bazel_7: init at 7.0.0-pre.20230917.3

pkgs/development/tools/build-managers/bazel/bash-tools-test.nix

···
-{ writeText, bazel, runLocal, bazelTest, distDir }:
+{ lib, writeText, bazel, runLocal, bazelTest, distDir, extraBazelArgs ? ""}:
 
 # Tests that certain executables are available in bazel-executed bash shells.
 
···
     inherit workspaceDir;
 
     bazelScript = ''
-      ${bazel}/bin/bazel build :tool_usage --distdir=${distDir}
+      ${bazel}/bin/bazel build :tool_usage --distdir=${distDir} ${extraBazelArgs}
       cp bazel-bin/output.txt $out
       echo "Testing content" && [ "$(cat $out | wc -l)" == "2" ] && echo "OK"
     '';

pkgs/development/tools/build-managers/bazel/bazel_7/actions_path.patch

···
+commit 595756621dd858cf18033af2c4707d2fe8548350
+Author: Guillaume Maudoux <[e-mail]>
+Date:   Fri Oct 6 15:09:56 2023 +0200
+
+    actions_path.patch
+
 diff --git a/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java b/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
-index 6fff2af..7e2877e 100644
+index 8284eff943..a820037968 100644
 --- a/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
 +++ b/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
 @@ -47,6 +47,16 @@ public final class PosixLocalEnvProvider implements LocalEnvProvider {
···
      String p = clientEnv.get("TMPDIR");
      if (Strings.isNullOrEmpty(p)) {
        // Do not use `fallbackTmpDir`, use `/tmp` instead. This way if the user didn't export TMPDIR
-index 95642767c6..39d3c62461 100644
+diff --git a/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java b/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
+index 8f230b1b1d..2e4c7d26b7 100644
 --- a/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
 +++ b/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
-@@ -74,6 +74,16 @@ public final class XcodeLocalEnvProvider implements LocalEnvProvider {
-
+@@ -75,6 +75,16 @@ public final class XcodeLocalEnvProvider implements LocalEnvProvider {
+ 
      ImmutableMap.Builder<String, String> newEnvBuilder = ImmutableMap.builder();
      newEnvBuilder.putAll(Maps.filterKeys(env, k -> !k.equals("TMPDIR")));
 +

pkgs/development/tools/build-managers/bazel/bazel_7/bazel-repository-cache.nix

···
+{ lib
+, nix
+, runCommand
+, fetchurl
+  # The path to the right MODULE.bazel.lock
+, lockfile
+  # The path to a json file containing the list of hashes we should prefetch
+, requiredDeps ? null
+, extraInputs ? [ ]
+}:
+let
+  modules = builtins.fromJSON (builtins.readFile lockfile);
+
+  # a foldl' for json values
+  foldlJSON = op: acc: value:
+    let
+      # preorder, visit the current node first
+      acc' = op acc value;
+
+      # then visit child values, ignoring attribute names
+      children =
+        if builtins.isList value then
+          lib.foldl' (foldlJSON op) acc' value
+        else if builtins.isAttrs value then
+          lib.foldlAttrs (_acc: _name: foldlJSON op _acc) acc' value
+        else
+          acc';
+    in
+    # like foldl', force evaluation of intermediate results
+    builtins.seq acc' children;
+
+  extract_source = acc: value:
+    # We take any "attributes" object that has a "sha256" field. Every value
+    # under "attributes" is assumed to be an object, and all the "attributes"
+    # with a "sha256" field are assumed to have either a "urls" or "url" field.
+    #
+    # We add them to the `acc`umulator:
+    #
+    #    acc // {
+    #      "ffad2b06ef2e09d040...fc8e33706bb01634" = fetchurl {
+    #        name = "source";
+    #        sha256 = "ffad2b06ef2e09d040...fc8e33706bb01634";
+    #        urls = [
+    #          "https://mirror.bazel.build/github.com/golang/library.zip",
+    #          "https://github.com/golang/library.zip"
+    #        ];
+    #      };
+    #    }
+    let
+      # remove the "--" prefix, abusing undocumented negative substring length
+      sanitize = builtins.substring 2 (-1);
+      attrs = value.attributes;
+      entry = hash: urls: {
+        ${hash} = fetchurl {
+          name = "source"; # just like fetch*, to get some deduplication
+          inherit urls;
+          sha256 = hash;
+          passthru.sha256 = hash;
+        };
+      };
+      insert = acc: hash: urls: acc // entry (sanitize hash) (map sanitize urls);
+    in
+    if builtins.isAttrs value && value ? attributes
+      && (attrs ? sha256 || attrs ? integrity)
+    then
+    #builtins.trace attrs
+      (
+        insert
+          acc
+          (attrs.integrity or attrs.sha256)
+          (attrs.urls or [ attrs.url ])
+      )
+    else if builtins.isAttrs value && value ? remote_patches
+      && builtins.isAttrs value.remote_patches
+    then
+    #builtins.trace value.remote_patches
+      (
+        lib.foldlAttrs
+          (acc: url: hash: insert acc hash [ url ])
+          acc
+          value.remote_patches
+      )
+    else acc;
+
+  inputs = foldlJSON extract_source { } modules;
+
+  requiredHashes = builtins.fromJSON (builtins.readFile requiredDeps);
+  requiredAttrs = lib.genAttrs requiredHashes throw;
+
+  requiredInputs =
+    if requiredDeps == null
+    then inputs
+    else builtins.intersectAttrs requiredAttrs (builtins.trace inputs inputs);
+
+  command = ''
+    mkdir -p $out/content_addressable/sha256
+    cd $out/content_addressable/sha256
+  '' + lib.concatMapStrings
+    # TODO: Do not re-hash. Use nix-hash to convert hashes
+    (drv: ''
+      filename=$(basename "${lib.head drv.urls}")
+      echo Caching $filename
+      hash=$(${nix}/bin/nix-hash --type sha256 --to-base16 ${drv.sha256})
+      mkdir -p $hash
+      ln -sfn ${drv} $hash/file
+      ln -sfn ${drv} $filename
+    '')
+    (builtins.attrValues requiredInputs ++ extraInputs)
+  ;
+
+  repository_cache = runCommand "bazel-repository-cache" { } command;
+
+in
+repository_cache

pkgs/development/tools/build-managers/bazel/bazel_7/darwin_sleep.patch

···
+diff --git a/src/main/native/darwin/sleep_prevention_jni.cc b/src/main/native/darwin/sleep_prevention_jni.cc
+index 67c35b201e..e50a58320e 100644
+--- a/src/main/native/darwin/sleep_prevention_jni.cc
++++ b/src/main/native/darwin/sleep_prevention_jni.cc
+@@ -33,31 +33,13 @@ static int g_sleep_state_stack = 0;
+ static IOPMAssertionID g_sleep_state_assertion = kIOPMNullAssertionID;
+ 
+ int portable_push_disable_sleep() {
+-  std::lock_guard<std::mutex> lock(g_sleep_state_mutex);
+-  BAZEL_CHECK_GE(g_sleep_state_stack, 0);
+-  if (g_sleep_state_stack == 0) {
+-    BAZEL_CHECK_EQ(g_sleep_state_assertion, kIOPMNullAssertionID);
+-    CFStringRef reasonForActivity = CFSTR("build.bazel");
+-    IOReturn success = IOPMAssertionCreateWithName(
+-        kIOPMAssertionTypeNoIdleSleep, kIOPMAssertionLevelOn, reasonForActivity,
+-        &g_sleep_state_assertion);
+-    BAZEL_CHECK_EQ(success, kIOReturnSuccess);
+-  }
+-  g_sleep_state_stack += 1;
+-  return 0;
++  // Unreliable, disable for now
++  return -1;
+ }
+ 
+ int portable_pop_disable_sleep() {
+-  std::lock_guard<std::mutex> lock(g_sleep_state_mutex);
+-  BAZEL_CHECK_GT(g_sleep_state_stack, 0);
+-  g_sleep_state_stack -= 1;
+-  if (g_sleep_state_stack == 0) {
+-    BAZEL_CHECK_NE(g_sleep_state_assertion, kIOPMNullAssertionID);
+-    IOReturn success = IOPMAssertionRelease(g_sleep_state_assertion);
+-    BAZEL_CHECK_EQ(success, kIOReturnSuccess);
+-    g_sleep_state_assertion = kIOPMNullAssertionID;
+-  }
+-  return 0;
++  // Unreliable, disable for now
++  return -1;
+ }
+ 
+ }  // namespace blaze_jni
+diff --git a/src/main/native/darwin/system_suspension_monitor_jni.cc b/src/main/native/darwin/system_suspension_monitor_jni.cc
+index 3483aa7935..51782986ec 100644
+--- a/src/main/native/darwin/system_suspension_monitor_jni.cc
++++ b/src/main/native/darwin/system_suspension_monitor_jni.cc
+@@ -83,10 +83,7 @@ void portable_start_suspend_monitoring() {
+     // Register to receive system sleep notifications.
+     // Testing needs to be done manually. Use the logging to verify
+     // that sleeps are being caught here.
+-    suspend_state.connect_port = IORegisterForSystemPower(
+-        &suspend_state, &notifyPortRef, SleepCallBack, &notifierObject);
+-    BAZEL_CHECK_NE(suspend_state.connect_port, MACH_PORT_NULL);
+-    IONotificationPortSetDispatchQueue(notifyPortRef, queue);
++    // XXX: Unreliable, disable for now
+ 
+     // Register to deal with SIGCONT.
+     // We register for SIGCONT because we can't catch SIGSTOP.

pkgs/development/tools/build-managers/bazel/bazel_7/default.nix

···
-{ stdenv, callPackage, lib, fetchurl, fetchpatch, fetchFromGitHub, installShellFiles
-, runCommand, runCommandCC, makeWrapper, recurseIntoAttrs
-# this package (through the fixpoint glass)
+{ stdenv
+, callPackage
+, lib
+, fetchurl
+, fetchpatch
+, fetchFromGitHub
+, installShellFiles
+, runCommand
+, runCommandCC
+, makeWrapper
+, recurseIntoAttrs
+  # this package (through the fixpoint glass)
 , bazel_self
-, lr, xe, zip, unzip, bash, writeCBin, coreutils
-, which, gawk, gnused, gnutar, gnugrep, gzip, findutils
-, diffutils, gnupatch
-# updater
-, python3, writeScript
-# Apple dependencies
-, cctools, libcxx, CoreFoundation, CoreServices, Foundation
-# Allow to independently override the jdks used to build and run respectively
-, buildJdk, runJdk
+, lr
+, xe
+, zip
+, unzip
+, bash
+, writeCBin
+, coreutils
+, which
+, gawk
+, gnused
+, gnutar
+, gnugrep
+, gzip
+, findutils
+, diffutils
+, gnupatch
+  # updater
+, python3
+, writeScript
+  # Apple dependencies
+, cctools
+, libcxx
+, CoreFoundation
+, CoreServices
+, Foundation
+, IOKit
+  # Allow to independently override the jdks used to build and run respectively
+, buildJdk
+, runJdk
 , runtimeShell
-# Downstream packages for tests
+  # Downstream packages for tests
 , bazel-watcher
-# Always assume all markers valid (this is needed because we remove markers; they are non-deterministic).
-# Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
+  # Always assume all markers valid (this is needed because we remove markers; they are non-deterministic).
+  # Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
 , enableNixHacks ? false
 , gcc-unwrapped
 , autoPatchelfHook
 , file
 , substituteAll
 , writeTextFile
+, writeText
+, darwin
+, jdk11_headless
+, jdk17_headless
+, openjdk8
+, ripgrep
+, sigtool
 }:
 
 let
-  version = "6.3.2";
+  version = "7.0.0-pre.20230917.3";
   sourceRoot = ".";
 
   src = fetchurl {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-jNf+rFgZO+K8ukUbpmiKRoJNN8pjWf9Y4NROuY8EKUg=";
+    hash = "sha256-sxITaivcJRrQrL+zZtdZohesNgmDtQysIG3BS8SFZd4=";
   };
 
-  # Update with
-  # 1. export BAZEL_SELF=$(nix-build -A bazel_6)
-  # 2. update version and hash for sources above
-  # 3. `eval $(nix-build -A bazel_6.updater)`
-  # 4. add new dependencies from the dict in ./src-deps.json if required by failing build
-  srcDeps = lib.attrsets.attrValues srcDepsSet;
-  srcDepsSet =
-    let
-      srcs = lib.importJSON ./src-deps.json;
-      toFetchurl = d: lib.attrsets.nameValuePair d.name (fetchurl {
-        urls = d.urls or [d.url];
-        sha256 = d.sha256;
-      });
-    in builtins.listToAttrs (map toFetchurl [
-      srcs.desugar_jdk_libs
-      srcs.io_bazel_skydoc
-      srcs.bazel_skylib
-      srcs.bazelci_rules
-      srcs.io_bazel_rules_sass
-      srcs.platforms
-      srcs.remote_java_tools_for_testing
-      srcs."coverage_output_generator-v2.6.zip"
-      srcs.build_bazel_rules_nodejs
-      srcs.android_tools_for_testing
-      srcs.openjdk_linux_vanilla
-      srcs.bazel_toolchains
-      srcs.com_github_grpc_grpc
-      srcs.upb
-      srcs.com_google_protobuf
-      srcs.rules_pkg
-      srcs.rules_cc
-      srcs.rules_java
-      srcs.rules_proto
-      srcs.rules_nodejs
-      srcs.rules_license
-      srcs.com_google_absl
-      srcs.com_googlesource_code_re2
-      srcs.com_github_cares_cares
-      srcs.com_envoyproxy_protoc_gen_validate
-      srcs.com_google_googleapis
-      srcs.bazel_gazelle
-    ]);
+  # Use builtins.fetchurl to avoid IFD, in particular on hydra
+  lockfile = builtins.fetchurl {
+    url = "https://raw.githubusercontent.com/bazelbuild/bazel/${version}/MODULE.bazel.lock";
+    sha256 = "0z6mlz8cn03qa40mqbw6j6kd6qyn4vgb3bb1kyidazgldxjhrz6y";
+  };
 
-  distDir = runCommand "bazel-deps" {} ''
-    mkdir -p $out
-    for i in ${builtins.toString srcDeps}; do cp $i $out/$(stripHash $i); done
-  '';
+  # Two-in-one format
+  distDir = repoCache;
+  repoCache = callPackage ./bazel-repository-cache.nix {
+    inherit lockfile;
+    # TODO: efficiently filter so that all tests find their dependencies
+    # without downloading 10 jdk versions
+    # requiredDeps = ./required-hashes.json;
+  };
 
   defaultShellUtils =
     # Keep this list conservative. For more exotic tools, prefer to use
···
 
   platforms = lib.platforms.linux ++ lib.platforms.darwin;
 
-  system = if stdenv.hostPlatform.isDarwin then "darwin" else "linux";
+  inherit (stdenv.hostPlatform) isDarwin isAarch64;
+
+  system = if isDarwin then "darwin" else "linux";
 
   # on aarch64 Darwin, `uname -m` returns "arm64"
   arch = with stdenv.hostPlatform; if isDarwin && isAarch64 then "arm64" else parsed.cpu.name;
···
   bazelRC = writeTextFile {
     name = "bazel-rc";
     text = ''
-      startup --server_javabase=${runJdk}
+      startup --server_javabase=${buildJdk}
 
-      # Can't use 'common'; https://github.com/bazelbuild/bazel/issues/3054
-      # Most commands inherit from 'build' anyway.
-      build --distdir=${distDir}
-      fetch --distdir=${distDir}
-      query --distdir=${distDir}
-
-      build --extra_toolchains=@bazel_tools//tools/jdk:nonprebuilt_toolchain_definition
-      build --tool_java_runtime_version=local_jdk_11
-      build --java_runtime_version=local_jdk_11
+      build --extra_toolchains=@local_jdk//:all
+      build --tool_java_runtime_version=local_jdk
+      build --java_runtime_version=local_jdk
+      build --repo_env=JAVA_HOME=${buildJdk}${if isDarwin then "/zulu-11.jdk/Contents/Home" else "/lib/openjdk"}
 
       # load default location for the system wide configuration
       try-import /etc/bazel.bazelrc
     '';
   };
 
+  bazelNixFlagsScript = writeScript "bazel-nix-flags" ''
+    cat << EOF
+    common --announce_rc
+    build --toolchain_resolution_debug=".*"
+    build --local_ram_resources=HOST_RAM*.5
+    build --local_cpu_resources=HOST_CPUS*.75
+    build --copt=$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ / --copt=/g')
+    build --host_copt=$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ / --host_copt=/g')
+    build --linkopt=$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ / --linkopt=/g')
+    build --host_linkopt=$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ / --host_linkopt=/g')
+    build --linkopt=-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ / --linkopt=-Wl,/g')
+    build --host_linkopt=-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ / --host_linkopt=-Wl,/g')
+    build --extra_toolchains=@bazel_tools//tools/jdk:nonprebuilt_toolchain_definition
+    build --verbose_failures
+    build --curses=no
+    build --features=-layering_check
+    build --experimental_strict_java_deps=off
+    build --strict_proto_deps=off
+    build --extra_toolchains=@bazel_tools//tools/jdk:nonprebuilt_toolchain_java11_definition
+    build --extra_toolchains=@local_jdk//:all
+    build --tool_java_runtime_version=local_jdk_11
+    build --java_runtime_version=local_jdk_11
+    build --repo_env=JAVA_HOME=${buildJdk}${if isDarwin then "/zulu-11.jdk/Contents/Home" else "/lib/openjdk"}
+    EOF
+  '';
 in
 stdenv.mkDerivation rec {
   pname = "bazel";
···
     description = "Build tool that builds code quickly and reliably";
     sourceProvenance = with sourceTypes; [
       fromSource
-      binaryBytecode  # source bundles dependencies as jars
+      binaryBytecode # source bundles dependencies as jars
     ];
     license = licenses.asl20;
     maintainers = lib.teams.bazel.members;
···
   inherit src;
   inherit sourceRoot;
   patches = [
-    # Force usage of the _non_ prebuilt java toolchain.
-    # the prebuilt one does not work in nix world.
-    ./java_toolchain.patch
+    # TODO: Make GSON work,
+    # In particular, our bazel build cannot emit MODULE.bazel.lock
+    # it only produces an empty json object `{ }`.
+    ./serialize_nulls.patch
+
+    ./darwin_sleep.patch
 
     # On Darwin, the last argument to gcc is coming up as an empty string. i.e: ''
     # This is breaking the build of any C target. This patch removes the last
     # argument if it's found to be an empty string.
     ../trim-last-argument-to-gcc-if-empty.patch
 
+    # XXX: This seems merged / not a real problem. See PR.
     # `java_proto_library` ignores `strict_proto_deps`
     # https://github.com/bazelbuild/bazel/pull/16146
-    ./strict_proto_deps.patch
+    # ./strict_proto_deps.patch
 
     # On Darwin, using clang 6 to build fails because of a linker error (see #105573),
     # but using clang 7 fails because libarclite_macosx.a cannot be found when linking
···
 
   # Additional tests that check bazel’s functionality. Execute
   #
-  #     nix-build . -A bazel_6.tests
+  #     nix-build . -A bazel_7.tests
   #
   # in the nixpkgs checkout root to exercise them locally.
   passthru.tests =
     let
       runLocal = name: attrs: script:
-      let
-        attrs' = removeAttrs attrs [ "buildInputs" ];
-        buildInputs = attrs.buildInputs or [];
-      in
-      runCommandCC name ({
-        inherit buildInputs;
-        preferLocalBuild = true;
-        meta.platforms = platforms;
-      } // attrs') script;
+        let
+          attrs' = removeAttrs attrs [ "buildInputs" ];
+          buildInputs = attrs.buildInputs or [ ];
+        in
+        runCommandCC name
+          ({
+            inherit buildInputs;
+            preferLocalBuild = true;
+            meta.platforms = platforms;
+          } // attrs')
+          script;
 
       # bazel wants to extract itself into $install_dir/install every time it runs,
       # so let’s do that only once.
       extracted = bazelPkg:
-        let install_dir =
-          # `install_base` field printed by `bazel info`, minus the hash.
-          # yes, this path is kinda magic. Sorry.
-          "$HOME/.cache/bazel/_bazel_nixbld";
-        in runLocal "bazel-extracted-homedir" { passthru.install_dir = install_dir; } ''
-            export HOME=$(mktemp -d)
-            touch WORKSPACE # yeah, everything sucks
-            install_base="$(${bazelPkg}/bin/bazel info | grep install_base)"
-            # assert it’s actually below install_dir
-            [[ "$install_base" =~ ${install_dir} ]] \
-              || (echo "oh no! $install_base but we are \
-            trying to copy ${install_dir} to $out instead!"; exit 1)
-            cp -R ${install_dir} $out
-          '';
+        let
+          install_dir =
+            # `install_base` field printed by `bazel info`, minus the hash.
+            # yes, this path is kinda magic. Sorry.
+            "$HOME/.cache/bazel/_bazel_nixbld";
+        in
+        runLocal "bazel-extracted-homedir" { passthru.install_dir = install_dir; } ''
+          export HOME=$(mktemp -d)
+          touch WORKSPACE # yeah, everything sucks
+          install_base="$(${bazelPkg}/bin/bazel info install_base)"
+          # assert it’s actually below install_dir
+          [[ "$install_base" =~ ${install_dir} ]] \
+            || (echo "oh no! $install_base but we are \
+          trying to copy ${install_dir} to $out instead!"; exit 1)
+          cp -R ${install_dir} $out
+        '';
 
-      bazelTest = { name, bazelScript, workspaceDir, bazelPkg, buildInputs ? [] }:
+      bazelTest = { name, bazelScript, workspaceDir, bazelPkg, buildInputs ? [ ] }:
         let
           be = extracted bazelPkg;
-        in runLocal name { inherit buildInputs; } (
-          # skip extraction caching on Darwin, because nobody knows how Darwin works
-          (lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-            # set up home with pre-unpacked bazel
+        in
+        runLocal name
+          {
+            inherit buildInputs;
+            # Necessary for the tests to pass on Darwin with sandbox enabled.
+            __darwinAllowLocalNetworking = true;
+          }
+          ''
+            # Bazel needs a real home for self-extraction and internal cache
             export HOME=$(mktemp -d)
-            mkdir -p ${be.install_dir}
-            cp -R ${be}/install ${be.install_dir}
+            export USER=$(basename $HOME)
 
-            # https://stackoverflow.com/questions/47775668/bazel-how-to-skip-corrupt-installation-on-centos6
-            # Bazel checks whether the mtime of the install dir files
-            # is >9 years in the future, otherwise it extracts itself again.
-            # see PosixFileMTime::IsUntampered in src/main/cpp/util
-            # What the hell bazel.
-            ${lr}/bin/lr -0 -U ${be.install_dir} | ${xe}/bin/xe -N0 -0 touch --date="9 years 6 months" {}
-          '')
-          +
-          ''
-            # Note https://github.com/bazelbuild/bazel/issues/5763#issuecomment-456374609
-            # about why to create a subdir for the workspace.
-            cp -r ${workspaceDir} wd && chmod u+w wd && cd wd
+            ${# Concurrent bazel invocations have the same workspace path.
+              # On darwin, for some reason, it means they accessing and corrupting the same execroot.
+              # Having a different workspace path ensures we use different execroots.
+              lib.optionalString isDarwin ''
+                # cd $(mktemp --tmpdir=. -d)
+              ''
+            }
+            ${# Speed-up tests by caching bazel extraction.
+              # Except on Darwin, because nobody knows how Darwin works.
+              lib.optionalString (!isDarwin) ''
+                mkdir -p ${be.install_dir}
+                cp -R ${be}/install ${be.install_dir}
 
-            ${bazelScript}
+                # https://stackoverflow.com/questions/47775668/bazel-how-to-skip-corrupt-installation-on-centos6
+                # Bazel checks whether the mtime of the install dir files
+                # is >9 years in the future, otherwise it extracts itself again.
+                # see PosixFileMTime::IsUntampered in src/main/cpp/util
+                # What the hell bazel.
+                ${lr}/bin/lr -0 -U ${be.install_dir} | ${xe}/bin/xe -N0 -0 touch --date="9 years 6 months" {}
+              ''
+            }
+            ${# Note https://github.com/bazelbuild/bazel/issues/5763#issuecomment-456374609
+              # about why to create a subdir for the workspace.
+              '' cp -r ${workspaceDir} wd && chmod u+w wd && cd wd ''
+            }
+            ${# run the actual test snippet
+              bazelScript
+            }
+            ${# Try to keep darwin clean of our garbage
+              lib.optionalString isDarwin ''
+                rm -rf $HOME || true
+              ''
+            }
 
             touch $out
-          '');
-
-      bazelWithNixHacks = bazel_self.override { enableNixHacks = true; };
+          '';
 
       bazel-examples = fetchFromGitHub {
         owner = "bazelbuild";
         repo = "examples";
-        rev = "4183fc709c26a00366665e2d60d70521dc0b405d";
-        sha256 = "1mm4awx6sa0myiz9j4hwp71rpr7yh8vihf3zm15n2ii6xb82r31k";
+        rev = "93564e1f1e7a3c39d6a94acee12b8d7b74de3491";
+        hash = "sha256-DaPKp7Sn5uvfZRjdDx6grot3g3B7trqCyL0TRIdwg98=";
       };
 
-    in (lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      callBazelTest = lib.callPackageWith {
+        inherit runLocal bazelTest bazel-examples lib writeText darwin runtimeShell stdenv writeScript jdk11_headless openjdk8 fetchFromGitHub fetchurl ripgrep unzip jdk17_headless Foundation;
+        inherit distDir;
+        extraBazelArgs = ''
+          --repository_cache=${repoCache} \
+          --repo_env=JAVA_HOME=${runJdk}${if isDarwin then "/zulu-17.jdk/Contents/Home" else "/lib/openjdk"} \
+        '';
+        bazel = bazel_self;
+      };
+
+      bazelWithNixHacks = bazel_self.override { enableNixHacks = true; };
+
+    in
+    (lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
       # `extracted` doesn’t work on darwin
-      shebang = callPackage ../shebang-test.nix { inherit runLocal extracted bazelTest distDir; bazel = bazel_self;};
+      shebang = callBazelTest ../shebang-test.nix { inherit extracted; };
     }) // {
-      bashTools = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self;};
-      cpp = callPackage ../cpp-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazel_self;};
-      java = callPackage ../java-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazel_self;};
-      protobuf = callPackage ../protobuf-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self; };
-      pythonBinPath = callPackage ../python-bin-path-test.nix { inherit runLocal bazelTest distDir; bazel = bazel_self;};
+      bashTools = callBazelTest ../bash-tools-test.nix { };
+      cpp = callBazelTest ../cpp-test.nix { };
+      java = callBazelTest ../java-test.nix { };
+      # TODO: protobuf tests just fail for now.
+      #protobuf = callBazelTest ../protobuf-test.nix { };
+      pythonBinPath = callBazelTest ../python-bin-path-test.nix { };
 
-      bashToolsWithNixHacks = callPackage ../bash-tools-test.nix { inherit runLocal bazelTest distDir; bazel = bazelWithNixHacks; };
+      bashToolsWithNixHacks = callBazelTest ../bash-tools-test.nix { bazel = bazelWithNixHacks; };
 
-      cppWithNixHacks = callPackage ../cpp-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazelWithNixHacks; };
-      javaWithNixHacks = callPackage ../java-test.nix { inherit runLocal bazelTest bazel-examples distDir; bazel = bazelWithNixHacks; };
-      protobufWithNixHacks = callPackage ../protobuf-test.nix { inherit runLocal bazelTest distDir; bazel = bazelWithNixHacks; };
-      pythonBinPathWithNixHacks = callPackage ../python-bin-path-test.nix { inherit runLocal bazelTest distDir; bazel = bazelWithNixHacks; };
+      cppWithNixHacks = callBazelTest ../cpp-test.nix { bazel = bazelWithNixHacks; };
+      javaWithNixHacks = callBazelTest ../java-test.nix { bazel = bazelWithNixHacks; };
+      #protobufWithNixHacks = callBazelTest ../protobuf-test.nix { bazel = bazelWithNixHacks; };
+      pythonBinPathWithNixHacks = callBazelTest ../python-bin-path-test.nix { bazel = bazelWithNixHacks; };
 
       # downstream packages using buildBazelPackage
       # fixed-output hashes of the fetch phase need to be spot-checked manually
-      downstream = recurseIntoAttrs ({
-        inherit bazel-watcher;
-      });
+      # TODO
+      #downstream = recurseIntoAttrs ({
+      #  inherit bazel-watcher;
+      #});
     };
 
   src_for_updater = stdenv.mkDerivation rec {
···
       runHook postInstall
     '';
   };
-  # update the list of workspace dependencies
-  passthru.updater = writeScript "update-bazel-deps.sh" ''
-    #!${runtimeShell}
-    (cd "${src_for_updater}" &&
-        BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
-        "$BAZEL_SELF"/bin/bazel \
-            query 'kind(http_archive, //external:*) + kind(http_file, //external:*) + kind(distdir_tar, //external:*) + kind(git_repository, //external:*)' \
-            --loading_phase_threads=1 \
-            --output build) \
-    | "${python3}"/bin/python3 "${./update-srcDeps.py}" \
-      "${builtins.toString ./src-deps.json}"
-  '';
 
-  # Necessary for the tests to pass on Darwin with sandbox enabled.
   # Bazel starts a local server and needs to bind a local address.
   __darwinAllowLocalNetworking = true;
+  # XXX: For IORegisterForSystemPower
+  # propagatedSandboxProfile = ''
+  #   (allow iokit-open (iokit-user-client-class "RootDomainUserClient"))
+  # '';
 
-  postPatch = let
+  postPatch =
+    let
 
-    darwinPatches = ''
-      bazelLinkFlags () {
-        eval set -- "$NIX_LDFLAGS"
-        local flag
-        for flag in "$@"; do
-          printf ' -Wl,%s' "$flag"
-        done
-      }
+      darwinPatches = ''
+        bazelLinkFlags () {
+          eval set -- "$NIX_LDFLAGS"
+          local flag
+          for flag in "$@"; do
+            printf ' -Wl,%s' "$flag"
+          done
+        }
 
-      # Disable Bazel's Xcode toolchain detection which would configure compilers
-      # and linkers from Xcode instead of from PATH
-      export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
+        # Disable Bazel's Xcode toolchain detection which would configure compilers
+        # and linkers from Xcode instead of from PATH
+        export BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
 
-      # Explicitly configure gcov since we don't have it on Darwin, so autodetection fails
-      export GCOV=${coreutils}/bin/false
+        # Explicitly configure gcov since we don't have it on Darwin, so autodetection fails
+        export GCOV=${coreutils}/bin/false
 
-      # Framework search paths aren't added by bintools hook
-      # https://github.com/NixOS/nixpkgs/pull/41914
-      export NIX_LDFLAGS+=" -F${CoreFoundation}/Library/Frameworks -F${CoreServices}/Library/Frameworks -F${Foundation}/Library/Frameworks"
+        # Framework search paths aren't added by bintools hook
+        # https://github.com/NixOS/nixpkgs/pull/41914
+        export NIX_LDFLAGS+=" -F${CoreFoundation}/Library/Frameworks -F${CoreServices}/Library/Frameworks -F${Foundation}/Library/Frameworks -F${IOKit}/Library/Frameworks"
 
-      # libcxx includes aren't added by libcxx hook
-      # https://github.com/NixOS/nixpkgs/pull/41589
-      export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${lib.getDev libcxx}/include/c++/v1"
+        # libcxx includes aren't added by libcxx hook
+        # https://github.com/NixOS/nixpkgs/pull/41589
+        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -isystem ${lib.getDev libcxx}/include/c++/v1"
 
-      # don't use system installed Xcode to run clang, use Nix clang instead
-      sed -i -E "s;/usr/bin/xcrun (--sdk macosx )?clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $(bazelLinkFlags) -framework CoreFoundation;g" \
-        scripts/bootstrap/compile.sh \
-        tools/osx/BUILD
+        # don't use system installed Xcode to run clang, use Nix clang instead
+        sed -i -E \
+          -e "s;/usr/bin/xcrun (--sdk macosx )?clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $(bazelLinkFlags) -framework CoreFoundation;g" \
+          -e "s;/usr/bin/codesign;CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate ${sigtool}/bin/codesign;" \
+          scripts/bootstrap/compile.sh \
+          tools/osx/BUILD
 
-      substituteInPlace scripts/bootstrap/compile.sh --replace ' -mmacosx-version-min=10.9' ""
+        substituteInPlace scripts/bootstrap/compile.sh --replace ' -mmacosx-version-min=10.9' ""
 
-      # nixpkgs's libSystem cannot use pthread headers directly, must import GCD headers instead
-      sed -i -e "/#include <pthread\/spawn.h>/i #include <dispatch/dispatch.h>" src/main/cpp/blaze_util_darwin.cc
+        # nixpkgs's libSystem cannot use pthread headers directly, must import GCD headers instead
+        sed -i -e "/#include <pthread\/spawn.h>/i #include <dispatch/dispatch.h>" src/main/cpp/blaze_util_darwin.cc
 
-      # clang installed from Xcode has a compatibility wrapper that forwards
-      # invocations of gcc to clang, but vanilla clang doesn't
-      sed -i -e 's;_find_generic(repository_ctx, "gcc", "CC", overriden_tools);_find_generic(repository_ctx, "clang", "CC", overriden_tools);g' tools/cpp/unix_cc_configure.bzl
+        # clang installed from Xcode has a compatibility wrapper that forwards
+        # invocations of gcc to clang, but vanilla clang doesn't
+        sed -i -e 's;_find_generic(repository_ctx, "gcc", "CC", overriden_tools);_find_generic(repository_ctx, "clang", "CC", overriden_tools);g' tools/cpp/unix_cc_configure.bzl
 
-      sed -i -e 's;"/usr/bin/libtool";_find_generic(repository_ctx, "libtool", "LIBTOOL", overriden_tools);g' tools/cpp/unix_cc_configure.bzl
-      wrappers=( tools/cpp/osx_cc_wrapper.sh.tpl )
-      for wrapper in "''${wrappers[@]}"; do
-        sed -i -e "s,/usr/bin/gcc,${stdenv.cc}/bin/clang,g" $wrapper
-        sed -i -e "s,/usr/bin/install_name_tool,${cctools}/bin/install_name_tool,g" $wrapper
-        sed -i -e "s,/usr/bin/xcrun install_name_tool,${cctools}/bin/install_name_tool,g" $wrapper
-      done
-    '';
+        sed -i -e 's;"/usr/bin/libtool";_find_generic(repository_ctx, "libtool", "LIBTOOL", overriden_tools);g' tools/cpp/unix_cc_configure.bzl
+        wrappers=( tools/cpp/osx_cc_wrapper.sh.tpl )
+        for wrapper in "''${wrappers[@]}"; do
+          sed -i -e "s,/usr/bin/gcc,${stdenv.cc}/bin/clang,g" $wrapper
+          sed -i -e "s,/usr/bin/install_name_tool,${cctools}/bin/install_name_tool,g" $wrapper
+          sed -i -e "s,/usr/bin/xcrun install_name_tool,${cctools}/bin/install_name_tool,g" $wrapper
+        done
+      '';
 
-    genericPatches = ''
-      # md5sum is part of coreutils
-      sed -i 's|/sbin/md5|md5sum|g' \
-        src/BUILD third_party/ijar/test/testenv.sh tools/objc/libtool.sh
+      genericPatches = ''
+        function sedVerbose() {
+          local path=$1; shift;
+          sed -i".bak-nix" "$path" "$@"
+          diff -U0 "$path.bak-nix" "$path" | sed "s/^/  /" || true
+          rm -f "$path.bak-nix"
+        }
 
-      # replace initial value of pythonShebang variable in BazelPythonSemantics.java
-      substituteInPlace src/main/java/com/google/devtools/build/lib/bazel/rules/python/BazelPythonSemantics.java \
-        --replace '"#!/usr/bin/env " + pythonExecutableName' "\"#!${python3}/bin/python\""
+        # unzip builtins_bzl.zip so the contents get patched
+        builtins_bzl=src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl
+        unzip ''${builtins_bzl}.zip -d ''${builtins_bzl}_zip >/dev/null
+        rm ''${builtins_bzl}.zip
+        builtins_bzl=''${builtins_bzl}_zip/builtins_bzl
 
-      substituteInPlace src/main/java/com/google/devtools/build/lib/starlarkbuildapi/python/PyRuntimeInfoApi.java \
-        --replace '"#!/usr/bin/env python3"' "\"#!${python3}/bin/python\""
+        # md5sum is part of coreutils
+        sed -i 's|/sbin/md5|md5sum|g' src/BUILD third_party/ijar/test/testenv.sh
 
-      # substituteInPlace is rather slow, so prefilter the files with grep
-      grep -rlZ /bin/ src/main/java/com/google/devtools | while IFS="" read -r -d "" path; do
-        # If you add more replacements here, you must change the grep above!
-        # Only files containing /bin are taken into account.
-        substituteInPlace "$path" \
-          --replace /bin/bash ${bash}/bin/bash \
-          --replace "/usr/bin/env bash" ${bash}/bin/bash \
-          --replace "/usr/bin/env python" ${python3}/bin/python \
-          --replace /usr/bin/env ${coreutils}/bin/env \
-          --replace /bin/true ${coreutils}/bin/true
-      done
+        echo
+        echo "Substituting */bin/* hardcoded paths in src/main/java/com/google/devtools"
+        # Prefilter the files with grep for speed
+        grep -rlZ /bin/ \
+          src/main/java/com/google/devtools \
+          src/main/starlark/builtins_bzl/common/python \
+          tools/python \
+          tools/cpp \
+          tools/build_rules \
+          tools/osx/BUILD \
+        | while IFS="" read -r -d "" path; do
+          # If you add more replacements here, you must change the grep above!
+          # Only files containing /bin are taken into account.
+          sedVerbose "$path" \
+            -e 's!/usr/local/bin/bash!${bash}/bin/bash!g' \
+            -e 's!/usr/bin/bash!${bash}/bin/bash!g' \
+            -e 's!/bin/bash!${bash}/bin/bash!g' \
+            -e 's!/usr/bin/env bash!${bash}/bin/bash!g' \
+            -e 's!/usr/bin/env python2!${python3}/bin/python!g' \
+            -e 's!/usr/bin/env python!${python3}/bin/python!g' \
+            -e 's!/usr/bin/env!${coreutils}/bin/env!g' \
+            -e 's!/bin/true!${coreutils}/bin/true!g'
+        done
 
-      grep -rlZ /bin/ tools/python | while IFS="" read -r -d "" path; do
-        substituteInPlace "$path" \
-          --replace "/usr/bin/env python2" ${python3.interpreter} \
-          --replace "/usr/bin/env python3" ${python3}/bin/python \
-          --replace /usr/bin/env ${coreutils}/bin/env
-      done
+        # Fixup scripts that generate scripts. Not fixed up by patchShebangs below.
+        sedVerbose scripts/bootstrap/compile.sh \
+          -e 's!/bin/bash!${bash}/bin/bash!g' \
+          -e 's!shasum -a 256!sha256sum!g'
 
-      # bazel test runner include references to /bin/bash
-      substituteInPlace tools/build_rules/test_rules.bzl \
-        --replace /bin/bash ${bash}/bin/bash
+        ${bazelNixFlagsScript} > .bazelrc.nix
+        # export BAZELRC=$PWD/.bazelrc.nix
+        # export BAZEL_BOOTSTRAP_STARTUP_OPTIONS=""
+        # export DIST_BAZEL_ARGS=
+        #export EXTRA_BAZEL_ARGS="--rc_source=$PWD/.bazelrc.nix --announce_rc"
 
-      for i in $(find tools/cpp/ -type f)
-      do
-        substituteInPlace $i \
-          --replace /bin/bash ${bash}/bin/bash
-      done
+        # Add compile options to command line.
+        # XXX: It would suit a bazelrc file better, but I found no way to pass it.
+        #      It seems it is always ignored.
+        #      Passing EXTRA_BAZEL_ARGS is tricky due to quoting.
 
-      # Fixup scripts that generate scripts. Not fixed up by patchShebangs below.
-      substituteInPlace scripts/bootstrap/compile.sh \
-          --replace /bin/bash ${bash}/bin/bash
+        #which javac
+        #printenv JAVA_HOME
+        #exit 0
 
-      # add nix environment vars to .bazelrc
-      cat >> .bazelrc <<EOF
-      # Limit the resources Bazel is allowed to use during the build to 1/2 the
-      # available RAM and 3/4 the available CPU cores. This should help avoid
-      # overwhelming the build machine.
-      build --toolchain_resolution_debug=".*"
-      build --local_ram_resources=HOST_RAM*.5
-      build --local_cpu_resources=HOST_CPUS*.75
+        sedVerbose compile.sh \
+          -e "/bazel_build /a\  --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
+          -e "/bazel_build /a\  --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/bazel_build /a\  --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/bazel_build /a\  --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
+          -e "/bazel_build /a\  --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
+          -e "/bazel_build /a\  --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
+          -e "/bazel_build /a\  --verbose_failures \\\\" \
+          -e "/bazel_build /a\  --curses=no \\\\" \
+          -e "/bazel_build /a\  --features=-layering_check \\\\" \
+          -e "/bazel_build /a\  --experimental_strict_java_deps=off \\\\" \
+          -e "/bazel_build /a\  --strict_proto_deps=off \\\\" \
+          -e "/bazel_build /a\  --tool_java_runtime_version=local_jdk \\\\" \
+          -e "/bazel_build /a\  --java_runtime_version=local_jdk \\\\" \
+          -e "/bazel_build /a\  --repo_env=JAVA_HOME=${buildJdk}/${if isDarwin then "/zulu-11.jdk/Contents/Home" else "/lib/openjdk"} \\\\" \
+          -e "/bazel_build /a\  --extra_toolchains=@local_jdk//:all \\\\" \
+          -e "/bazel_build /a\  --toolchain_resolution_debug=@bazel_tools//tools/jdk:runtime_toolchain_type \\\\" \
+          -e "/bazel_build /a\  --sandbox_debug --verbose_failures \\\\" \
+        ${lib.optionalString isDarwin ''
+          -e "/bazel_build /a\  --cpu=${({aarch64-darwin = "darwin_arm64"; x86_64-darwin = "darwin_x86_64";}.${stdenv.hostPlatform.system})} \\\\" \''
+        }
 
-      build --distdir=${distDir}
-      fetch --distdir=${distDir}
-      build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
-      build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
-      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
-      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
-      build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
-      build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
-      build --extra_toolchains=@bazel_tools//tools/jdk:nonprebuilt_toolchain_definition
-      build --verbose_failures
-      build --curses=no
-      build --features=-layering_check
-      build --experimental_strict_java_deps=off
-      build --strict_proto_deps=off
-      EOF
+          #-e "/bazel_build /a\  --spawn_strategy=standalone \\\\" \
 
-      cat >> third_party/grpc/bazel_1.41.0.patch <<EOF
-      diff --git a/third_party/grpc/BUILD b/third_party/grpc/BUILD
-      index 39ee9f97c6..9128d20c85 100644
-      --- a/third_party/grpc/BUILD
-      +++ b/third_party/grpc/BUILD
-      @@ -28,7 +28,6 @@ licenses(["notice"])
-       package(
-           default_visibility = ["//visibility:public"],
-           features = [
-      -        "layering_check",
-               "-parse_headers",
-           ],
-       )
-      EOF
 
-      # add the same environment vars to compile.sh
-      sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
-          -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
-          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
-          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
-          -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
-          -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
-          -e "/\$command \\\\$/a --tool_java_runtime_version=local_jdk_11 \\\\" \
-          -e "/\$command \\\\$/a --java_runtime_version=local_jdk_11 \\\\" \
-          -e "/\$command \\\\$/a --verbose_failures \\\\" \
-          -e "/\$command \\\\$/a --curses=no \\\\" \
-          -e "/\$command \\\\$/a --features=-layering_check \\\\" \
-          -e "/\$command \\\\$/a --experimental_strict_java_deps=off \\\\" \
-          -e "/\$command \\\\$/a --strict_proto_deps=off \\\\" \
-          -i scripts/bootstrap/compile.sh
+        # Also build parser_deploy.jar with bootstrap bazel
+        # TODO: Turn into a proper patch
+        sedVerbose compile.sh \
+          -e 's!bazel_build !bazel_build src/tools/execlog:parser_deploy.jar !' \
+          -e 's!clear_log!cp $(get_bazel_bin_path)/src/tools/execlog/parser_deploy.jar output\nclear_log!'
 
-      # This is necessary to avoid:
-      # "error: no visible @interface for 'NSDictionary' declares the selector
-      # 'initWithContentsOfURL:error:'"
-      # This can be removed when the apple_sdk is upgraded beyond 10.13+
-      sed -i '/initWithContentsOfURL:versionPlistUrl/ {
-        N
-        s/error:nil\];/\];/
-      }' tools/osx/xcode_locator.m
 
-      # append the PATH with defaultShellPath in tools/bash/runfiles/runfiles.bash
-      echo "PATH=\$PATH:${defaultShellPath}" >> runfiles.bash.tmp
-      cat tools/bash/runfiles/runfiles.bash >> runfiles.bash.tmp
-      mv runfiles.bash.tmp tools/bash/runfiles/runfiles.bash
+        # This is necessary to avoid:
+        # "error: no visible @interface for 'NSDictionary' declares the selector
+        # 'initWithContentsOfURL:error:'"
+        # This can be removed when the apple_sdk is upgraded beyond 10.13+
+        sedVerbose tools/osx/xcode_locator.m \
+          -e '/initWithContentsOfURL:versionPlistUrl/ {
+            N
+            s/error:nil\];/\];/
+          }'
 
-      patchShebangs .
-    '';
-    in lib.optionalString stdenv.hostPlatform.isDarwin darwinPatches
-     + genericPatches;
+        # append the PATH with defaultShellPath in tools/bash/runfiles/runfiles.bash
+        echo "PATH=\$PATH:${defaultShellPath}" >> runfiles.bash.tmp
+        cat tools/bash/runfiles/runfiles.bash >> runfiles.bash.tmp
+        mv runfiles.bash.tmp tools/bash/runfiles/runfiles.bash
 
-  buildInputs = [buildJdk] ++ defaultShellUtils;
+        # reconstruct the now patched builtins_bzl.zip
+        pushd src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl_zip &>/dev/null
+          zip ../builtins_bzl.zip $(find builtins_bzl -type f) >/dev/null
+          rm -rf builtins_bzl
+        popd &>/dev/null
+        rmdir src/main/java/com/google/devtools/build/lib/bazel/rules/builtins_bzl_zip
+
+        patchShebangs . >/dev/null
+      '';
+    in
+    lib.optionalString stdenv.hostPlatform.isDarwin darwinPatches
+    + genericPatches;
+
+  buildInputs = [ buildJdk ] ++ defaultShellUtils;
 
   # when a command can’t be found in a bazel build, you might also
   # need to add it to `defaultShellPath`.
···
     unzip
     which
     zip
-    python3.pkgs.absl-py   # Needed to build fish completion
-  ] ++ lib.optionals (stdenv.isDarwin) [ cctools libcxx CoreFoundation CoreServices Foundation ];
+    python3.pkgs.absl-py # Needed to build fish completion
+  ] ++ lib.optionals (stdenv.isDarwin) [
+    cctools
+    libcxx
+    CoreFoundation
+    CoreServices
+    Foundation
+  ];
 
   # Bazel makes extensive use of symlinks in the WORKSPACE.
   # This causes problems with infinite symlinks if the build output is in the same location as the
   # Bazel WORKSPACE. This is why before executing the build, the source code is moved into a
   # subdirectory.
   # Failing to do this causes "infinite symlink expansion detected"
-  preBuildPhases = ["preBuildPhase"];
+  preBuildPhases = [ "preBuildPhase" ];
   preBuildPhase = ''
     mkdir bazel_src
     shopt -s dotglob extglob
···
     # Note that .bazelversion is always correct and is based on bazel-*
     # executable name, version checks should work fine
     export EMBED_LABEL="${version}- (@non-git)"
+    echo "Stage 1 - Running bazel bootstrap script"
     ${bash}/bin/bash ./bazel_src/compile.sh
-    ./bazel_src/scripts/generate_bash_completion.sh \
+
+    # XXX: get rid of this, or move it to another stage.
+    # It is plain annoying when builds fail.
+    echo "Stage 2 - Generate bazel completions"
+    ${bash}/bin/bash ./bazel_src/scripts/generate_bash_completion.sh \
         --bazel=./bazel_src/output/bazel \
         --output=./bazel_src/output/bazel-complete.bash \
         --prepend=./bazel_src/scripts/bazel-complete-header.bash \
···
         --bazel=./bazel_src/output/bazel \
         --output=./bazel_src/output/bazel-complete.fish
 
-    # need to change directory for bazel to find the workspace
-    cd ./bazel_src
-    # build execlog tooling
-    export HOME=$(mktemp -d)
-    ./output/bazel build src/tools/execlog:parser_deploy.jar
-    cd -
+    #echo "Stage 3 - Generate parser_deploy.jar"
+    # XXX: for now, build in the patched compile.sh script to get all the args right.
+    ## need to change directory for bazel to find the workspace
+    #cd ./bazel_src
+    ## build execlog tooling
+    #export HOME=$(mktemp -d)
+    #./output/bazel build src/tools/execlog:parser_deploy.jar
+    #cd -
 
     runHook postBuild
   '';
···
     mv ./bazel_src/output/bazel $out/bin/bazel-${version}-${system}-${arch}
 
     mkdir $out/share
-    cp ./bazel_src/bazel-bin/src/tools/execlog/parser_deploy.jar $out/share/parser_deploy.jar
+    cp ./bazel_src/output/parser_deploy.jar $out/share/parser_deploy.jar
     cat <<EOF > $out/bin/bazel-execlog
     #!${runtimeShell} -e
     ${runJdk}/bin/java -jar $out/share/parser_deploy.jar \$@
···
 
   # Install check fails on `aarch64-darwin`
   # https://github.com/NixOS/nixpkgs/issues/145587
-  doInstallCheck = stdenv.hostPlatform.system != "aarch64-darwin";
+  doInstallCheck = false; #stdenv.hostPlatform.system != "aarch64-darwin";
   installCheckPhase = ''
     export TEST_TMPDIR=$(pwd)
 
···
 
   dontStrip = true;
   dontPatchELF = true;
+
+  passthru.repoCache = repoCache;
+  passthru.distDir = distDir;
 }

pkgs/development/tools/build-managers/bazel/bazel_7/java_toolchain.patch

···
+commit ef1f5586d3c7fb426af1df6ba650bbad98a5a78a
+Author: Guillaume Maudoux <[e-mail]>
+Date:   Fri Oct 6 15:03:28 2023 +0200
+
+    java_toolchain.patch
+
 diff --git a/tools/jdk/BUILD.tools b/tools/jdk/BUILD.tools
+index a8af76e90c..af2540f838 100644
 --- a/tools/jdk/BUILD.tools
 +++ b/tools/jdk/BUILD.tools
-@@ -3,6 +3,7 @@ load(
-     "DEFAULT_TOOLCHAIN_CONFIGURATION",
-     "PREBUILT_TOOLCHAIN_CONFIGURATION",
-     "VANILLA_TOOLCHAIN_CONFIGURATION",
-+    "NONPREBUILT_TOOLCHAIN_CONFIGURATION",
-     "bootclasspath",
-     "default_java_toolchain",
-     "java_runtime_files",
-@@ -321,6 +322,21 @@ alias(
-     actual = ":toolchain",
+@@ -146,6 +146,16 @@ py_test(
+     ],
  )
  
-+default_java_toolchain(
-+  name = "nonprebuilt_toolchain",
-+  configuration = NONPREBUILT_TOOLCHAIN_CONFIGURATION,
-+  java_runtime = "@local_jdk//:jdk",
-+)
++load("@rules_java//toolchains:default_java_toolchain.bzl", "default_java_toolchain", "NONPREBUILT_TOOLCHAIN_CONFIGURATION")
 +
 +default_java_toolchain(
-+  name = "nonprebuilt_toolchain_java11",
-+  configuration = NONPREBUILT_TOOLCHAIN_CONFIGURATION,
-+  java_runtime = "@local_jdk//:jdk",
-+  source_version = "11",
-+  target_version = "11",
++    name = "nonprebuilt_toolchain_java11",
++    configuration = NONPREBUILT_TOOLCHAIN_CONFIGURATION,
++    java_runtime = "@local_jdk//:jdk",
++    source_version = "11",
++    target_version = "11",
 +)
 +
-+
- RELEASES = (8, 9, 10, 11)
+ #### Aliases to rules_java to keep backward-compatibility (begin) ####
  
- [
+ TARGET_NAMES = [

pkgs/development/tools/build-managers/bazel/bazel_7/no-arc.patch

···
+commit bb831fbf02535a3372f5c74dc49e668a2507efeb
+Author: Guillaume Maudoux <[e-mail]>
+Date:   Fri Oct 6 15:06:35 2023 +0200
+
+    no-arc.patch
+
 diff --git a/tools/osx/BUILD b/tools/osx/BUILD
-index 990afe3e8c..cd5b7b1b7a 100644
+index 0358fb0ffe..baae1bf65b 100644
 --- a/tools/osx/BUILD
 +++ b/tools/osx/BUILD
-@@ -28,8 +28,8 @@ exports_files([
+@@ -27,9 +27,9 @@ exports_files([
  ])
  
  DARWIN_XCODE_LOCATOR_COMPILE_COMMAND = """
 -  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.13 -fobjc-arc -framework CoreServices \
 -      -framework Foundation -arch arm64 -arch x86_64 -Wl,-no_adhoc_codesign -Wl,-no_uuid -o $@ $< && \
+-  env -i codesign --identifier $@ --force --sign - $@
 +  /usr/bin/xcrun --sdk macosx clang -mmacosx-version-min=10.13 -framework CoreServices \
-+      -framework Foundation -arch @multiBinPatch@ -Wl,-no_uuid -o $@ $< && \
-   env -i codesign --identifier $@ --force --sign - $@
++      -framework Foundation -Wl,-no_uuid -o $@ $< && \
++  /usr/bin/env -i /usr/bin/codesign --identifier $@ --force --sign - $@
  """
  
+ genrule(
 diff --git a/tools/osx/xcode_configure.bzl b/tools/osx/xcode_configure.bzl
-index 2b819f07ec..a98ce37673 100644
+index a4a712a341..dfbf4869a9 100644
 --- a/tools/osx/xcode_configure.bzl
 +++ b/tools/osx/xcode_configure.bzl
-@@ -127,7 +127,6 @@ def run_xcode_locator(repository_ctx, xcode_locator_src_label):
+@@ -135,7 +135,6 @@ def run_xcode_locator(repository_ctx, xcode_locator_src_label):
          "macosx",
          "clang",
          "-mmacosx-version-min=10.13",
···
          "CoreServices",
          "-framework",
 diff --git a/tools/osx/xcode_locator.m b/tools/osx/xcode_locator.m
-index ed2ef87453..e0ce6dbdd1 100644
+index c602b0bb4b..1f7eb64810 100644
 --- a/tools/osx/xcode_locator.m
 +++ b/tools/osx/xcode_locator.m
 @@ -21,10 +21,6 @@

pkgs/development/tools/build-managers/bazel/bazel_7/os_detect.patch

···
+diff --git a/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkOS.java b/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkOS.java
+index 333ea07801..287760f8b6 100644
+--- a/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkOS.java
++++ b/src/main/java/com/google/devtools/build/lib/bazel/repository/starlark/StarlarkOS.java
+@@ -64,6 +64,8 @@ final class StarlarkOS implements StarlarkValue {
+           "A string identifying the architecture Bazel is running on (the value of the \"os.arch\""
+               + " Java property converted to lower case).")
+   public String getArch() {
+-    return System.getProperty("os.arch").toLowerCase(Locale.ROOT);
++    String arch = System.getProperty("os.arch").toLowerCase(Locale.ROOT);
++    System.out.println("ARCH is " + arch);
++    return arch;
+   }
+ }
+diff --git a/tools/cpp/cc_configure.bzl b/tools/cpp/cc_configure.bzl
+index 56399fb4e3..a0172717b5 100644
+--- a/tools/cpp/cc_configure.bzl
++++ b/tools/cpp/cc_configure.bzl
+@@ -32,16 +32,20 @@ def cc_autoconf_toolchains_impl(repository_ctx):
+     # Should we try to find C++ toolchain at all? If not, we don't have to generate toolchains for C++ at all.
+     should_detect_cpp_toolchain = "BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN" not in env or env["BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN"] != "1"
+ 
++    cpu_value = get_cpu_value(repository_ctx)
++    print('cc_autoconf_toolchains_impl', "cpu_value", cpu_value)
+     if should_detect_cpp_toolchain:
++        print('cc_autoconf_toolchains_impl', repository_ctx.name, "should detect")
+         paths = resolve_labels(repository_ctx, [
+             "@bazel_tools//tools/cpp:BUILD.toolchains.tpl",
+         ])
+         repository_ctx.template(
+             "BUILD",
+             paths["@bazel_tools//tools/cpp:BUILD.toolchains.tpl"],
+-            {"%{name}": get_cpu_value(repository_ctx)},
++            {"%{name}": cpu_value},
+         )
+     else:
++        print('cc_autoconf_toolchains_impl', repository_ctx.name, "should NOT detect")
+         repository_ctx.file("BUILD", "# C++ toolchain autoconfiguration was disabled by BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN env variable.")
+ 
+ cc_autoconf_toolchains = repository_rule(
+@@ -62,6 +66,7 @@ def cc_autoconf_impl(repository_ctx, overriden_tools = dict()):
+ 
+     env = repository_ctx.os.environ
+     cpu_value = get_cpu_value(repository_ctx)
++    print('cc_autoconf_impl', "cpu_value", cpu_value)
+     if "BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN" in env and env["BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN"] == "1":
+         paths = resolve_labels(repository_ctx, [
+             "@bazel_tools//tools/cpp:BUILD.empty.tpl",
+@@ -148,12 +153,14 @@ def cc_configure():
+     cc_autoconf_toolchains(name = "local_config_cc_toolchains")
+     cc_autoconf(name = "local_config_cc")
+     native.bind(name = "cc_toolchain", actual = "@local_config_cc//:toolchain")
++    print('cc_configure does register')
+     native.register_toolchains(
+         # Use register_toolchain's target pattern expansion to register all toolchains in the package.
+         "@local_config_cc_toolchains//:all",
+     )
+ 
+ def _cc_configure_extension_impl(ctx):
++    print('cc_configure_extension does NOT register')
+     cc_autoconf_toolchains(name = "local_config_cc_toolchains")
+     cc_autoconf(name = "local_config_cc")
+ 

pkgs/development/tools/build-managers/bazel/bazel_7/required-hashes.json

···
+[
+  "0a8003b044294d7840ac7d9d73eef05d6ceb682d7516781a4ec62eeb34702578",
+  "sha256-CoADsEQpTXhArH2dc+7wXWzraC11FngaTsYu6zRwJXg=",
+  "0a4c735bb80e342d418c0ef7d2add7793aaf72b91c449bde2769ea81f1869737",
+  "sha256-CkxzW7gONC1BjA730q3XeTqvcrkcRJveJ2nqgfGGlzc=",
+  "0d830380ec66bd7e25eee63aa0a5a08578e46ad187fb72d99b44d9ba22827f91",
+  "sha256-DYMDgOxmvX4l7uY6oKWghXjkatGH+3LZm0TZuiKCf5E=",
+  "0ea47b5ba23ca1da8eb9146c8fc755c1271414633b1e2be2ce1df764ba0fff2a",
+  "sha256-DqR7W6I8odqOuRRsj8dVwScUFGM7Hivizh33ZLoP/yo=",
+  "1b49a7bcbcc595fe1123a5c069816ae31efe6a9625b15dd6fa094f7ff439175e",
+  "sha256-G0mnvLzFlf4RI6XAaYFq4x7+apYlsV3W+glPf/Q5F14=",
+  "1dee0481072d19c929b623e155e14d2f6085dc011529a0a0dbefc84cf571d865",
+  "sha256-He4EgQctGckptiPhVeFNL2CF3AEVKaCg2+/ITPVx2GU=",
+  "1e490b98005664d149b379a9529a6aa05932b8a11b76b4cd86f3d22d76346f47",
+  "sha256-HkkLmABWZNFJs3mpUppqoFkyuKEbdrTNhvPSLXY0b0c=",
+  "1ef5535a8bd41cf3072469f381b9ee6ab28275311a7499f53d6e52adf976fef0",
+  "sha256-HvVTWovUHPMHJGnzgbnuarKCdTEadJn1PW5Srfl2/vA=",
+  "1fc4964236b67cf3c5651d7ac1dff668f73b7810c7f1dc0862a0e5bc01608785",
+  "sha256-H8SWQja2fPPFZR16wd/2aPc7eBDH8dwIYqDlvAFgh4U=",
+  "2a51593342a2ee4f8f1b946dc48d06b02d0721493238e4ae83d1ad66f8b0c9f4",
+  "sha256-KlFZM0Ki7k+PG5RtxI0GsC0HIUkyOOSug9GtZviwyfQ=",
+  "2b70cdfa8c9e997b4007035a266c273c0df341f9c57c9d0b45a680ae3fd882db",
+  "sha256-K3DN+oyemXtABwNaJmwnPA3zQfnFfJ0LRaaArj/Ygts=",
+  "2ac5f7fbefa0b73ef783889069344d5515505a14b2303be693c5002c486df2b4",
+  "sha256-KsX3+++gtz73g4iQaTRNVRVQWhSyMDvmk8UALEht8rQ=",
+  "2f25841c937e24959a57b630e2c4b8525b3d0f536f2e511c9b2bed30b1651d54",
+  "sha256-LyWEHJN+JJWaV7Yw4sS4Uls9D1NvLlEcmyvtMLFlHVQ=",
+  "2fb9007e12f768e9c968f9db292be4ea9cba2ef40fb8d179f3f8746ebdc73c1b",
+  "sha256-L7kAfhL3aOnJaPnbKSvk6py6LvQPuNF58/h0br3HPBs=",
+  "3ea995b55a4068be22989b70cc29a4d788c2d328d1d50613a7a9afd13fdd2d0a",
+  "sha256-PqmVtVpAaL4imJtwzCmk14jC0yjR1QYTp6mv0T/dLQo=",
+  "3a561c99e7bdbe9173aa653fd579fe849f1d8d67395780ab4770b1f381431d51",
+  "sha256-OlYcmee9vpFzqmU/1Xn+hJ8djWc5V4CrR3Cx84FDHVE=",
+  "4e5f563ae14ed713381816d582f5fcfd0615aefb29203486cdfb782d8a00a02b",
+  "sha256-Tl9WOuFO1xM4GBbVgvX8/QYVrvspIDSGzft4LYoAoCs=",
+  "4ae44dd05b49a1109a463c0d2aaf920c24f76d1e996bb89f29481c4ff75ec526",
+  "sha256-SuRN0FtJoRCaRjwNKq+SDCT3bR6Za7ifKUgcT/dexSY=",
+  "5a76c3d401c984999d59868f08df05a15613d1428f7764fed80b722e2a277f6c",
+  "sha256-WnbD1AHJhJmdWYaPCN8FoVYT0UKPd2T+2AtyLionf2w=",
+  "4fccff8382aafc589962c4edb262f6aa595e34f1e11e61057d1c6a96e8fc7323",
+  "sha256-T8z/g4Kq/FiZYsTtsmL2qlleNPHhHmEFfRxqluj8cyM=",
+  "5a725b777976b77aa122b707d1b6f0f39b6020f66cd427bb111a585599c857b1",
+  "sha256-WnJbd3l2t3qhIrcH0bbw85tgIPZs1Ce7ERpYVZnIV7E=",
+  "5bb6b0253ccf64b53d6c7249625a7e3f6c3bc6402abd52d3778bfa48258703a0",
+  "sha256-W7awJTzPZLU9bHJJYlp+P2w7xkAqvVLTd4v6SCWHA6A=",
+  "5bc8365613fe2f8ce6cc33959b7667b13b7fe56cb9d16ba740c06e1a7c4242fc",
+  "sha256-W8g2VhP+L4zmzDOVm3ZnsTt/5Wy50WunQMBuGnxCQvw=",
+  "5efa9fbb54a58b1a12205a5fac565f6982abfeb0ff45bdbc318748ef5fd3a3ff",
+  "sha256-Xvqfu1SlixoSIFpfrFZfaYKr/rD/Rb28MYdI71/To/8=",
+  "6c4e993c28cf2882964cac82a0f96e81a325840043884526565017b2f62c5ba4",
+  "sha256-bE6ZPCjPKIKWTKyCoPlugaMlhABDiEUmVlAXsvYsW6Q=",
+  "6ab68b0a3bb3834af44208df058be4631425b56ef95f9b9412aa21df3311e8d3",
+  "sha256-araLCjuzg0r0QgjfBYvkYxQltW75X5uUEqoh3zMR6NM=",
+  "6d472ee6d2b60ef3f3e6801e7cd4dbec5fbbef81e883a0de1fbc55e6defe1cb7",
+  "sha256-bUcu5tK2DvPz5oAefNTb7F+774Hog6DeH7xV5t7+HLc=",
+  "8a9b54d3506a3b92ee46b217bcee79196b21ca6d52dc2967c686a205fb2f9c15",
+  "sha256-iptU01BqO5LuRrIXvO55GWshym1S3ClnxoaiBfsvnBU=",
+  "007c7d9c378df02d390567d0d7ddf542ffddb021b7313dbf502392113ffabb08",
+  "sha256-AHx9nDeN8C05BWfQ1931Qv/dsCG3MT2/UCOSET/6uwg=",
+  "8b0862cad85b9549f355fe383c6c63816d2f19529634e033ae06d0107ab110b9",
+  "sha256-iwhiythblUnzVf44PGxjgW0vGVKWNOAzrgbQEHqxELk=",
+  "8d784075bec0b7c55042c109a4de8923b3b6d2ebd2e00912d518f07240f9c23a",
+  "sha256-jXhAdb7At8VQQsEJpN6JI7O20uvS4AkS1RjwckD5wjo=",
+  "8f9ee2dc10c1ae514ee599a8b42ed99fa262b757058f65ad3c384289ff70c4b8",
+  "sha256-j57i3BDBrlFO5ZmotC7Zn6Jit1cFj2WtPDhCif9wxLg=",
+  "21af30c92267bd6122c0e0b4d20cccb6641a37eaf956c6540ec471d584e64a7b",
+  "sha256-Ia8wySJnvWEiwOC00gzMtmQaN+r5VsZUDsRx1YTmSns=",
+  "30dba0a651fd5fba8fcae81f92938c590230300f9265ea849f431494f7f92c16",
+  "sha256-MNugplH9X7qPyugfkpOMWQIwMA+SZeqEn0MUlPf5LBY=",
+  "50f11b09f877c294d56f24463f47d28f929cf5044f648661c0f0cfbae9a2f49c",
+  "sha256-UPEbCfh3wpTVbyRGP0fSj5Kc9QRPZIZhwPDPuumi9Jw=",
+  "54e5be675e5c2ab0958647fcaa35c14bd8f7c08358c634f5ab786e4ed7268576",
+  "sha256-VOW+Z15cKrCVhkf8qjXBS9j3wINYxjT1q3huTtcmhXY=",
+  "82ca0e08171846d1768d5ac3f13244d6fe5a54102c14735ef40bf15d57d478e5",
+  "sha256-gsoOCBcYRtF2jVrD8TJE1v5aVBAsFHNe9AvxXVfUeOU=",
+  "84ee23b7989d4bf19930b5bd3d03c0f2efb9e73bcee3a0208a9d1b2e1979c049",
+  "sha256-hO4jt5idS/GZMLW9PQPA8u+55zvO46Agip0bLhl5wEk=",
+  "91ac87d30cc6d79f9ab974c51874a704de9c2647c40f6932597329a282217ba8",
+  "sha256-kayH0wzG15+auXTFGHSnBN6cJkfED2kyWXMpooIhe6g=",
+  "117a1227cdaf813a20a1bba78a9f2d8fb30841000c33e2f2d2a640bd224c9282",
+  "sha256-EXoSJ82vgTogobunip8tj7MIQQAMM+Ly0qZAvSJMkoI=",
+  "153fa3cdc153ac3ee25649e8037aeda4438256153d35acf3c27e83e4ee6165a4",
+  "sha256-FT+jzcFTrD7iVknoA3rtpEOCVhU9Nazzwn6D5O5hZaQ=",
+  "193edf97aefa28b93c5892bdc598bac34fa4c396588030084f290b1440e8b98a",
+  "sha256-GT7fl676KLk8WJK9xZi6w0+kw5ZYgDAITykLFEDouYo=",
+  "211b306cfc44f8f96df3a0a3ddaf75ba8c5289eed77d60d72f889bb855f535e5",
+  "sha256-IRswbPxE+Plt86Cj3a91uoxSie7XfWDXL4ibuFX1NeU=",
+  "261be84be30a56994e132d718a85efcd579197a2edb9426b84c5722c56955eca",
+  "sha256-JhvoS+MKVplOEy1xioXvzVeRl6LtuUJrhMVyLFaVXso=",
+  "443bb316599fb16e3baeba2fb58881814d7ff0b7af176fe76e38071a6e86f8c0",
+  "sha256-RDuzFlmfsW47rrovtYiBgU1/8LevF2/nbjgHGm6G+MA=",
+  "453fe595c3e12b9228b930b845140aaed93a9fb87d1a5d829c55b31d670def9f",
+  "sha256-RT/llcPhK5IouTC4RRQKrtk6n7h9Gl2CnFWzHWcN758=",
+  "685de33b53eb313049bbeee7f4b7a80dd09e8e754e96b048a3edab2cebb36442",
+  "sha256-aF3jO1PrMTBJu+7n9LeoDdCejnVOlrBIo+2rLOuzZEI=",
+  "725c26b4dd58a1aa782020952ad949bdb607235dd20ee49e5a5875c15456ca86",
+  "sha256-clwmtN1Yoap4ICCVKtlJvbYHI13SDuSeWlh1wVRWyoY=",
+  "766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7",
+  "sha256-dmrSoHg/JoeWLIrXTO7MOKKLn3Ki0IXuQ4t4E+ko0Mc=",
+  "878fbe521731c072d14d2d65b983b1beae6ad06fda0007b6a8bae81f73f433c4",
+  "sha256-h4++UhcxwHLRTS1luYOxvq5q0G/aAAe2qLroH3P0M8Q=",
+  "914ce84508410ee1419514925f93b1855a9f7a7b5b5d02fc07f411d2a45f1bba",
+  "sha256-kUzoRQhBDuFBlRSSX5OxhVqfentbXQL8B/QR0qRfG7o=",
+  "990c378168dc6364c6ff569701f4f2f122fffe8998b3e189eba4c4d868ed1084",
+  "sha256-mQw3gWjcY2TG/1aXAfTy8SL//omYs+GJ66TE2GjtEIQ=",
+  "2067b788d4c1c96fd621ad861053a5c4d8a801cfafc77fec20d49a6e9340a745",
+  "sha256-IGe3iNTByW/WIa2GEFOlxNioAc+vx3/sINSabpNAp0U=",
+  "2220f02fcfc480e3798bab43b2618d158319f9fcb357c9eb04b4a68117699808",
+  "sha256-IiDwL8/EgON5i6tDsmGNFYMZ+fyzV8nrBLSmgRdpmAg=",
+  "2744ccc1bbd653c9f65f5764ab211f51cae56aa6c2e2288850a9add9c805be56",
+  "sha256-J0TMwbvWU8n2X1dkqyEfUcrlaqbC4iiIUKmt2cgFvlY=",
+  "4531deccb913639c30e5c7512a054d5d875698daeb75d8cf90f284375fe7c360",
+  "sha256-RTHezLkTY5ww5cdRKgVNXYdWmNrrddjPkPKEN1/nw2A=",
+  "5493a21f5ed3fc502e66fec6b9449c06a551ced63002fa48903c40dfa8de7a4a",
+  "sha256-VJOiH17T/FAuZv7GuUScBqVRztYwAvpIkDxA36jeeko=",
+  "6436f19cef264fd949fb7a41e11424e373aa3b1096cad0b7e518f1c81aa60f23",
+  "sha256-ZDbxnO8mT9lJ+3pB4RQk43OqOxCWytC35RjxyBqmDyM=",
+  "8923a73ba8a373f7b994906f5902ba9f6bb59d181d4ad01576a6e0c5abb09b67",
+  "sha256-iSOnO6ijc/e5lJBvWQK6n2u1nRgdStAVdqbgxauwm2c=",
+  "23722fa366ba017137a68c5e92fc3ee27bbb341c681ac4790f61c6adb7289e26",
+  "sha256-I3Ivo2a6AXE3poxekvw+4nu7NBxoGsR5D2HGrbconiY=",
+  "366009a43cfada35015e4cc40a7efc4b7f017c6b8df5cac3f87d2478027b2056",
+  "sha256-NmAJpDz62jUBXkzECn78S38BfGuN9crD+H0keAJ7IFY=",
+  "748677bebb1651a313317dfd93e984ed8f8c9e345538fa8b0ab0cbb804631953",
+  "sha256-dIZ3vrsWUaMTMX39k+mE7Y+MnjRVOPqLCrDLuARjGVM=",
+  "774165a1c4dbaacb17f9c1ad666b3569a6a59715ae828e7c3d47703f479a53e7",
+  "sha256-d0FlocTbqssX+cGtZms1aaallxWugo58PUdwP0eaU+c=",
+  "320366665d19027cda87b2368c03939006a37e0388bfd1091c8d2a96fbc93bd8",
+  "sha256-MgNmZl0ZAnzah7I2jAOTkAajfgOIv9EJHI0qlvvJO9g=",
+  "810232374e76a954949f0e2185cd7d9515addb918cf3da3481f77e07c356b49a",
+  "sha256-gQIyN052qVSUnw4hhc19lRWt25GM89o0gfd+B8NWtJo=",
+  "a5a78019bc1cd43dbc3c7b7cdd3801912ca26d1f498fb560514fee497864ba96",
+  "sha256-paeAGbwc1D28PHt83TgBkSyibR9Jj7VgUU/uSXhkupY=",
+  "2044542933fcdf40ad18441bec37646d150c491871157f288847e29cb81de4cb",
+  "sha256-IERUKTP830CtGEQb7DdkbRUMSRhxFX8oiEfinLgd5Ms=",
+  "a136d3dce67168d88751115fa223bec80eae6cc062aa2f8173e8344a98235ec4",
+  "sha256-oTbT3OZxaNiHURFfoiO+yA6ubMBiqi+Bc+g0SpgjXsQ=",
+  "a42edc9cab792e39fe39bb94f3fca655ed157ff87a8af78e1d6ba5b07c4a00ab",
+  "sha256-pC7cnKt5Ljn+ObuU8/ymVe0Vf/h6iveOHWulsHxKAKs=",
+  "a171ee4c734dd2da837e4b16be9df4661afab72a41adaf31eb84dfdaf936ca26",
+  "sha256-oXHuTHNN0tqDfksWvp30Zhr6typBra8x64Tf2vk2yiY=",
+  "aa11ecd5fc0af2769f0f2bdd25e2f4de7c1291ed24326fb23fa69bdd5dcae2b5",
+  "sha256-qhHs1fwK8nafDyvdJeL03nwSke0kMm+yP6ab3V3K4rU=",
+  "a827c49183f3a632277d27a0a4673686cb341507447b9d570261094bd748aa68",
+  "sha256-qCfEkYPzpjInfSegpGc2hss0FQdEe51XAmEJS9dIqmg=",
+  "aabf9bd23091a4ebfc109c1f3ee7cf3e4b89f6ba2d3f51c5243f16b3cffae011",
+  "sha256-qr+b0jCRpOv8EJwfPufPPkuJ9rotP1HFJD8Ws8/64BE=",
+  "ae46b722a8b8e9b62170f83bfb040cbf12adb732144e689985a66b26410a7d6f",
+  "sha256-rka3Iqi46bYhcPg7+wQMvxKttzIUTmiZhaZrJkEKfW8=",
+  "ae63be5fe345ffdd5157284d90b783138eb31634e274182a8495242f9ad66a56",
+  "sha256-rmO+X+NF/91RVyhNkLeDE46zFjTidBgqhJUkL5rWalY=",
+  "aeb8d7a1361aa3d8f5a191580fa7f8cbc5ceb53137a4a698590f612f791e2c45",
+  "sha256-rrjXoTYao9j1oZFYD6f4y8XOtTE3pKaYWQ9hL3keLEU=",
+  "b5ecd1483e041197012786f749968a62063c1964d3ecfbf96ba92a95797bb8f5",
+  "sha256-tezRSD4EEZcBJ4b3SZaKYgY8GWTT7Pv5a6kqlXl7uPU=",
+  "b8a1527901774180afc798aeb28c4634bdccf19c4d98e7bdd1ce79d1fe9aaad7",
+  "sha256-uKFSeQF3QYCvx5iusoxGNL3M8ZxNmOe90c550f6aqtc=",
+  "b9d4fe4d71938df38839f0eca42aaaa64cf8b313d678da036f0cb3ca199b47f5",
+  "sha256-udT+TXGTjfOIOfDspCqqpkz4sxPWeNoDbwyzyhmbR/U=",
+  "b372a037d4230aa57fbeffdef30fd6123f9c0c2db85d0aced00c91b974f33f99",
+  "sha256-s3KgN9QjCqV/vv/e8w/WEj+cDC24XQrO0AyRuXTzP5k=",
+  "ba734e1e84c09d615af6a09d33034b4f0442f8772dec120efb376d86a565ae15",
+  "sha256-unNOHoTAnWFa9qCdMwNLTwRC+Hct7BIO+zdthqVlrhU=",
+  "bb529ba133c0256df49139bd403c17835edbf60d2ecd6463549c6a5fe279364d",
+  "sha256-u1KboTPAJW30kTm9QDwXg17b9g0uzWRjVJxqX+J5Nk0=",
+  "be4ce53138a238bb522cd781cf91f3ba5ce2f6ca93ec62d46a162a127225e0a6",
+  "sha256-vkzlMTiiOLtSLNeBz5Hzulzi9sqT7GLUahYqEnIl4KY=",
+  "c7bec54b7b5588b5967e870341091c5691181d954cf2039f1bf0a6eeb837473b",
+  "sha256-x77FS3tViLWWfocDQQkcVpEYHZVM8gOfG/Cm7rg3Rzs=",
+  "c96d60551331a196dac54b745aa642cd078ef89b6f267146b705f2c2cbef052d",
+  "sha256-yW1gVRMxoZbaxUt0WqZCzQeO+JtvJnFGtwXywsvvBS0=",
+  "cb852272c1cb0c8449d8b1a70f3e0f2c1efb2063e543183faa43078fb446f540",
+  "sha256-y4UicsHLDIRJ2LGnDz4PLB77IGPlQxg/qkMHj7RG9UA=",
+  "cf7f71eaff90b24c1a28b49645a9ff03a9a6c1e7134291ce70901cb63e7364b5",
+  "sha256-z39x6v+QskwaKLSWRan/A6mmwecTQpHOcJActj5zZLU=",
+  "d76b9afea61c7c082908023f0cbc1427fab9abd2df915c8b8a3e7a509bccbc6d",
+  "sha256-12ua/qYcfAgpCAI/DLwUJ/q5q9LfkVyLij56UJvMvG0=",
+  "d96cc09045a1341c6d47494352aa263b87b72fb1d2ea9eca161aa73820bfe8bb",
+  "sha256-2WzAkEWhNBxtR0lDUqomO4e3L7HS6p7KFhqnOCC/6Ls=",
+  "dc3fb206a2cb3441b485eb1e423165b231235a1ea9b031b4433cf7bc1fa460dd",
+  "sha256-3D+yBqLLNEG0heseQjFlsjEjWh6psDG0Qzz3vB+kYN0=",
+  "dacf78ce78ab2d29570325db4cd2451ea589639807de95881a0fa7155a9e6b55",
+  "sha256-2s94znirLSlXAyXbTNJFHqWJY5gH3pWIGg+nFVqea1U=",
+  "e04ba5195bcd555dc95650f7cc614d151e4bcd52d29a10b8aa2197f3ab89ab9b",
+  "sha256-4EulGVvNVV3JVlD3zGFNFR5LzVLSmhC4qiGX86uJq5s=",
+  "de69a09dc70417580aabf20a28619bb3ef60d038470c7cf8442fafcf627c21cb",
+  "sha256-3mmgnccEF1gKq/IKKGGbs+9g0DhHDHz4RC+vz2J8Ics=",
+  "e47edfb2ceaf43fc699e20c179ec428b6f3e497cf8e2dcd8e9c936d4b96b1e56",
+  "sha256-5H7fss6vQ/xpniDBeexCi28+SXz44tzY6ck21LlrHlY=",
+  "e59770b66e81822e5d111ac4e544d7eb0c543e0a285f52628e53941acd8ed759",
+  "sha256-5Zdwtm6Bgi5dERrE5UTX6wxUPgooX1JijlOUGs2O11k=",
+  "ec76c5e79db59762776bece58b69507d095856c37b81fd35bfb0958e74b61d93",
+  "sha256-7HbF5521l2J3a+zli2lQfQlYVsN7gf01v7CVjnS2HZM=",
+  "ec92dae810034f4b46dbb16ef4364a4013b0efb24a8c5dd67435cae46a290d8e",
+  "sha256-7JLa6BADT0tG27Fu9DZKQBOw77JKjF3WdDXK5GopDY4=",
+  "eede807f0dd5eb1ad74ea1ae1094430631da63fcde00d4dc20eb0cd048bb0ac3",
+  "sha256-7t6Afw3V6xrXTqGuEJRDBjHaY/zeANTcIOsM0Ei7CsM=",
+  "eca21884e6f66a88c358e580fd67a6b148d30ab57b1680f62a96c00f9bc6a07e",
+  "sha256-7KIYhOb2aojDWOWA/WemsUjTCrV7FoD2KpbAD5vGoH4=",
+  "eeeae917917144a68a741d4c0dff66aa5c5c5fd85593ff217bced3fc8ca783b8",
+  "sha256-7urpF5FxRKaKdB1MDf9mqlxcX9hVk/8he87T/Iyng7g=",
+  "f43f29fe2a6ebaf04b2598cdeec32a4e346d49a9404e990f5fc19c19f3a28d0e",
+  "sha256-9D8p/ipuuvBLJZjN7sMqTjRtSalATpkPX8GcGfOijQ4=",
+  "f86fd42a809e1871ca0aabe89db0d440451219c3ce46c58da240c7dcdc00125f",
+  "sha256-+G/UKoCeGHHKCqvonbDUQEUSGcPORsWNokDH3NwAEl8=",
+  "f87a502f3d257bc41f80bd0b90c19e6b4a48d0600fb26e7b5d6c2c675680fa0e",
+  "sha256-+HpQLz0le8QfgL0LkMGea0pI0GAPsm57XWwsZ1aA+g4=",
+  "f195cd6228d3f99fa7e30ff2dee60ad0f2c7923be31399a7dcdc1abd679aa22e",
+  "sha256-8ZXNYijT+Z+n4w/y3uYK0PLHkjvjE5mn3NwavWeaoi4=",
+  "fa5469f4c44ee598a2d8f033ab0a9dcbc6498a0c5e0c998dfa0c2adf51358044",
+  "sha256-+lRp9MRO5Zii2PAzqwqdy8ZJigxeDJmN+gwq31E1gEQ=",
+  "f1474d47f4b6b001558ad27b952e35eda5cc7146788877fc52938c6eba24b382",
+  "sha256-8UdNR/S2sAFVitJ7lS417aXMcUZ4iHf8UpOMbroks4I=",
+  "ff2d59fad74e867630fbc7daab14c432654712ac624dbee468d220677b124dd5",
+  "sha256-/y1Z+tdOhnYw+8faqxTEMmVHEqxiTb7kaNIgZ3sSTdU=",
+  "ff5b3cd331ae8a9a804768280da98f50f424fef23dd3c788bb320e08c94ee598",
+  "sha256-/1s80zGuipqAR2goDamPUPQk/vI908eIuzIOCMlO5Zg="
+]

pkgs/development/tools/build-managers/bazel/bazel_7/serialize_nulls.patch

···
+diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/GsonTypeAdapterUtil.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/GsonTypeAdapterUtil.java
+index 05a54e2e05..6e22f10386 100644
+--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/GsonTypeAdapterUtil.java
++++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/GsonTypeAdapterUtil.java
+@@ -362,6 +362,7 @@ public final class GsonTypeAdapterUtil {
+   public static Gson createLockFileGson(Path moduleFilePath) {
+     return new GsonBuilder()
+         .setPrettyPrinting()
++        .serializeNulls()
+         .disableHtmlEscaping()
+         .enableComplexMapKeySerialization()
+         .registerTypeAdapterFactory(GenerateTypeAdapter.FACTORY)

pkgs/development/tools/build-managers/bazel/bazel_7/strict_proto_deps.patch

···
+commit c5cbdf1fcfb96299aaef7fb9909c2cc30b126568
+Author: Guillaume Maudoux <[e-mail]>
+Date:   Fri Oct 6 15:06:00 2023 +0200
+
+    strict_proto_deps.patch
+
 diff --git a/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl b/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
-index 63f68167e4..f106e64c9b 100644
+index e2118aabea..6a33f03472 100644
 --- a/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
 +++ b/src/main/starlark/builtins_bzl/common/java/proto/java_proto_library.bzl
-@@ -114,6 +114,7 @@ def java_compile_for_protos(ctx, output_jar_suffix, source_jar = None, deps = []
+@@ -117,6 +117,7 @@ def java_compile_for_protos(ctx, output_jar_suffix, source_jar = None, deps = []
+             deps = deps,
              exports = exports,
-             output = output_jar,
              output_source_jar = source_jar,
 +            strict_deps = ctx.fragments.proto.strict_proto_deps(),
              injecting_rule_kind = injecting_rule_kind,

pkgs/development/tools/build-managers/bazel/bazel_7/tmp.patch

···
+diff --git a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleFileFunction.java b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleFileFunction.java
+index 958669706c..dc27d3de26 100644
+--- a/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleFileFunction.java
++++ b/src/main/java/com/google/devtools/build/lib/bazel/bzlmod/ModuleFileFunction.java
+@@ -52,6 +52,7 @@ import com.google.devtools.build.skyframe.SkyKey;
+ import com.google.devtools.build.skyframe.SkyValue;
+ import com.google.errorprone.annotations.FormatMethod;
+ import java.io.IOException;
++import java.io.*;
+ import java.net.URISyntaxException;
+ import java.util.ArrayList;
+ import java.util.List;
+@@ -404,6 +405,7 @@ public class ModuleFileFunction implements SkyFunction {
+     GetModuleFileResult result = new GetModuleFileResult();
+     for (Registry registry : registryObjects) {
+       try {
++        System.out.println("Trying to find module " + key + " in " + registry.getUrl());
+         Optional<ModuleFile> moduleFile = registry.getModuleFile(key, env.getListener());
+         if (moduleFile.isEmpty()) {
+           continue;
+diff --git a/src/main/java/com/google/devtools/build/lib/bazel/repository/cache/RepositoryCache.java b/src/main/java/com/google/devtools/build/lib/bazel/repository/cache/RepositoryCache.java
+index 07bc071655..0ee990e0f4 100644
+--- a/src/main/java/com/google/devtools/build/lib/bazel/repository/cache/RepositoryCache.java
++++ b/src/main/java/com/google/devtools/build/lib/bazel/repository/cache/RepositoryCache.java
+@@ -27,6 +27,7 @@ import com.google.devtools.build.lib.vfs.Path;
+ import java.io.IOException;
+ import java.io.InputStream;
+ import java.io.OutputStream;
++import java.io.*;
+ import java.util.UUID;
+ import javax.annotation.Nullable;
+ 
+@@ -166,6 +167,7 @@ public class RepositoryCache {
+ 
+     assertKeyIsValid(cacheKey, keyType);
+     if (!exists(cacheKey, keyType)) {
++      System.out.println("Cache lookup failed for " + keyType + " key " + cacheKey); 
+       return null;
+     }
+ 
+diff --git a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+index a8e2a08145..fcbe05fcea 100644
+--- a/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
++++ b/src/main/java/com/google/devtools/build/lib/rules/repository/RepositoryDelegatorFunction.java
+@@ -48,6 +48,7 @@ import com.google.devtools.build.skyframe.SkyFunctionException.Transience;
+ import com.google.devtools.build.skyframe.SkyKey;
+ import com.google.devtools.build.skyframe.SkyValue;
+ import java.io.IOException;
++import java.io.*;
+ import java.nio.charset.StandardCharsets;
+ import java.util.Map;
+ import java.util.Optional;
+@@ -345,6 +346,7 @@ public final class RepositoryDelegatorFunction implements SkyFunction {
+ 
+     if (!repoRoot.exists()) {
+       // The repository isn't on the file system, there is nothing we can do.
++      System.out.println("Failed to find repo " + repositoryName.getNameWithAt());
+       throw new RepositoryFunctionException(
+           new IOException(
+               "to fix, run\n\tbazel fetch //...\nExternal repository "

pkgs/development/tools/build-managers/bazel/bazel_7/trim-last-argument-to-gcc-if-empty.patch

···
+commit d2b4b1d748ec4fa302036b514377da4c4618177a
+Author: Guillaume Maudoux <[e-mail]>
+Date:   Fri Oct 6 15:05:20 2023 +0200
+
+    trim-last-argument-to-gcc-if-empty.patch
+
+diff --git a/tools/cpp/osx_cc_wrapper.sh.tpl b/tools/cpp/osx_cc_wrapper.sh.tpl
+index 8264090c29..b7b9e8537a 100644
+--- a/tools/cpp/osx_cc_wrapper.sh.tpl
++++ b/tools/cpp/osx_cc_wrapper.sh.tpl
+@@ -64,7 +64,11 @@ done
+ %{env}
+ 
+ # Call the C++ compiler
+-%{cc} "$@"
++if [[ ${*: -1} = "" ]]; then
++    %{cc} "${@:0:$#}"
++else
++    %{cc} "$@"
++fi
+ 
+ function get_library_path() {
+     for libdir in ${LIB_DIRS}; do

pkgs/development/tools/build-managers/bazel/cpp-test.nix

···
-{
-  bazel
+{ bazel
 , bazelTest
 , bazel-examples
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , runLocal
 , runtimeShell
 , writeScript
 , writeText
 , distDir
+, Foundation
 }:
 
 let
···
     exec "$BAZEL_REAL" "$@"
   '';
 
-  workspaceDir = runLocal "our_workspace" {} (''
+  workspaceDir = runLocal "our_workspace" { } (''
     cp -r ${bazel-examples}/cpp-tutorial/stage3 $out
     find $out -type d -exec chmod 755 {} \;
   ''
···
     inherit workspaceDir;
     bazelPkg = bazel;
     bazelScript = ''
-      ${bazel}/bin/bazel \
-        build --verbose_failures \
+      ${bazel}/bin/bazel info output_base
+      ${bazel}/bin/bazel build //... \
+        --verbose_failures \
+        --sandbox_debug \
         --distdir=${distDir} \
         --curses=no \
-        --sandbox_debug \
-        //... \
+        ${extraBazelArgs} \
     '' + lib.optionalString (stdenv.isDarwin) ''
-        --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
-        --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
+      --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
+      --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
+      --linkopt=-Wl,-F${Foundation}/Library/Frameworks \
+      --linkopt=-L${darwin.libobjc}/lib \
     '';
   };
 
-in testBazel
+in
+testBazel

pkgs/development/tools/build-managers/bazel/java-test.nix

···
-{
-  bazel
+{ bazel
 , bazelTest
 , bazel-examples
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , openjdk8
 , jdk11_headless
+, jdk17_headless
 , runLocal
 , runtimeShell
 , writeScript
···
     exec "$BAZEL_REAL" "$@"
   '';
 
-  workspaceDir = runLocal "our_workspace" {} (''
+  workspaceDir = runLocal "our_workspace" { } (''
     cp -r ${bazel-examples}/java-tutorial $out
     find $out -type d -exec chmod 755 {} \;
   ''
···
     name = "bazel-test-java";
     inherit workspaceDir;
     bazelPkg = bazel;
-    buildInputs = [ (if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8 else jdk11_headless) ];
+    buildInputs = [
+      #(if lib.strings.versionOlder bazel.version "5.0.0" then openjdk8
+      #else if lib.strings.versionOlder bazel.version "7.0.0" then jdk11_headless
+      #else jdk17_headless)
+      jdk17_headless
+    ];
     bazelScript = ''
       ${bazel}/bin/bazel \
         run \
+        --announce_rc \
         --distdir=${distDir} \
         --verbose_failures \
         --curses=no \
···
         --strict_java_deps=off \
         //:ProjectRunner \
     '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
-        --host_javabase='@local_jdk//:jdk' \
-        --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
-        --javabase='@local_jdk//:jdk' \
-    '';
+      --host_javabase='@local_jdk//:jdk' \
+      --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
+      --javabase='@local_jdk//:jdk' \
+    '' + extraBazelArgs;
   };
 
-in testBazel
+in
+testBazel
 

pkgs/development/tools/build-managers/bazel/protobuf-test.nix

···
-{
-  bazel
+{ bazel
 , bazelTest
 , fetchFromGitHub
 , fetchurl
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , openjdk8
 , jdk11_headless
···
 }:
 
 let
-  com_google_protobuf = fetchFromGitHub {
-    owner = "protocolbuffers";
-    repo = "protobuf";
-    rev = "v3.13.0";
-    sha256 = "1nqsvi2yfr93kiwlinz8z7c68ilg1j75b2vcpzxzvripxx5h6xhd";
-  };
-
-  bazel_skylib = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "bazel-skylib";
-    rev = "2ec2e6d715e993d96ad6222770805b5bd25399ae";
-    sha256 = "1z2r2vx6kj102zvp3j032djyv99ski1x1sl4i3p6mswnzrzna86s";
-  };
 
-  rules_python = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "rules_python";
-    rev = "c8c79aae9aa1b61d199ad03d5fe06338febd0774";
-    sha256 = "1zn58wv5wcylpi0xj7riw34i1jjpqahanxx8y9srwrv0v93b6pqz";
-  };
-
-  rules_proto = fetchFromGitHub {
-    owner = "bazelbuild";
-    repo = "rules_proto";
-    rev = "a0761ed101b939e19d83b2da5f59034bffc19c12";
-    sha256 = "09lqfj5fxm1fywxr5w8pnpqd859gb6751jka9fhxjxjzs33glhqf";
-  };
-
-  net_zlib = fetchurl rec {
-    url = "https://zlib.net/zlib-1.2.11.tar.gz";
-    sha256 = "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1";
+  # Use builtins.fetchurl to avoid IFD, in particular on hydra
+  lockfile =
+    let version = "7.0.0-pre.20230917.3";
+    in builtins.fetchurl {
+      url = "https://raw.githubusercontent.com/bazelbuild/bazel/${version}/MODULE.bazel.lock";
+      sha256 = "0z6mlz8cn03qa40mqbw6j6kd6qyn4vgb3bb1kyidazgldxjhrz6y";
+    };
 
-    passthru.sha256 = sha256;
-  };
+  MODULE = writeText "MODULE.bazel" ''
+    #bazel_dep(name = "bazel_skylib", version = "1.4.1")
+    #bazel_dep(name = "protobuf", version = "21.7", repo_name = "com_google_protobuf")
+    bazel_dep(name = "protobuf", version = "21.7")
+    #bazel_dep(name = "grpc", version = "1.48.1.bcr.1", repo_name = "com_github_grpc_grpc")
+    #bazel_dep(name = "platforms", version = "0.0.7")
+    #bazel_dep(name = "rules_pkg", version = "0.9.1")
+    #bazel_dep(name = "stardoc", version = "0.5.3", repo_name = "io_bazel_skydoc")
+    #bazel_dep(name = "zstd-jni", version = "1.5.2-3.bcr.1")
+    #bazel_dep(name = "blake3", version = "1.3.3.bcr.1")
+    #bazel_dep(name = "zlib", version = "1.3")
+    #bazel_dep(name = "rules_cc", version = "0.0.8")
+    #bazel_dep(name = "rules_java", version = "6.3.1")
+    bazel_dep(name = "rules_proto", version = "5.3.0-21.7")
+    #bazel_dep(name = "rules_jvm_external", version = "5.2")
+    #bazel_dep(name = "rules_python", version = "0.24.0")
+    #bazel_dep(name = "rules_testing", version = "0.0.4")
+  '';
 
   WORKSPACE = writeText "WORKSPACE" ''
     workspace(name = "our_workspace")
 
-    load("//:proto-support.bzl", "protobuf_deps")
-    protobuf_deps()
-    load("@rules_proto//proto:repositories.bzl", "rules_proto_toolchains")
-    rules_proto_toolchains()
-    '';
-
-  protoSupport = writeText "proto-support.bzl" ''
-    """Load dependencies needed to compile the protobuf library as a 3rd-party consumer."""
-
     load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-    def protobuf_deps():
-        """Loads common dependencies needed to compile the protobuf library."""
-
-        if "zlib" not in native.existing_rules():
-            # proto_library, cc_proto_library, and java_proto_library rules implicitly
-            # depend on @com_google_protobuf for protoc and proto runtimes.
-            # This statement defines the @com_google_protobuf repo.
-            native.local_repository(
-                name = "com_google_protobuf",
-                path = "${com_google_protobuf}",
-            )
-            native.local_repository(
-                name = "bazel_skylib",
-                path = "${bazel_skylib}",
-            )
-            native.local_repository(
-                name = "rules_proto",
-                path = "${rules_proto}",
-            )
-            native.local_repository(
-                name = "rules_python",
-                path = "${rules_python}",
-            )
-
-            http_archive(
-                name = "zlib",
-                build_file = "@com_google_protobuf//:third_party/zlib.BUILD",
-                sha256 = "${net_zlib.sha256}",
-                strip_prefix = "zlib-1.2.11",
-                urls = ["file://${net_zlib}"],
-            )
+    http_archive(
+        name = "rules_proto",
+        sha256 = "dc3fb206a2cb3441b485eb1e423165b231235a1ea9b031b4433cf7bc1fa460dd",
+        strip_prefix = "rules_proto-5.3.0-21.7",
+        urls = [
+            "https://github.com/bazelbuild/rules_proto/archive/refs/tags/5.3.0-21.7.tar.gz",
+        ],
+    )
+    load("@rules_proto//proto:repositories.bzl", "rules_proto_dependencies", "rules_proto_toolchains")
+    rules_proto_dependencies()
+    rules_proto_toolchains()
   '';
 
   personProto = writeText "person.proto" ''
···
     exec "$BAZEL_REAL" "$@"
   '';
 
-  workspaceDir = runLocal "our_workspace" {} (''
+  workspaceDir = runLocal "our_workspace" { } (''
     mkdir $out
+    cp ${MODULE} $out/MODULE.bazel
+    cp ${lockfile} $out/MODULE.bazel.lock
     cp ${WORKSPACE} $out/WORKSPACE
     touch $out/BUILD.bazel
-    cp ${protoSupport} $out/proto-support.bzl
     mkdir $out/person
     cp ${personProto} $out/person/person.proto
     cp ${personBUILD} $out/person/BUILD.bazel
···
     bazelScript = ''
       ${bazel}/bin/bazel \
         build \
-        --distdir=${distDir} \
         --verbose_failures \
         --curses=no \
         --sandbox_debug \
         --strict_java_deps=off \
         --strict_proto_deps=off \
+        ${extraBazelArgs} \
         //... \
     '' + lib.optionalString (lib.strings.versionOlder bazel.version "5.0.0") ''
-        --host_javabase='@local_jdk//:jdk' \
-        --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
-        --javabase='@local_jdk//:jdk' \
+      --host_javabase='@local_jdk//:jdk' \
+      --java_toolchain='@bazel_tools//tools/jdk:toolchain_hostjdk8' \
+      --javabase='@local_jdk//:jdk' \
     '' + lib.optionalString (stdenv.isDarwin) ''
-        --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
-        --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
+      --cxxopt=-x --cxxopt=c++ --host_cxxopt=-x --host_cxxopt=c++ \
+      --linkopt=-stdlib=libc++ --host_linkopt=-stdlib=libc++ \
     '';
   };
 
-in testBazel
+in
+testBazel

pkgs/development/tools/build-managers/bazel/python-bin-path-test.nix

···
 , bazelTest
 , stdenv
 , darwin
+, extraBazelArgs ? ""
 , lib
 , runLocal
 , runtimeShell
···
     bazelScript = ''
       ${bazel}/bin/bazel \
         run \
-        --distdir=${distDir} \
+        --repository_cache=${distDir} \
+        ${extraBazelArgs} \
         //python:bin
     '';
   };

pkgs/development/tools/build-managers/bazel/shebang-test.nix

···
 {
   bazel
 , bazelTest
-, distDir
 , extracted
+, ripgrep
 , runLocal
 , unzip
+, ...
 }:
 
 # Tests that all shebangs are patched appropriately.
···
     bazelPkg = bazel;
     bazelScript = ''
       set -ueo pipefail
+
       FAIL=
       check_shebangs() {
         local dir="$1"
-        { grep -Re '#!/usr/bin' $dir && FAIL=1; } || true
-        { grep -Re '#![^[:space:]]*/bin/env' $dir && FAIL=1; } || true
+        { rg -e '#!/usr/bin' -e '#![^[:space:]]*/bin/env' $dir -e && echo && FAIL=1; } || true
       }
-      BAZEL_EXTRACTED=${extracted bazel}/install
-      check_shebangs $BAZEL_EXTRACTED
-      while IFS= read -r -d "" zip; do
-        unzipped="./$zip/UNPACKED"
-        mkdir -p "$unzipped"
-        unzip -qq $zip -d "$unzipped"
-        check_shebangs "$unzipped"
-        rm -rf unzipped
-      done < <(find $BAZEL_EXTRACTED -type f -name '*.zip' -or -name '*.jar' -print0)
+      extract() {
+        local dir="$1"
+        find "$dir" -type f '(' -name '*.zip' -or -name '*.jar' ')' -print0 \
+        | while IFS="" read -r -d "" zip ; do
+          echo "Extracting $zip"
+          local unzipped="$zip-UNPACKED"
+          mkdir -p "$unzipped"
+          unzip -qq $zip -d "$unzipped"
+          extract "$unzipped"
+          rm -rf "$unzipped" "$zip" || true
+        done
+        check_shebangs "$dir"
+      }
+
+      mkdir install_root
+      cp --no-preserve=all -r ${extracted bazel}/install/*/* install_root/
+      extract ./install_root
+
       if [[ $FAIL = 1 ]]; then
         echo "Found files in the bazel distribution with illegal shebangs." >&2
         echo "Replace those by explicit Nix store paths." >&2
···
         exit 1
       fi
     '';
-    buildInputs = [ unzip ];
+    buildInputs = [ unzip ripgrep ];
   };
 
 in testBazel

pkgs/top-level/all-packages.nix

···
     bazel_self = bazel_6;
   };
 
+  bazel_7 = darwin.apple_sdk_11_0.callPackage ../development/tools/build-managers/bazel/bazel_7 {
+    inherit (darwin) cctools sigtool;
+    inherit (darwin.apple_sdk_11_0.frameworks) CoreFoundation CoreServices Foundation IOKit;
+    buildJdk = jdk11_headless;
+    runJdk = jdk17_headless;
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv
+      else if stdenv.cc.isClang then llvmPackages.stdenv
+      else stdenv;
+    bazel_self = bazel_7;
+  };
+
   bazel-buildtools = callPackage ../development/tools/build-managers/bazel/buildtools { };
   buildifier = bazel-buildtools;
   buildozer = bazel-buildtools;