envoy: fix up Rust

Envoy 1.32 has added some more dependencies on rules_rust bits, so we
need to support that now.

In particular, for some reason, we always fail with a message about
needing repinning, so we repin during the IFD phase, but we need to
point rules_rust at the nixpkgs Rust toolchain, make it build the
cargo-bazel tool (because the one in nixpkgs is the wrong version), and
then clean up afterwards.

pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel

···
+load("@bazel_tools//tools/sh:sh_toolchain.bzl", "sh_toolchain")
+load("@rules_rust//rust:toolchain.bzl", "rust_toolchain")
+
+toolchains = {
+    "x86_64": "x86_64-unknown-linux-gnu",
+    "aarch64": "aarch64-unknown-linux-gnu",
+}
+
+exports_files(["cargo", "rustdoc", "ruststd", "rustc"])
+
+[
+    rust_toolchain(
+        name = "rust_nix_" + k + "_impl",
+        binary_ext = "",
+        dylib_ext = ".so",
+        exec_triple = v,
+        cargo = ":cargo",
+        rust_doc = ":rustdoc",
+        rust_std = ":ruststd",
+        rustc = ":rustc",
+        stdlib_linkflags = ["-ldl", "-lpthread"],
+        staticlib_ext = ".a",
+        target_triple = v,
+    )
+    for k, v in toolchains.items()
+]
+
+[
+    toolchain(
+        name = "rust_nix_" + k,
+        exec_compatible_with = [
+            "@platforms//cpu:" + k,
+            "@platforms//os:linux",
+        ],
+        target_compatible_with = [
+            "@platforms//cpu:" + k,
+            "@platforms//os:linux",
+        ],
+        toolchain = ":rust_nix_" + k + "_impl",
+        toolchain_type = "@rules_rust//rust:toolchain_type",
+    )
+    for k in toolchains.keys()
+]
+
+sh_toolchain(
+    name = "local_sh_impl",
+    path = "@bash@",
+)
+
+toolchain(
+    name = "local_sh",
+    toolchain = ":local_sh_impl",
+    toolchain_type = "@bazel_tools//tools/sh:toolchain_type",
+)

pkgs/by-name/en/envoy/package.nix

···
   buildBazelPackage,
   fetchFromGitHub,
   stdenv,
+  cacert,
+  cargo,
+  rustc,
+  rustPlatform,
   cmake,
   gn,
   go,
···
   # these need to be updated for any changes to fetchAttrs
   depsHash =
     {
-      x86_64-linux = "";
-      aarch64-linux = "";
+      x86_64-linux = "sha256-LkDNPFT7UUCsGPG1dMnwzdIw0lzc5+3JYDoblF5oZVk=";
+      aarch64-linux = "sha256-DkibjmY1YND9Q2aQ41bhNdch0SKM5ghY2mjYSQfV30M=";
     }
     .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 in
-buildBazelPackage {
+buildBazelPackage rec {
   pname = "envoy";
   inherit (srcVer) version;
   bazel = bazel_6;
···
     sed -i 's,#!/usr/bin/env python3,#!${python3}/bin/python,' bazel/foreign_cc/luajit.patch
     sed -i '/javabase=/d' .bazelrc
     sed -i '/"-Werror"/d' bazel/envoy_internal.bzl
+
+    mkdir -p bazel/nix/
+    substitute ${./bazel_nix.BUILD.bazel} bazel/nix/BUILD.bazel \
+      --subst-var-by bash "$(type -p bash)"
+    ln -sf "${cargo}/bin/cargo" bazel/nix/cargo
+    ln -sf "${rustc}/bin/rustc" bazel/nix/rustc
+    ln -sf "${rustc}/bin/rustdoc" bazel/nix/rustdoc
+    ln -sf "${rustPlatform.rustLibSrc}" bazel/nix/ruststd
+    substituteInPlace bazel/dependency_imports.bzl \
+      --replace-fail 'crate_universe_dependencies()' 'crate_universe_dependencies(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc")' \
+      --replace-fail 'crates_repository(' 'crates_repository(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc",'
+
+    substitute ${./rules_rust_extra.patch} bazel/nix/rules_rust_extra.patch \
+      --subst-var-by bash "$(type -p bash)"
+    cat bazel/nix/rules_rust_extra.patch bazel/rules_rust.patch > bazel/nix/rules_rust.patch
+    mv bazel/nix/rules_rust.patch bazel/rules_rust.patch
   '';
 
   patches = [
···
     jdk
     ninja
     patchelf
+    cacert
   ];
 
   buildInputs = [ linuxHeaders ];
 
   fetchAttrs = {
     sha256 = depsHash;
+    env.CARGO_BAZEL_REPIN = true;
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
+    postPatch = ''
+      ${postPatch}
+
+      substituteInPlace bazel/dependency_imports.bzl \
+        --replace-fail 'crate_universe_dependencies(' 'crate_universe_dependencies(bootstrap=True, ' \
+        --replace-fail 'crates_repository(' 'crates_repository(generator="@@cargo_bazel_bootstrap//:cargo-bazel", '
+    '';
     preInstall = ''
       # Strip out the path to the build location (by deleting the comment line).
       find $bazelOut/external -name requirements.bzl | while read requirements; do
···
 
       # fix tcmalloc failure https://github.com/envoyproxy/envoy/issues/30838
       sed -i '/TCMALLOC_GCC_FLAGS = \[/a"-Wno-changes-meaning",' $bazelOut/external/com_github_google_tcmalloc/tcmalloc/copts.bzl
+
+      # Install repinned rules_rust lockfile
+      cp source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock $bazelOut/external/Cargo.Bazel.lock
+
+      # Don't save cargo_bazel_bootstrap or the crate index cache
+      rm -rf $bazelOut/external/cargo_bazel_bootstrap $bazelOut/external/dynamic_modules_rust_sdk_crate_index/.cargo_home $bazelOut/external/dynamic_modules_rust_sdk_crate_index/splicing-output
     '';
   };
   buildAttrs = {
···
         file "$execbin" | grep -q ': ELF .*, dynamically linked,' || continue
         patchelf \
           --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
-          "$execbin"
+          "$execbin" || echo "$execbin"
       done
 
       ln -s ${bazel-gazelle}/bin $bazelOut/external/bazel_gazelle_go_repository_tools/bin
···
         $bazelOut/external/com_github_luajit_luajit/build.py \
         $bazelOut/external/local_config_sh/BUILD \
         $bazelOut/external/*_pip3/BUILD.bazel
+
+      # Install repinned rules_rust lockfile
+      cp $bazelOut/external/Cargo.Bazel.lock source/extensions/dynamic_modules/sdk/rust/Cargo.Bazel.lock
     '';
     installPhase = ''
       install -Dm0755 bazel-bin/source/exe/envoy-static $out/bin/envoy
···
       "--java_runtime_version=local_jdk"
       "--tool_java_runtime_version=local_jdk"
 
+      # Force use of system Rust.
+      "--extra_toolchains=//bazel/nix:rust_nix_aarch64,//bazel/nix:rust_nix_x86_64"
+
       # undefined reference to 'grpc_core::*Metadata*::*Memento*
       #
       # During linking of the final binary, we see undefined references to grpc_core related symbols.
···
 
   bazelFetchFlags = [
     "--define=wasm=${wasmRuntime}"
+
+    # Force use of system Rust.
+    "--extra_toolchains=//bazel/nix:rust_nix_aarch64,//bazel/nix:rust_nix_x86_64"
 
     # https://github.com/bazelbuild/rules_go/issues/3844
     "--repo_env=GOPROXY=https://proxy.golang.org,direct"

pkgs/by-name/en/envoy/rules_rust_extra.patch

···
+--- crate_universe/src/metadata/cargo_tree_rustc_wrapper.sh
++++ crate_universe/src/metadata/cargo_tree_rustc_wrapper.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
++#!@bash@
+ #
+ # For details, see:
+ # `@rules_rust//crate_universe/src/metadata/cargo_tree_resolver.rs - TreeResolver::create_rustc_wrapper`
+
+--- util/process_wrapper/private/process_wrapper.sh
++++ util/process_wrapper/private/process_wrapper.sh
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env bash
++#!@bash@
+ 
+ set -euo pipefail
+ 
+