Hermetic nixpkgs_cc_toolchain

WORKSPACE

@@ -33,7 +33,7 @@ register_toolchains(
 load("//bazel_tools/dev_env_tool:dev_env_tool.bzl", "dadew", "dev_env_tool")
 load(
     "@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl",
-    "nixpkgs_cc_configure",
+    "nixpkgs_cc_configure_hermetic",
     "nixpkgs_local_repository",
     "nixpkgs_package",
     "nixpkgs_python_configure",
@@ -98,14 +98,17 @@ common_nix_file_deps = [
 ]
 
 # Use Nix provisioned cc toolchain
-nixpkgs_cc_configure(
+nixpkgs_cc_configure_hermetic(
+    # We override the Bazel's autodetect toolchain to avoid accidentaly
+    # dependencies on the inhermetic autodetected builtin include paths or
+    # builds failing due to Bazel not finding `cc` in `$PATH` or `$CC`.
+    name = "local_config_cc",
     nix_file = "//nix:bazel-cc-toolchain.nix",
     nix_file_deps = common_nix_file_deps + [
-        "//nix:bazel-cc-toolchain.nix",
         "//nix:tools/bazel-cc-toolchain/default.nix",
     ],
     repositories = dev_env_nix_repos,
-)
+) if not is_windows else None
 
 nixpkgs_python_configure(repository = "@nixpkgs") if not is_windows else None
 

bazel_tools/dev_env_tool/dev_env_tool.bzl

@@ -197,7 +197,9 @@ def _dadew_sh_posix_config_impl(repository_ctx):
 load("@rules_sh//sh:posix.bzl", "sh_posix_toolchain")
 sh_posix_toolchain(
     name = "dadew_posix",
-    {commands}
+    cmds = {{
+        {commands},
+    }},
 )
 toolchain(
     name = "dadew_posix_toolchain",
@@ -213,8 +215,8 @@ toolchain(
     ],
 )
 """.format(
-        commands = ",\n    ".join([
-            '{cmd} = r"{path}"'.format(cmd = cmd, path = cmd_path).replace("\\", "/")
+        commands = ",\n        ".join([
+            'r"{cmd}": r"{path}"'.format(cmd = cmd, path = cmd_path).replace("\\", "/")
             for (cmd, cmd_path) in commands.items()
             if cmd_path
         ]),

bazel_tools/fat_cc_library.bzl

@@ -113,14 +113,6 @@ fat_cc_library = rule(
         "_cc_toolchain": attr.label(
             default = Label("@bazel_tools//tools/cpp:current_cc_toolchain"),
         ),
-        "_cc_compiler": attr.label(
-            allow_files = True,
-            executable = True,
-            cfg = "host",
-            default =
-                # bin/cc is gcc on Darwin which fails to find libc++
-                Label("@nixpkgs_cc_toolchain//:bin/clang") if is_darwin else None,
-        ),
         "whole_archive_flag": attr.string_list(
             # ld on MacOS doesn’t understand --whole-archive
             default = ["-Wl,-all_load"] if is_darwin else ["-Wl,--whole-archive"],

bazel_tools/nixpkgs-disable-http2.patch

@@ -1,8 +1,8 @@
 diff --git a/nixpkgs/nixpkgs.bzl b/nixpkgs/nixpkgs.bzl
-index 263bb37..d363dfb 100644
+index 2f2c83d..61123c6 100644
 --- a/nixpkgs/nixpkgs.bzl
 +++ b/nixpkgs/nixpkgs.bzl
-@@ -88,7 +88,7 @@ def _nixpkgs_package_impl(repository_ctx):
+@@ -156,7 +156,7 @@ def _nixpkgs_package_impl(repository_ctx):
          "The NIX_PATH environment variable is not inherited."
      )
 
@@ -11,15 +11,12 @@ index 263bb37..d363dfb 100644
      if repository_ctx.attr.nix_file and repository_ctx.attr.nix_file_content:
          fail("Specify one of 'nix_file' or 'nix_file_content', but not both.")
      elif repository_ctx.attr.nix_file:
-diff --git a/nixpkgs/nixpkgs.bzl b/nixpkgs/nixpkgs.bzl
-index 263bb37..3360b9b 100644
---- a/nixpkgs/nixpkgs.bzl
-+++ b/nixpkgs/nixpkgs.bzl
-@@ -117,6 +117,7 @@ def _nixpkgs_package_impl(repository_ctx):
+@@ -186,6 +186,8 @@ def _nixpkgs_package_impl(repository_ctx):
          "bazel-support/nix-out-link",
      ])
 
 +    expr_args.extend(["--option", "http2", "false"])
-     expr_args.extend(repository_ctx.attr.nixopts)
-
-     # If repositories is not set, leave empty so nix will fail
++
+     if repository_ctx.attr.expand_location:
+         expr_args.extend([
+             _expand_location(repository_ctx, opt, nix_file_deps, "nixopts")