envoy: 1.33.0 -> 1.34.0 (#399369)

pkgs/by-name/en/envoy/0001-nixpkgs-use-system-Python.patch

···
 Subject: [PATCH] nixpkgs: use system Python
 
 Signed-off-by: Paul Meyer <[e-mail]>
+Signed-off-by: Luke Granger-Brown <[e-mail]>
 ---
  bazel/python_dependencies.bzl |  9 ++++-----
  bazel/repositories_extra.bzl  | 17 +----------------

pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch

···
 Subject: [PATCH] nixpkgs: use system Go
 
 Signed-off-by: Paul Meyer <[e-mail]>
+Signed-off-by: Luke Granger-Brown <[e-mail]>
 ---
  bazel/dependency_imports.bzl | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index c68eb4bf3ed2d39d46d38d7bd0eeab2c74a507fa..addee4f6af74ea78ae778b73384e01db83ac6694 100644
+index aef33aa103dc1136e63e165fb9ee6a267f52ba54..c5aefca14b729b548c4e90857202eb82576b507d 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -20,7 +20,7 @@ load("@rules_rust//rust:defs.bzl", "rust_common")
+@@ -22,7 +22,7 @@ load("@rules_rust//rust:defs.bzl", "rust_common")
  load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_register_toolchains", "rust_repository_set")
  
  # go version for rules_go

pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch

···
 Subject: [PATCH] nixpkgs: use system C/C++ toolchains
 
 Signed-off-by: Paul Meyer <[e-mail]>
+Signed-off-by: Luke Granger-Brown <[e-mail]>
 ---
  bazel/dependency_imports.bzl | 6 +++++-
  1 file changed, 5 insertions(+), 1 deletion(-)
 
 diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index addee4f6af74ea78ae778b73384e01db83ac6694..dc1967e43b2b71358d2767a3d83b52819987290d 100644
+index c5aefca14b729b548c4e90857202eb82576b507d..6938ce63abb53661e8d1fb71eaaab03ba0cc37c6 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -26,7 +26,11 @@ JQ_VERSION = "1.7"
- YQ_VERSION = "4.24.4"
+@@ -30,7 +30,11 @@ YQ_VERSION = "4.24.4"
+ BUF_VERSION = "v1.50.0"
  
- def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, yq_version = YQ_VERSION):
+ def envoy_dependency_imports(go_version = GO_VERSION, jq_version = JQ_VERSION, yq_version = YQ_VERSION, buf_version = BUF_VERSION):
 -    rules_foreign_cc_dependencies()
 +    rules_foreign_cc_dependencies(
 +        register_default_tools=False,  # no prebuilt toolchains

pkgs/by-name/en/envoy/0004-nixpkgs-bump-rules_rust-to-0.60.0.patch

···
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Luke Granger-Brown <[e-mail]>
+Date: Thu, 17 Apr 2025 02:40:18 +0100
+Subject: [PATCH] nixpkgs: bump rules_rust to 0.60.0
+
+Signed-off-by: Luke Granger-Brown <[e-mail]>
+---
+ bazel/repository_locations.bzl | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
+index 6904bc93bdda3ee2308f13d61e62295fa11d799b..e4574878a566cceb4dc2343f3cade0350ea5e5ff 100644
+--- a/bazel/repository_locations.bzl
++++ b/bazel/repository_locations.bzl
+@@ -1465,8 +1465,8 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+         project_name = "Bazel rust rules",
+         project_desc = "Bazel rust rules (used by Wasm)",
+         project_url = "https://github.com/bazelbuild/rules_rust",
+-        version = "0.56.0",
+-        sha256 = "f1306aac0b258b790df01ad9abc6abb0df0b65416c74b4ef27f4aab298780a64",
++        version = "0.60.0",
++        sha256 = "7825214ccad7c2482cb490ac91dbc1e88b30223062796ce328aca893b74ae342",
+         # Note: rules_rust should point to the releases, not archive to avoid the hassle of bootstrapping in crate_universe.
+         # This is described in https://bazelbuild.github.io/rules_rust/crate_universe.html#setup, otherwise bootstrap
+         # is required which in turn requires a system CC toolchains, not the bazel controlled ones.
+@@ -1477,7 +1477,7 @@ REPOSITORY_LOCATIONS_SPEC = dict(
+             "dataplane_ext",
+         ],
+         extensions = ["envoy.wasm.runtime.wasmtime"],
+-        release_date = "2024-12-16",
++        release_date = "2025-04-08",
+         cpe = "N/A",
+         license = "Apache-2.0",
+         license_url = "https://github.com/bazelbuild/rules_rust/blob/{version}/LICENSE.txt",

pkgs/by-name/en/envoy/package.nix

···
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.33.0";
-    rev = "b0f43d67aa25c1b03c97186a200cc187f4c22db3";
-    hash = "sha256-zqekRpOlaA2IrwwFUEwASa1uokET98h5sr7EwzWgcbU=";
+    version = "1.34.0";
+    rev = "d7809ba2b07fd869d49bfb122b27f6a7977b4d94";
+    hash = "sha256-SKdUrBXe0E3fMo73NROFO9Ck5FZidF/awP+QRA5t3VM=";
   };
 
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "sha256-4CQkHlXbDpRiqzeyserVf9PpLx3ME7TtZ2H88ggog6U=";
-      aarch64-linux = "sha256-FxkfBWiG0NIInl28w+l4YvaV2VFuCtjn5VBAKvJoxM8=";
+      x86_64-linux = "sha256-CiP9qH8/+nNZM8BNz84eVwWphVyDNo2KOYcK0wOsXn0=";
+      aarch64-linux = "sha256-9HGg68R546JY1EOm22tg9CuPt0nU+FooFcLG9A2hkzE=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
···
       repo = "envoy";
       inherit (srcVer) hash rev;
     };
+    # By convention, these patches are generated like:
+    # git format-patch --zero-commit --signoff --no-numbered --minimal --full-index --no-signature
     patches = [
       # use system Python, not bazel-fetched binary Python
       ./0001-nixpkgs-use-system-Python.patch
···
 
       # use system C/C++ tools
       ./0003-nixpkgs-use-system-C-C-toolchains.patch
+
+      # bump rules_rust to support newer Rust
+      ./0004-nixpkgs-bump-rules_rust-to-0.60.0.patch
     ];
     postPatch = ''
       chmod -R +w .
···
     substituteInPlace bazel/dependency_imports.bzl \
       --replace-fail 'crate_universe_dependencies()' 'crate_universe_dependencies(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc")' \
       --replace-fail 'crates_repository(' 'crates_repository(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc",'
+
+    # patch rules_rust for envoy specifics, but also to support old Bazel
+    # (Bazel 6 doesn't have ctx.watch, but ctx.path is sufficient for our use)
+    cp ${./rules_rust.patch} bazel/rules_rust.patch
+    substituteInPlace bazel/repositories.bzl \
+      --replace-fail ', "@envoy//bazel:rules_rust_ppc64le.patch"' ""
 
     substitute ${./rules_rust_extra.patch} bazel/nix/rules_rust_extra.patch \
       --subst-var-by bash "$(type -p bash)"
···
       sed -i \
         -e 's,${python3},__NIXPYTHON__,' \
         -e 's,${stdenv.shellPackage},__NIXSHELL__,' \
+        -e 's,${builtins.storeDir}/[^/]\+/bin/bash,__NIXBASH__,' \
         $bazelOut/external/com_github_luajit_luajit/build.py \
         $bazelOut/external/local_config_sh/BUILD \
         $bazelOut/external/*_pip3/BUILD.bazel \
···
       sed -i \
         -e 's,__NIXPYTHON__,${python3},' \
         -e 's,__NIXSHELL__,${stdenv.shellPackage},' \
+        -e 's,__NIXBASH__,${stdenv.shell},' \
         $bazelOut/external/com_github_luajit_luajit/build.py \
         $bazelOut/external/local_config_sh/BUILD \
-        $bazelOut/external/*_pip3/BUILD.bazel
+        $bazelOut/external/*_pip3/BUILD.bazel \
+        $bazelOut/external/rules_rust/util/process_wrapper/private/process_wrapper.sh \
+        $bazelOut/external/rules_rust/crate_universe/src/metadata/cargo_tree_rustc_wrapper.sh
 
       # Install repinned rules_rust lockfile
       cp $bazelOut/external/Cargo.Bazel.lock source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock

pkgs/by-name/en/envoy/rules_rust.patch

···
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Luke Granger-Brown <[e-mail]>
+Date: Thu, 17 Apr 2025 02:44:24 +0100
+Subject: [PATCH] rules_rust base
+
+Signed-off-by: Luke Granger-Brown <[e-mail]>
+---
+ cargo/private/cargo_bootstrap.bzl |  8 ++++----
+ crate_universe/extensions.bzl     | 10 +++++-----
+ crate_universe/src/lockfile.rs    |  4 ++--
+ rust/private/rustc.bzl            |  4 ++--
+ 4 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git cargo/private/cargo_bootstrap.bzl cargo/private/cargo_bootstrap.bzl
+index a8021c49d62037ef32c7c64d5bb4a5efe3a8b4aa..f63d7c23ae0bddc9f3fece347a3a2b5b0afe6d8d 100644
+--- cargo/private/cargo_bootstrap.bzl
++++ cargo/private/cargo_bootstrap.bzl
+@@ -173,13 +173,13 @@ def _detect_changes(repository_ctx):
+     # 'consumed' which means changes to it will trigger rebuilds
+ 
+     for src in repository_ctx.attr.srcs:
+-        repository_ctx.watch(src)
++        repository_ctx.path(src)
+ 
+-    repository_ctx.watch(repository_ctx.attr.cargo_lockfile)
+-    repository_ctx.watch(repository_ctx.attr.cargo_toml)
++    repository_ctx.path(repository_ctx.attr.cargo_lockfile)
++    repository_ctx.path(repository_ctx.attr.cargo_toml)
+ 
+     if repository_ctx.attr.cargo_config:
+-        repository_ctx.watch(repository_ctx.attr.cargo_config)
++        repository_ctx.path(repository_ctx.attr.cargo_config)
+ 
+ def _cargo_bootstrap_repository_impl(repository_ctx):
+     # Pretend to Bazel that this rule's input files have been used, so that it will re-run the rule if they change.
+diff --git crate_universe/extensions.bzl crate_universe/extensions.bzl
+index a749b10c8d469bd316d78034059c94b1fd98dbef..8f8c84dac1ec330d5e8e6abbd930387cb6c9f29e 100644
+--- crate_universe/extensions.bzl
++++ crate_universe/extensions.bzl
+@@ -957,17 +957,17 @@ def _crate_impl(module_ctx):
+                 fail("Spec specified for repo {}, but the module defined repositories {}".format(repo, local_repos))
+ 
+         for cfg in mod.tags.from_cargo + mod.tags.from_specs:
+-            # Preload all external repositories. Calling `module_ctx.watch` will cause restarts of the implementation
++            # Preload all external repositories. Calling `module_ctx.path` will cause restarts of the implementation
+             # function of the module extension when the file has changed.
+             if cfg.cargo_lockfile:
+-                module_ctx.watch(cfg.cargo_lockfile)
++                module_ctx.path(cfg.cargo_lockfile)
+             if cfg.lockfile:
+-                module_ctx.watch(cfg.lockfile)
++                module_ctx.path(cfg.lockfile)
+             if cfg.cargo_config:
+-                module_ctx.watch(cfg.cargo_config)
++                module_ctx.path(cfg.cargo_config)
+             if hasattr(cfg, "manifests"):
+                 for m in cfg.manifests:
+-                    module_ctx.watch(m)
++                    module_ctx.path(m)
+ 
+             cargo_path, rustc_path = _get_host_cargo_rustc(module_ctx, host_triple, cfg.host_tools_repo)
+             cargo_bazel_fn = new_cargo_bazel_fn(
+diff --git crate_universe/src/lockfile.rs crate_universe/src/lockfile.rs
+index 3e0ce6265fda6fbdd9e3e989e3e4e4443b615b8c..0fafcea8fbc7a590676d34d2c4ca8c413b953955 100644
+--- crate_universe/src/lockfile.rs
++++ crate_universe/src/lockfile.rs
+@@ -146,10 +146,10 @@ impl Digest {
+         ));
+         hasher.update(b"\0");
+ 
+-        hasher.update(Digest::compute_single_hash(cargo_version, "Cargo version"));
++        hasher.update(Digest::compute_single_hash("hermetic", "Cargo version"));
+         hasher.update(b"\0");
+ 
+-        hasher.update(Digest::compute_single_hash(rustc_version, "Rustc version"));
++        hasher.update(Digest::compute_single_hash("hermetic", "Rustc version"));
+         hasher.update(b"\0");
+ 
+         let hash = hasher.finalize().encode_hex::<String>();
+diff --git rust/private/rustc.bzl rust/private/rustc.bzl
+index d78c28902c8f73ae655b8f6b5df3db5a1805aa19..321a24a946c33d5e3452758a72a77b52d5a3eccf 100644
+--- rust/private/rustc.bzl
++++ rust/private/rustc.bzl
+@@ -1059,7 +1059,7 @@ def construct_arguments(
+ 
+     if toolchain.llvm_cov and ctx.configuration.coverage_enabled:
+         # https://doc.rust-lang.org/rustc/instrument-coverage.html
+-        rustc_flags.add("--codegen=instrument-coverage")
++        pass
+ 
+     if toolchain._experimental_link_std_dylib:
+         rustc_flags.add("--codegen=prefer-dynamic")
+@@ -1563,7 +1563,7 @@ def rustc_compile_action(
+         })
+         crate_info = rust_common.create_crate_info(**crate_info_dict)
+ 
+-    if crate_info.type in ["staticlib", "cdylib"]:
++    if crate_info.type in ["staticlib", "cdylib"] and not out_binary:
+         # These rules are not supposed to be depended on by other rust targets, and
+         # as such they shouldn't provide a CrateInfo. However, one may still want to
+         # write a rust_test for them, so we provide the CrateInfo wrapped in a provider