Merge remote-tracking branch 'origin/master' into HEAD

.bazelrc

@@ -3,6 +3,14 @@
 # Global Configuration
 # --------------------
 
+# Force TLS 1.2. With TLS 1.3, we run into the following error on Darwin.
+# > No subject alternative DNS name matching github-releases.githubusercontent.com found.
+# It looks like this is a result of SNI being broken on TLS 1.3 which results
+# in us getting a certificate for githubassets.com instead.
+#
+# Taken from https://github.com/digital-asset/daml/pull/8697.
+startup --host_jvm_args=-Djdk.tls.client.protocols=TLSv1.2
+
 common --incompatible_require_linker_input_cc_api
 
 # test environment does not propagate locales by default some tests reads files

.ci/bazel-3.7.2-darwin-x86_64.sha256

@@ -0,0 +1 @@
+80c82e93a12ba30021692b11c78007807e82383a673be1602573b944beb359ab  bazel-3.7.2-darwin-x86_64

.ci/bazel-3.7.2-linux-x86_64.sha256

@@ -0,0 +1 @@
+70dc0bee198a4c3d332925a32d464d9036a831977501f66d4996854ad4e4fc0d  bazel-3.7.2-linux-x86_64

.ci/bazel-3.7.2-windows-x86_64.exe.sha256

@@ -0,0 +1 @@
+ecb696b1b9c9da6728d92fbfe8410bafb4b3a65c358980e49742233f33f74d10  bazel-3.7.2-windows-x86_64.exe

.ci/bazelversion

@@ -1 +1 @@
-3.3.1
+3.7.2

.github/workflows/workflow.yaml

@@ -23,6 +23,8 @@ jobs:
         with:
           nix_path: nixpkgs=./nixpkgs/default.nix
       - name: Configure
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         run: |
           case ${{ matrix.os }} in
             macos) BUILD_CONFIG=macos-nixpkgs;;
@@ -31,6 +33,11 @@ jobs:
           cat >.bazelrc.local <<EOF
           common --config=ci
           build --config=$BUILD_CONFIG
+          build --remote_header=x-buildbuddy-api-key="$BUILDBUDDY_API_KEY"
+          EOF
+          cat >~/.netrc <<EOF
+          machine api.github.com
+                  password ${{ secrets.GITHUB_TOKEN }}
           EOF
       - name: Check Bazel version
         run: |
@@ -66,6 +73,8 @@ jobs:
           BAZEL_DIR="$(.ci/fetch-bazel-bindist)"
           mv $BAZEL_DIR $HOME/bazel
       - name: Configure
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         run: |
           case ${{ matrix.os }} in
             macos) BUILD_CONFIG=macos-bindist;;
@@ -74,6 +83,11 @@ jobs:
           cat >.bazelrc.local <<EOF
           common --config=ci
           build --config=$BUILD_CONFIG
+          build --remote_header=x-buildbuddy-api-key="$BUILDBUDDY_API_KEY"
+          EOF
+          cat >~/.netrc <<EOF
+          machine api.github.com
+                  password ${{ secrets.GITHUB_TOKEN }}
           EOF
       - name: Build & test
         run: |

WORKSPACE

@@ -139,12 +139,9 @@ load(
 
 http_archive(
     name = "rules_proto",
-    sha256 = "73ebe9d15ba42401c785f9d0aeebccd73bd80bf6b8ac78f74996d31f2c0ad7a6",
-    strip_prefix = "rules_proto-2c0468366367d7ed97a1f702f9cd7155ab3f73c5",
-    urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_proto/archive/2c0468366367d7ed97a1f702f9cd7155ab3f73c5.tar.gz",
-        "https://github.com/bazelbuild/rules_proto/archive/2c0468366367d7ed97a1f702f9cd7155ab3f73c5.tar.gz",
-    ],
+    sha256 = "9fc210a34f0f9e7cc31598d109b5d069ef44911a82f507d5a88716db171615a8",
+    strip_prefix = "rules_proto-f7a30f6f80006b591fa7c437fe5a951eb10bcbcf",
+    urls = ["https://github.com/bazelbuild/rules_proto/archive/f7a30f6f80006b591fa7c437fe5a951eb10bcbcf.tar.gz"],
 )
 
 load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
@@ -403,10 +400,8 @@ nixpkgs_package(
 
 http_archive(
     name = "build_bazel_rules_nodejs",
-    sha256 = "84abf7ac4234a70924628baa9a73a5a5cbad944c4358cf9abdb4aab29c9a5b77",
-    urls = [
-        "https://github.com/bazelbuild/rules_nodejs/releases/download/1.7.0/rules_nodejs-1.7.0.tar.gz",
-    ],
+    sha256 = "dd4dc46066e2ce034cba0c81aa3e862b27e8e8d95871f567359f7a534cccb666",
+    urls = ["https://github.com/bazelbuild/rules_nodejs/releases/download/3.1.0/rules_nodejs-3.1.0.tar.gz"],
 )
 
 load("@build_bazel_rules_nodejs//:index.bzl", "node_repositories")
@@ -417,12 +412,9 @@ node_repositories(
 
 http_archive(
     name = "io_bazel_rules_sass",
-    sha256 = "d5e0c0d16fb52f3dcce5bd7830d92d4813eb01bac0211119e74ec9e65eaf3b86",
-    strip_prefix = "rules_sass-1.23.3",
-    urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_sass/archive/1.23.3.tar.gz",
-        "https://github.com/bazelbuild/rules_sass/archive/1.23.3.tar.gz",
-    ],
+    sha256 = "6e547fe6fe0ac66f464dd06c8903fc82f77826f40e3fe869b41886bef582c2fe",
+    strip_prefix = "rules_sass-1.32.6",
+    urls = ["https://github.com/bazelbuild/rules_sass/archive/1.32.6.tar.gz"],
 )
 
 load("@io_bazel_rules_sass//:package.bzl", "rules_sass_dependencies")
@@ -467,21 +459,18 @@ register_toolchains(
 
 http_archive(
     name = "io_bazel_rules_go",
-    sha256 = "d1ffd055969c8f8d431e2d439813e42326961d0942bdf734d2c95dc30c369566",
+    sha256 = "4d838e2d70b955ef9dd0d0648f673141df1bc1d7ecf5c2d621dcc163f47dd38a",
     urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.24.5/rules_go-v0.24.5.tar.gz",
-        "https://github.com/bazelbuild/rules_go/releases/download/v0.24.5/rules_go-v0.24.5.tar.gz",
+        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.24.12/rules_go-v0.24.12.tar.gz",
+        "https://github.com/bazelbuild/rules_go/releases/download/v0.24.12/rules_go-v0.24.12.tar.gz",
     ],
 )
 
 http_archive(
     name = "com_github_bazelbuild_buildtools",
-    sha256 = "a02ba93b96a8151b5d8d3466580f6c1f7e77212c4eb181cba53eb2cae7752a23",
-    strip_prefix = "buildtools-3.5.0",
-    urls = [
-        "https://mirror.bazel.build/github.com/bazelbuild/buildtools/archive/3.5.0.tar.gz",
-        "https://github.com/bazelbuild/buildtools/archive/3.5.0.tar.gz",
-    ],
+    sha256 = "0d3ca4ed434958dda241fb129f77bd5ef0ce246250feed2d5a5470c6f29a77fa",
+    strip_prefix = "buildtools-4.0.0",
+    urls = ["https://github.com/bazelbuild/buildtools/archive/4.0.0.tar.gz"],
 )
 
 # A repository that generates the Go SDK imports, see ./tools/go_sdk/README

haskell/cabal.bzl

@@ -2,7 +2,7 @@
 
 load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load("@bazel_skylib//lib:paths.bzl", "paths")
-load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe", "read_netrc", "use_netrc")
 load("//vendor/bazel_json/lib:json_parser.bzl", "json_parse")
 load("@bazel_tools//tools/cpp:lib_cc_configure.bzl", "get_cpu_value")
 load("@bazel_tools//tools/cpp:toolchain_utils.bzl", "find_cpp_toolchain")
@@ -42,6 +42,37 @@ load(
     "haskell_cc_libraries_aspect",
 )
 
+def _get_auth(ctx, urls):
+    """Find the .netrc file and obtain the auth dict for the required URLs.
+
+    Refer to the [authentication in downloads proposal][auth-proposal] and the
+    [`http_archive` API documentation][http-archive] for a definition of the
+    auth dict.
+
+    [auth-proposal]: https://github.com/bazelbuild/proposals/blob/master/designs/2019-05-27-auth.md
+    [http-archive]: https://docs.bazel.build/versions/master/repo/http.html#http_archive-auth_patterns
+    """
+    auth_patterns = {"api.github.com": "Bearer <password>"}
+
+    # Taken from @bazel_tools//tools/build_defs/repo:http.bzl
+    if ctx.attr.netrc:
+        netrc = read_netrc(ctx, ctx.attr.netrc)
+        return use_netrc(netrc, urls, auth_patterns)
+
+    if "HOME" in ctx.os.environ and not ctx.os.name.startswith("windows"):
+        netrcfile = "%s/.netrc" % (ctx.os.environ["HOME"])
+        if ctx.execute(["test", "-f", netrcfile]).return_code == 0:
+            netrc = read_netrc(ctx, netrcfile)
+            return use_netrc(netrc, urls, auth_patterns)
+
+    if "USERPROFILE" in ctx.os.environ and ctx.os.name.startswith("windows"):
+        netrcfile = "%s/.netrc" % (ctx.os.environ["USERPROFILE"])
+        if ctx.path(netrcfile).exists:
+            netrc = read_netrc(ctx, netrcfile)
+            return use_netrc(netrc, urls, auth_patterns)
+
+    return {}
+
 def _so_extension(hs):
     return "dylib" if hs.toolchain.is_darwin else "so"
 
@@ -1237,10 +1268,13 @@ def _pin_packages(repository_ctx, resolved):
     errmsg = "Unexpected format in {context}: {{error}}"
 
     # Determine current git revision of all-cabal-hashes.
+    hashes_url = "https://api.github.com/repos/commercialhaskell/all-cabal-hashes/git/ref/heads/hackage"
+    auth = _get_auth(repository_ctx, [hashes_url])
     repository_ctx.download(
-        "https://api.github.com/repos/commercialhaskell/all-cabal-hashes/git/ref/heads/hackage",
+        hashes_url,
         output = "all-cabal-hashes-hackage.json",
         executable = False,
+        auth = auth,
     )
     hashes_json = json_parse(repository_ctx.read("all-cabal-hashes-hackage.json"))
     hashes_object = _parse_json_field(
@@ -1966,6 +2000,7 @@ _stack_snapshot_unpinned = repository_rule(
         "flags": attr.string_list_dict(),
         "stack": attr.label(),
         "stack_update": attr.label(),
+        "netrc": attr.string(),
     },
 )
 
@@ -2128,6 +2163,7 @@ def stack_snapshot(
         components = {},
         stack_update = None,
         verbose = False,
+        netrc = "",
         **kwargs):
     """Use Stack to download and extract Cabal source distributions.
 
@@ -2285,6 +2321,8 @@ def stack_snapshot(
       verbose: Whether to show the output of the build.
       stack_update: A meta repository that is used to avoid multiple concurrent invocations of
         `stack update` which could fail due to a race on the hackage security lock.
+      netrc: Location of the .netrc file to use for authentication.
+        Defaults to `~/.netrc` if present.
     """
     typecheck_stackage_extradeps(extra_deps)
     if not stack:
@@ -2311,6 +2349,7 @@ def stack_snapshot(
         stack_snapshot_json = stack_snapshot_json,
         packages = packages,
         flags = flags,
+        netrc = netrc,
     )
     _stack_snapshot(
         name = name,

haskell/private/versions.bzl

@@ -45,7 +45,7 @@ def check_version(actual_version):
     # Please use length 3 tuples, because bazel versions has 3 members;
     # to avoid surprising behaviors (for example (2,0) >/= (2, 0, 0))
     min_bazel = (2, 1, 0)  # Change THIS LINE when changing bazel min version
-    max_bazel = (3, 3, 1)  # Change THIS LINE when changing bazel max version
+    max_bazel = (3, 7, 2)  # Change THIS LINE when changing bazel max version
 
     actual = tuple(_parse_bazel_version(actual_version))
 

haskell/repositories.bzl

@@ -1,71 +1,74 @@
 """Workspace rules (repositories)"""
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+load("@bazel_tools//tools/build_defs/repo:utils.bzl", "maybe")
 load(":private/versions.bzl", "check_version")
 
 def rules_haskell_dependencies():
     """Provide all repositories that are necessary for `rules_haskell` to function."""
-    excludes = native.existing_rules().keys()
     if "bazel_version" in dir(native):
         check_version(native.bazel_version)
 
-    if "platforms" not in excludes:
-        http_archive(
-            name = "platforms",
-            sha256 = "23566db029006fe23d8140d14514ada8c742d82b51973b4d331ee423c75a0bfa",
-            strip_prefix = "platforms-46993efdd33b73649796c5fc5c9efb193ae19d51",
-            urls = ["https://github.com/bazelbuild/platforms/archive/46993efdd33b73649796c5fc5c9efb193ae19d51.tar.gz"],
-        )
+    maybe(
+        http_archive,
+        name = "platforms",
+        urls = [
+            "https://mirror.bazel.build/github.com/bazelbuild/platforms/releases/download/0.0.3/platforms-0.0.3.tar.gz",
+            "https://github.com/bazelbuild/platforms/releases/download/0.0.3/platforms-0.0.3.tar.gz",
+        ],
+        sha256 = "460caee0fa583b908c622913334ec3c1b842572b9c23cf0d3da0c2543a1a157d",
+    )
 
-    if "bazel_skylib" not in excludes:
-        http_archive(
-            name = "bazel_skylib",
-            sha256 = "e5d90f0ec952883d56747b7604e2a15ee36e288bb556c3d0ed33e818a4d971f2",
-            strip_prefix = "bazel-skylib-1.0.2",
-            urls = ["https://github.com/bazelbuild/bazel-skylib/archive/1.0.2.tar.gz"],
-        )
+    maybe(
+        http_archive,
+        name = "bazel_skylib",
+        urls = [
+            "https://github.com/bazelbuild/bazel-skylib/releases/download/1.0.3/bazel-skylib-1.0.3.tar.gz",
+            "https://mirror.bazel.build/github.com/bazelbuild/bazel-skylib/releases/download/1.0.3/bazel-skylib-1.0.3.tar.gz",
+        ],
+        sha256 = "1c531376ac7e5a180e0237938a2536de0c54d93f5c278634818e0efc952dd56c",
+    )
 
-    if "rules_cc" not in excludes:
-        http_archive(
-            name = "rules_cc",
-            sha256 = "dafda2ff2a913028ce1718253b6b2f353b2d2163470f3069ca810a0d8d55a5a9",
-            strip_prefix = "rules_cc-cd7e8a690caf526e0634e3ca55b10308ee23182d",
-            urls = ["https://github.com/bazelbuild/rules_cc/archive/cd7e8a690caf526e0634e3ca55b10308ee23182d.tar.gz"],
-        )
+    maybe(
+        http_archive,
+        name = "rules_cc",
+        sha256 = "cb8ce8a25464b2a8536450971ad1b45ee309491c1f5e052a611b9e249cfdd35d",
+        strip_prefix = "rules_cc-40548a2974f1aea06215272d9c2b47a14a24e556",
+        urls = ["https://github.com/bazelbuild/rules_cc/archive/40548a2974f1aea06215272d9c2b47a14a24e556.tar.gz"],
+    )
 
-    if "rules_python" not in excludes:
-        http_archive(
-            name = "rules_python",
-            sha256 = "fa53cc0afe276d8f6675df1a424592e00e4f37b2a497e48399123233902e2e76",
-            strip_prefix = "rules_python-0.0.1",
-            urls = ["https://github.com/bazelbuild/rules_python/archive/0.0.1.tar.gz"],
-        )
+    maybe(
+        http_archive,
+        name = "rules_python",
+        url = "https://github.com/bazelbuild/rules_python/releases/download/0.1.0/rules_python-0.1.0.tar.gz",
+        sha256 = "b6d46438523a3ec0f3cead544190ee13223a52f6a6765a29eae7b7cc24cc83a0",
+    )
 
-    if "rules_sh" not in excludes:
-        http_archive(
-            name = "rules_sh",
-            sha256 = "83a065ba6469135a35786eb741e17d50f360ca92ab2897857475ab17c0d29931",
-            strip_prefix = "rules_sh-0.2.0",
-            urls = ["https://github.com/tweag/rules_sh/archive/v0.2.0.tar.gz"],
-        )
+    maybe(
+        http_archive,
+        name = "rules_sh",
+        sha256 = "83a065ba6469135a35786eb741e17d50f360ca92ab2897857475ab17c0d29931",
+        strip_prefix = "rules_sh-0.2.0",
+        urls = ["https://github.com/tweag/rules_sh/archive/v0.2.0.tar.gz"],
+    )
 
-    if "io_tweag_rules_nixpkgs" not in excludes:
-        http_archive(
-            name = "io_tweag_rules_nixpkgs",
-            sha256 = "5c80f5ed7b399a857dd04aa81e66efcb012906b268ce607aaf491d8d71f456c8",
-            strip_prefix = "rules_nixpkgs-0.7.0",
-            urls = ["https://github.com/tweag/rules_nixpkgs/archive/v0.7.0.tar.gz"],
-        )
+    maybe(
+        http_archive,
+        name = "io_tweag_rules_nixpkgs",
+        sha256 = "5c80f5ed7b399a857dd04aa81e66efcb012906b268ce607aaf491d8d71f456c8",
+        strip_prefix = "rules_nixpkgs-0.7.0",
+        urls = ["https://github.com/tweag/rules_nixpkgs/archive/v0.7.0.tar.gz"],
+    )
 
-    if "com_google_protobuf" not in excludes:
-        http_archive(
-            name = "com_google_protobuf",
-            sha256 = "e8c7601439dbd4489fe5069c33d374804990a56c2f710e00227ee5d8fd650e67",
-            strip_prefix = "protobuf-3.11.2",
-            urls = [
-                "https://github.com/google/protobuf/archive/v3.11.2.tar.gz",
-            ],
-        )
+    maybe(
+        http_archive,
+        name = "com_google_protobuf",
+        sha256 = "d0f5f605d0d656007ce6c8b5a82df3037e1d8fe8b121ed42e536f569dec16113",
+        strip_prefix = "protobuf-3.14.0",
+        urls = [
+            "https://github.com/google/protobuf/archive/v3.14.0.tar.gz",
+        ],
+    )
 
     # Dependency of com_google_protobuf.
     # TODO(judahjacobson): this is a bit of a hack.
@@ -78,14 +81,14 @@ def rules_haskell_dependencies():
     # Alternately, consider adding another function from another
     # .bzl file that needs to be called from WORKSPACE, similar to:
     # https://github.com/grpc/grpc/blob/8c9dcf7c35e489c2072a9ad86635dbc4e28f88ea/bazel/grpc_extra_deps.bzl#L10
-    if "zlib" not in excludes:
-        http_archive(
-            name = "zlib",
-            build_file = "@com_google_protobuf//:third_party/zlib.BUILD",
-            sha256 = "629380c90a77b964d896ed37163f5c3a34f6e6d897311f1df2a7016355c45eff",
-            strip_prefix = "zlib-1.2.11",
-            urls = ["https://github.com/madler/zlib/archive/v1.2.11.tar.gz"],
-        )
+    maybe(
+        http_archive,
+        name = "zlib",
+        build_file = "@com_google_protobuf//:third_party/zlib.BUILD",
+        sha256 = "629380c90a77b964d896ed37163f5c3a34f6e6d897311f1df2a7016355c45eff",
+        strip_prefix = "zlib-1.2.11",
+        urls = ["https://github.com/madler/zlib/archive/v1.2.11.tar.gz"],
+    )
 
 def haskell_repositories():
     """Alias for rules_haskell_dependencies