!jar}" "$MAIN_CLASS" "''${@:next}"
+      fi
+    done
+
+    echo "Failed to find -jar argument in: $@" >&2
+    exit 1
+  '';
+in
+{
+  jvmIntercept = stdenv.mkDerivation {
+    pname = "jvmIntercept";
+    inherit version;
+    dontUnpack = true;
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin
+      install -Dm755 ${jvmInterceptSh} $out/bin/java
+
+      runHook postInstall
+    '';
+  };
+
+}

pkgs/by-name/ba/bazel_7/package.nix

@@ -5,6 +5,7 @@
   fetchurl,
   makeWrapper,
   writeTextFile,
+  writeScript,
   replaceVars,
   writeShellApplication,
   makeBinaryWrapper,
@@ -168,6 +169,22 @@ let
   bazelDeps =
     let
       bazelForDeps = if stdenv.hostPlatform.isDarwin then bazelBootstrap else bazelFhs;
+      serverJavabase =
+        if stdenv.hostPlatform.isDarwin then
+          let
+            hacks = (import ./darwin_hacks/default.nix) {
+              inherit
+                stdenv
+                buildJdk
+                runJdk
+                version
+                writeScript
+                ;
+            };
+          in
+          hacks.jvmIntercept
+        else
+          runJdk;
     in
     stdenv.mkDerivation {
       name = "bazelDeps";
@@ -203,8 +220,8 @@ let
       buildPhase = ''
         runHook preBuild
         export HOME=$(mktemp -d)
-        (cd bazel_src; ${bazelForDeps}/bin/bazel --server_javabase=${runJdk} mod deps --curses=no;
-        ${bazelForDeps}/bin/bazel --server_javabase=${runJdk} vendor src:bazel_nojdk \
+        (cd bazel_src; ${bazelForDeps}/bin/bazel --server_javabase=${serverJavabase} mod deps --curses=no;
+        ${bazelForDeps}/bin/bazel --server_javabase=${serverJavabase} vendor src:bazel_nojdk \
         --curses=no \
         --vendor_dir ../vendor_dir \
         --verbose_failures \