Make CI pass by tweaking linker setups

Author: RomainMuller

.cargo/config.toml

@@ -1,17 +1,3 @@
 [alias]
 license = "dd-rust-license-tool check"
 format = "fmt --all && clippy --workspace --all-features --fix"
-
-# libddwaf's bindgen uses `clang-sys` which by default dynamically opens
-# `libclang.so`; however this is not supported on Alpine Linux (the usual musl
-# target).
-# Enabling the `static` feature of `bindgen`/`clang-sys` creates additional
-# build requirements (`libLLVM.a`), which Alpine's `llvm-static` does not
-# provide (it has its content presented as many `libLLVM*.a` files). Disabling
-# statically linking to the C runtime alleviates this issue, but can result in
-# `proc-macro` not being usable; which notably causes doc tests to fail with
-# a big linker error.
-[target.aarch64-unknown-linux-musl]
-rustflags = ["-C", "target-feature=-crt-static"]
-[target.x86_64-unknown-linux-musl]
-rustflags = ["-C", "target-feature=-crt-static"]

bottlecap/Cargo.toml

@@ -114,3 +114,16 @@ fips = [
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(coverage,coverage_nightly)'] }
 
+# libddwaf's bindgen uses `clang-sys` which by default dynamically opens
+# `libclang.so`; however this is not supported on Alpine Linux (the usual musl
+# target).
+# Enabling the `static` feature of `bindgen`/`clang-sys` creates additional
+# build requirements (`libLLVM.a`), which Alpine's `llvm-static` does not
+# provide (it has its content presented as many `libLLVM*.a` files). Disabling
+# statically linking to the C runtime alleviates this issue, but can result in
+# `proc-macro` not being usable; which notably causes doc tests to fail with
+# a big linker error.
+[target.aarch64-unknown-linux-musl]
+rustflags = ["-C", "target-feature=-crt-static"]
+[target.x86_64-unknown-linux-musl]
+rustflags = ["-C", "target-feature=-crt-static"]

images/Dockerfile.bottlecap.alpine.compile

@@ -4,7 +4,7 @@ ARG PLATFORM
 ARG FIPS
 
 # Install dependencies
-RUN apk add --no-cache curl gcc musl-dev make unzip bash \
+RUN apk add --no-cache curl gcc build-base make unzip bash \
     autoconf automake libtool g++ perl go cmake linux-headers \
     clang-libclang
 
@@ -28,11 +28,15 @@ COPY ./bottlecap/Cargo.lock /tmp/dd/bottlecap/Cargo.lock
 
 # Build the binary
 #
-# Added `-C link-arg=-lgcc` for alpine.
-ENV RUSTFLAGS="-C panic=abort -C link-arg=-lgcc"
+# Added `-C link-arg=-lgcc` and `-Ctarget-feature=-crt-static` for alpine, as otherwise `bindgen` is
+# unable to load `libclang` dynamically (on `musl`, the C runtime is static by default, and that
+# makes it incapable of dynamically loading libraries - static-linking `libclang` would be possible
+# if it was not such a pain to build in that case).
+ENV RUSTFLAGS="-Cpanic=abort -Clink-arg=-lgcc -Ctarget-feature=-crt-static"
 
 WORKDIR /tmp/dd/bottlecap
-RUN --mount=type=cache,target=/root/.cargo/registry \
+RUN --mount=type=cache,target=/root/.cargo/git \
+    --mount=type=cache,target=/root/.cargo/registry \
     export PROFILE="release"; \
     if [ "$FIPS" = "1" ]; then \
         export FEATURES=fips; \
@@ -43,8 +47,12 @@ RUN --mount=type=cache,target=/root/.cargo/registry \
         export FEATURES=default; \
     fi; \
     env; \
-    cargo +stable build --verbose --no-default-features --features $FEATURES --profile $PROFILE --target $PLATFORM-unknown-linux-musl; \
-    cp /tmp/dd/bottlecap/target/$PLATFORM-unknown-linux-musl/$PROFILE/bottlecap /tmp/dd/bottlecap/bottlecap
+    # Explicitly NOT passing `--target` as this makes the `RUSTFLAGS` (from any source) not apply to `build.rs`
+    # compilation, which in turns means `libddwaf`'s builder fails to build because on MUSL platforms it can only work
+    # with `-Ctarget-feature=-crt-runtime` being specified. There is currently no way to set `RUSTFLAGS` for `build.rs`
+    # compilation if `--target` is passed (see: https://github.com/rust-lang/cargo/issues/4423).
+    cargo +stable build --verbose --no-default-features --features $FEATURES --profile $PROFILE; \
+    cp /tmp/dd/bottlecap/target/$PROFILE/bottlecap /tmp/dd/bottlecap/bottlecap
 
 # Use the smallest image possible
 FROM scratch

images/Dockerfile.bottlecap.compile

@@ -4,7 +4,7 @@ ARG PLATFORM
 ARG FIPS
 
 # Install dependencies
-RUN yum install -y curl clang make unzip cmake3 perl go
+RUN yum install -y curl clang compiler-rt make unzip cmake3 perl go
 
 # Install Protocol Buffers compiler by hand, since AL2 does not have a recent enough version.
 COPY ./scripts/install-protoc.sh /
@@ -24,7 +24,7 @@ COPY ./bottlecap/Cargo.toml /tmp/dd/bottlecap/Cargo.toml
 COPY ./bottlecap/Cargo.lock /tmp/dd/bottlecap/Cargo.lock
 
 # Build the binary
-ENV RUSTFLAGS="-C panic=abort"
+ENV RUSTFLAGS="-Cpanic=abort"
 ENV AWS_LC_FIPS_SYS_CC=clang
 ENV AWS_LC_FIPS_SYS_CXX=clang++
 
@@ -35,6 +35,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     else \
         export FEATURES=default; \
     fi; \
+    export RUSTFLAGS="${RUSTFLAGS} -Clinker=clang -L$(dirname $(clang --print-file-name="libclang_rt.builtins-$(uname -m).a")) -lclang_rt.builtins-$(uname -m)"; \
     cargo +stable build --no-default-features --features $FEATURES --release --target $PLATFORM-unknown-linux-gnu;
 RUN cp /tmp/dd/bottlecap/target/$PLATFORM-unknown-linux-gnu/release/bottlecap /tmp/dd/bottlecap/bottlecap
 

scripts/build_bottlecap_layer.sh

@@ -37,7 +37,7 @@ rm -rf ${EXTENSION_PATH} 2>/dev/null
 
 cd $ROOT_DIR
 
-ALPINE=0
+ALPINE=${ALPINE:-0}
 ARCHITECTURE=$ARCHITECTURE ALPINE=$ALPINE FILE_SUFFIX=$FILE_SUFFIX .gitlab/scripts/compile_bottlecap.sh
 
 docker buildx build --platform linux/${ARCHITECTURE} \