Replace `git_sha_rewriter.py` with a generated linker option. #3021

jmillikin-stripe · 2018-04-06T22:49:49Z

Description:
This replaces Envoy's use of a Python script to poke at raw ELF headers with a generated --build-id linker flag, following the example of @oquenchil in #2625.

Note: this means the //source/exe:envoy-static target is now stamped, instead of having a separate implicit envoy-static_stamped target.

I also edited the workspace status command so it treated the Git commit ID as "stable" instead of "volatile", so Bazel won't ignore it when relinking.

Risk Level: Low

Testing:
Tested locally on a MacOS and Linux build. Both of them have the current Git commit ID embedded in the expected binary sections.

Fixes #2551
Fixes #2625

mattklein123 · 2018-04-08T18:21:35Z

Approach at a high level LGTM. Assigning to @htuch for review. @jmillikin-stripe looks like there are still some CI issues.

htuch

This is awesome @jmillikin-stripe, nice to see this landing.

htuch · 2018-04-09T00:55:58Z

bazel/BUILD

+    outs = ["gnu_build_id.ldscript"],
+    cmd = """
+      echo --build-id=0x$$(
+          grep STABLE_BUILD_SCM_REVISION bazel-out/stable-status.txt \\


How does this work when Envoy is used as a dependency in another project to assemble a binary? Are there any issues with relative paths? Can you validate with envoy-filter-example?

I don't fully understand how the build-id feature is being used now, so I don't know what the desired behavior is when building from a higher-level repo.

Do you want the build ID to be Envoy's commit ID, or the commit ID of the root workspace? What if it's not being built from a Git repo -- should we make the build ID empty, or leave the flag unset, or ...?

@mattklein123 or other Lyfters will have to answer this one, as they have a similar setup to envoy-filter-example and use this for production build stamping.

I think right now it's the SHA of the envoy repo. Optimally, it would be the SHA of the owning repo, but whatever is fine with us as long as we have something.

I've tweaked this a bit so it'll always use BUILD_SCM_REVISION, which should be compatible with most/all external repos. This means the decision to relink on a Git status change will be left up to the root workspace.

htuch · 2018-04-09T00:58:48Z

source/common/common/version_linkstamp.cc

@@ -2,5 +2,5 @@
 extern const char build_scm_revision[];
 extern const char build_scm_status[];

-const char build_scm_revision[] = BUILD_SCM_REVISION;
-const char build_scm_status[] = BUILD_SCM_STATUS;
+const char build_scm_revision[] = STABLE_BUILD_SCM_REVISION;


Curious if you think we can add a test to avoid regressions such as #2551?

Not that I know of. Maybe we could hack something together in CI to add a fake empty commit, relink, and run envoy --version? Seems kinda fragile.

FYI: I reverted changes to this file so we don't need to rename SCM status keys in everything that might build Envoy as a dependency.

htuch · 2018-04-09T01:00:19Z

bazel/BUILD

+        | sed 's/^STABLE_BUILD_SCM_REVISION //') \\
+        > $@
+    """,
+    stamp = 1,


What is stamp doing here and in the other genrules? I can't see much in the way of docs for genrule+stamp?

stamp=1 gives the rule access to the bazel-out/stable-status.txt and bazel-out/volatile-status.txt files. It also makes the genrule depend directly on the stable status, so it'll re-run if the status changes.

The param is undocumented :( : bazelbuild/bazel#4942

htuch · 2018-04-09T01:01:29Z

bazel/envoy_build_system.bzl

+        "-sectcreate,__TEXT,__build_id", "$(location //bazel:raw_build_id.ldscript)"
+    ],
+    "//conditions:default": [
+        "-Wl,@$(location //bazel:gnu_build_id.ldscript)",


Wondering if this needs to be @envoy//bazel... or similar in the envoy-filter-example scenario.

I successfully built envoy-filter-example pointing to an Envoy src dir with my changes, and it has the correct build ID.

jmillikin-stripe · 2018-04-09T18:15:29Z

Out of curiosity, how was the --build-id flag chosen as the storage for this info? One problem I hit was trying to represent non-Git builds, which have some arbitrary string as the "SCM version" instead of a Git commit ID.

It might make more sense to leave this flag alone and try to embed the version info as normal symbols.

mattklein123 · 2018-04-09T18:55:10Z

Out of curiosity, how was the --build-id flag chosen as the storage for this info? One problem I hit was trying to represent non-Git builds, which have some arbitrary string as the "SCM version" instead of a Git commit ID.

This is how I've always done it in the past. It gets embedded in core dumps, etc. and is easily accessible using normal tools. If there is a different way we can potentially change, but the main requirement is easily accessible in core dumps.

htuch · 2018-04-23T11:18:18Z

@jmillikin-stripe friendly ping on this one.

Fixes envoyproxy#2551 uses genrule workaround for missing STABLE_ keys in cc linkstamp, more details at bazelbuild/bazel#1992 Signed-off-by: John Millikin <jmillikin@stripe.com>

Fixes envoyproxy#2625 Signed-off-by: John Millikin <jmillikin@stripe.com>

Signed-off-by: John Millikin <jmillikin@stripe.com>

jmillikin-stripe · 2018-04-23T16:28:52Z

Sorry for the delay, got nerdsniped into a non-Envoy project last week. Comments addressed.

htuch

LGTM modulo one nit comment.

htuch · 2018-04-23T18:19:33Z

bazel/BUILD

+        | sed 's/^BUILD_SCM_REVISION //') \\
+        > $@
+    """,
+    stamp = 1,


Can you leave a comment on the undocumented stamp semantics and the link the GH issue? I feel this will be useful when later revisiting these rules.

Signed-off-by: John Millikin <jmillikin@stripe.com>

mattklein123 · 2018-04-23T21:07:20Z

@jmillikin-stripe can you push an empty commit now that DCO bot is fixed?

Signed-off-by: John Millikin <jmillikin@stripe.com>

jrajahalme · 2018-04-23T22:15:39Z

Thanks!

I tested envoyproxy#3021 with envoy-filter-example to verify it works for non-default workspace roots, but didn't realize the filter example's envoy binary is built without linkstamping so the testing was worthless. Experimental evidence is that the `deps` field needs `@envoy` but the linker options are fine without it. I don't understand why this would be true so I'm going to put `@envoy` in both places. Signed-off-by: John Millikin <jmillikin@stripe.com>

I tested #3021 with envoy-filter-example to verify it works for non-default workspace roots, but didn't realize the filter example's envoy binary is built without linkstamping so the testing was worthless. Experimental evidence is that the `deps` field needs `@envoy` but the linker options are fine without it. I don't understand why this would be true so I'm going to put `@envoy` in both places. Signed-off-by: John Millikin <jmillikin@stripe.com>

jmillikin-stripe force-pushed the rm-git-sha-rewriter branch 2 times, most recently from 809af57 to 43dcd4a Compare April 7, 2018 03:12

mattklein123 assigned htuch Apr 8, 2018

htuch requested changes Apr 9, 2018

View reviewed changes

dnoe assigned mattklein123 Apr 9, 2018

Mark BUILD_SCM_REVISION as stable so Bazel will always relink with it.

01a6af7

Fixes envoyproxy#2551 uses genrule workaround for missing STABLE_ keys in cc linkstamp, more details at bazelbuild/bazel#1992 Signed-off-by: John Millikin <jmillikin@stripe.com>

jmillikin-stripe force-pushed the rm-git-sha-rewriter branch from 43dcd4a to 5975ae6 Compare April 23, 2018 15:27

jmillikin-stripe added 2 commits April 23, 2018 09:16

Replace git_sha_rewriter.py with a generated linker option.

ebf681f

Fixes envoyproxy#2625 Signed-off-by: John Millikin <jmillikin@stripe.com>

Disable build ID handling in coverage mode due to gold internal error.

786acc7

Signed-off-by: John Millikin <jmillikin@stripe.com>

jmillikin-stripe force-pushed the rm-git-sha-rewriter branch from 5975ae6 to 786acc7 Compare April 23, 2018 16:16

htuch reviewed Apr 23, 2018

View reviewed changes

Add comments about undocumented genrule.stamp attr.

ae6cf33

Signed-off-by: John Millikin <jmillikin@stripe.com>

htuch approved these changes Apr 23, 2018

View reviewed changes

caniszczyk mentioned this pull request Apr 23, 2018

DCO bot is stuck in "waiting for status reported" dcoapp/app#69

Closed

empty commit to poke DCO bot

37361de

Signed-off-by: John Millikin <jmillikin@stripe.com>

mattklein123 approved these changes Apr 23, 2018

View reviewed changes

mattklein123 merged commit b3bc488 into envoyproxy:master Apr 23, 2018

jmillikin-stripe deleted the rm-git-sha-rewriter branch April 23, 2018 22:08

jmillikin-stripe mentioned this pull request Apr 23, 2018

Adding missing @bazel prefixes that dependencies need. #3175

Merged

htuch mentioned this pull request Oct 11, 2018

bazel/README.md references "envoy-static.stripped.stamped" which doesn't exist #4695

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace `git_sha_rewriter.py` with a generated linker option. #3021

Replace `git_sha_rewriter.py` with a generated linker option. #3021

jmillikin-stripe commented Apr 6, 2018

mattklein123 commented Apr 8, 2018

htuch left a comment

htuch Apr 9, 2018

jmillikin-stripe Apr 9, 2018

htuch Apr 9, 2018

mattklein123 Apr 9, 2018

jmillikin-stripe Apr 23, 2018

htuch Apr 9, 2018

jmillikin-stripe Apr 9, 2018

jmillikin-stripe Apr 23, 2018

htuch Apr 9, 2018

jmillikin-stripe Apr 23, 2018

htuch Apr 9, 2018

jmillikin-stripe Apr 23, 2018

jmillikin-stripe commented Apr 9, 2018

mattklein123 commented Apr 9, 2018

htuch commented Apr 23, 2018

jmillikin-stripe commented Apr 23, 2018

htuch left a comment

htuch Apr 23, 2018

jmillikin-stripe Apr 23, 2018

mattklein123 commented Apr 23, 2018

jrajahalme commented Apr 23, 2018

Replace git_sha_rewriter.py with a generated linker option. #3021

Replace git_sha_rewriter.py with a generated linker option. #3021

Conversation

jmillikin-stripe commented Apr 6, 2018

mattklein123 commented Apr 8, 2018

htuch left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jmillikin-stripe commented Apr 9, 2018

mattklein123 commented Apr 9, 2018

htuch commented Apr 23, 2018

jmillikin-stripe commented Apr 23, 2018

htuch left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mattklein123 commented Apr 23, 2018

jrajahalme commented Apr 23, 2018

Replace `git_sha_rewriter.py` with a generated linker option. #3021

Replace `git_sha_rewriter.py` with a generated linker option. #3021