bazel: switch C++ toolchain to hermetic-llvm; add etc/bazel-hermetic

.bazelrc

@@ -96,9 +96,13 @@ common --enable_platform_specific_config
 # macOS: boost.stacktrace needs this since backtrace() doesn't require GNU source
 build:macos --copt=-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED
 build:macos --host_copt=-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED
-# Aligned allocation/deallocation for abseil is only available since 10.13
-build:macos --macos_minimum_os=10.13
-build:macos --host_macos_minimum_os=10.13
+# Floating-point std::to_chars (behind std::format, used by OpenSTA)
+# needs macOS 13.3; std::filesystem (src/tcl_readline_setup.cc) needs
+# 10.15; abseil's aligned allocation needs 10.13. The historical 10.13
+# floor was never enforced: toolchains_llvm ignored it and compiled
+# against the host SDK's default. hermetic-llvm honors it.
+build:macos --macos_minimum_os=13.3
+build:macos --host_macos_minimum_os=13.3
 
 # Settings for --config=asan address sanitizer build
 build:asan --strip=never
@@ -123,6 +127,9 @@ build:profile --copt -fno-omit-frame-pointer --host_copt -fno-omit-frame-pointer
 # Improve hermeticity by disallowing user envars and network access
 build --incompatible_strict_action_env
 build --nosandbox_default_allow_network
+# Refuse to autodetect a local C++ toolchain (/usr/bin/gcc); the hermetic
+# toolchain must win resolution, with or without the etc/bazel-hermetic wrapper.
+common --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 test --build_tests_only
 
@@ -142,6 +149,11 @@ build:ci --disk_cache=
 # Tell the 'ci' config to include 'opt'
 build:ci --config=opt
 
+# Launch py_binary via a shell stub instead of rules_python's legacy python
+# stub, whose '#!/usr/bin/env python3' shebang needs a host python3 before
+# the hermetic interpreter takes over (found by etc/bazel-hermetic).
+common --@rules_python//python/config_settings:bootstrap_impl=script
+
 # Setup remote cache
 # Anon: HTTPS read-only cache
 build --remote_cache=https://bazel.precisioninno.com

MODULE.bazel

@@ -34,19 +34,35 @@ bazel_dep(name = "rules_python", version = "1.8.5")
 bazel_dep(name = "rules_shell", version = "0.6.1")
 bazel_dep(name = "swig", version = "4.3.0.bcr.2")
 
-# bison is transitive (rules_bison -> bison). Its vendored gnulib headers
-# deliberately shadow libc headers; under toolchains that inject libc
-# headers as leading -isystem entries (hermetic-llvm, #10812) the shadowing
-# breaks and bison@3.8.2.bcr.5 fails to compile (O_BINARY, BCR #7642).
-# 3.8.2.bcr.7 fixes most of it (a small remainder is patched in #10812
-# pending a proposed 3.8.2.bcr.8).
+# bison is transitive (rules_bison -> bison). Same gnulib libc-header
+# shadowing class as sed/gawk/m4 under hermetic-llvm (BCR #7642).
+# 3.8.2.bcr.7 fixes lib/ but src/ still picks up raw libc headers; the
+# patch restores gnulib wrapper-header precedence via -I (to be proposed
+# upstream as 3.8.2.bcr.8, then drop).
 single_version_override(
     module_name = "bison",
+    patch_strip = 1,
+    patches = [
+        "//bazel/bison-patches:0001-gnulib-wrapper-headers-use-I-not-isystem.patch",
+    ],
     version = "3.8.2.bcr.7",
 )
 
 BOOST_VERSION = "1.89.0.bcr.2"
 
+# boost::icl's exclusive_less_than comparator violates strict weak ordering
+# (boostorg/icl#51); libc++'s std::map exposes it, leaving phantom intervals
+# after interval_set subtraction (boostorg/icl#55) — pad IO fillers were
+# placed on top of pads. Upstream fix boostorg/icl@7de3f55655 (#54), merged
+# after boost 1.90. Drop when a boost.icl release containing it lands in BCR.
+single_version_override(
+    module_name = "boost.icl",
+    patch_strip = 1,
+    patches = [
+        "//bazel/boost-icl-patches:0001-refactor-interval-lookup-operations-icl-54.patch",
+    ],
+)
+
 bazel_dep(name = "boost.algorithm", version = BOOST_VERSION)
 bazel_dep(name = "boost.asio", version = BOOST_VERSION)
 bazel_dep(name = "boost.beast", version = BOOST_VERSION)
@@ -88,11 +104,10 @@ bazel_dep(name = "cudd", version = "3.0.0.bcr.2")
 bazel_dep(name = "eigen", version = "3.4.0.bcr.3")
 bazel_dep(name = "fmt", version = "11.2.0.bcr.1")
 
-# gawk is transitive (abc -> ncurses -> gawk; yosys -> gawk). Its vendored
-# gnulib headers deliberately shadow libc headers; under toolchains that
-# inject libc headers as leading -isystem entries (hermetic-llvm, #10812)
-# the shadowing breaks and gawk fails to compile (BCR #7642).
-# 5.3.2.bcr.7 carries the upstream BCR fix (BCR #7989).
+# gawk is transitive (abc -> ncurses -> gawk; yosys -> gawk). Same gnulib
+# libc-header shadowing as sed: gawk@5.3.2.bcr.2 fails to compile against
+# hermetic-llvm's explicit libc -isystem entries (BCR #7642). 5.3.2.bcr.7
+# carries the upstream fix (BCR #7989).
 single_version_override(
     module_name = "gawk",
     version = "5.3.2.bcr.7",
@@ -101,21 +116,41 @@ single_version_override(
 bazel_dep(name = "git", version = "2.54.0")
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
 
-# m4 is transitive (rules_bison/rules_flex -> m4). Its vendored gnulib
-# headers deliberately shadow libc headers; under toolchains that inject
-# libc headers as leading -isystem entries (hermetic-llvm, #10812) the
-# shadowing breaks and m4@1.4.21 fails to compile (O_SEARCH, BCR #7642).
-# 1.4.21.bcr.4 carries the upstream fix.
+# m4 is transitive (rules_bison/rules_flex -> m4). Same gnulib libc-header
+# shadowing class as sed/gawk under hermetic-llvm (BCR #7642).
 single_version_override(
     module_name = "m4",
     version = "1.4.21.bcr.4",
 )
 
 bazel_dep(name = "openmp", version = "21.1.5.bcr.2")
 bazel_dep(name = "or-tools", version = "9.15")
+
+# sed is transitive (abc -> ncurses -> sed). Its vendored gnulib headers
+# deliberately shadow libc headers (stdio.h, error.h); hermetic-llvm's
+# explicit libc -isystem entries outrank them and sed@4.9.bcr.3 fails to
+# compile (BCR #7642). 4.9.bcr.5 carries the upstream fix (BCR #7915).
+single_version_override(
+    module_name = "sed",
+    version = "4.9.bcr.5",
+)
+
 bazel_dep(name = "spdlog", version = "1.15.1")
 bazel_dep(name = "sv-lang", version = "10.0.1-20260316-f04e8156")
 bazel_dep(name = "tcl_lang", version = "9.0.2.bcr.1")
+
+# tclZipfs.c's '#include "crypt.h"' picks up glibc's crypt.h instead of the
+# vendored minizip one when glibc headers are explicit -isystem directories
+# (hermetic-llvm zero-sysroot toolchain). Drop when fixed in a tcl_lang
+# BCR release.
+single_version_override(
+    module_name = "tcl_lang",
+    patch_strip = 1,
+    patches = [
+        "//bazel/tcl-patches:0001-tclZipfs-include-vendored-minizip-crypt.h-by-path.patch",
+    ],
+)
+
 bazel_dep(name = "tcmalloc", version = "0.0.0-20250927-12f2552")
 bazel_dep(name = "yaml-cpp", version = "0.9.0")
 bazel_dep(name = "zlib", version = "1.3.1.bcr.8")
@@ -134,7 +169,12 @@ git_override(
 
 ## Lock the compiler version and avoid any local compiler.
 ## Downstream consumers must configure their own C++ toolchain.
-bazel_dep(name = "toolchains_llvm", version = "1.5.0", dev_dependency = True)
+##
+## hermetic-llvm (BCR module "llvm") provides statically linked LLVM
+## binaries and a zero-sysroot cc_toolchain: no host compiler, linker,
+## libxml2 or /usr/include involved, and it runs unmodified on distros
+## without FHS paths (e.g. NixOS).
+bazel_dep(name = "llvm", version = "0.8.11", dev_dependency = True)
 
 # --- Dev dependencies (not propagated to downstream consumers) ---
 
@@ -201,23 +241,63 @@ archive_override(
 
 # --- Extensions ---
 
-llvm = use_extension(
-    "@toolchains_llvm//toolchain/extensions:llvm.bzl",
-    "llvm",
-    dev_dependency = True,
-)
-llvm.toolchain(
-    llvm_version = "20.1.8",
-)
-use_repo(llvm, "llvm_toolchain", "llvm_toolchain_llvm")
-
-# FYI: Comment out @llvm_toolchain//:all on NixOS and use the local clang toolchain instead.
 register_toolchains(
-    "@llvm_toolchain//:all",
+    "@llvm//toolchain:all",
     "@rules_verilator//verilator:verilator_toolchain",
     dev_dependency = True,
 )
 
+# hermetic-llvm ships a minimal macOS SDK subset (frameworks are opt-in).
+# Qt (qt-bazel) needs the desktop frameworks; the first six entries are
+# hermetic-llvm's defaults, which listing any framework replaces.
+osx = use_extension("@llvm//extensions:osx.bzl", "osx", dev_dependency = True)
+osx.frameworks(names = [
+    "CoreFoundation",
+    "Foundation",
+    "Kernel",
+    "OSLog",
+    "Security",
+    "SystemConfiguration",
+    "AppKit",
+    "ApplicationServices",
+    "CFNetwork",
+    "Carbon",
+    "Cocoa",
+    "ColorSync",
+    "CoreData",
+    "CoreGraphics",
+    "CoreImage",
+    "CoreServices",
+    "CoreText",
+    "CoreVideo",
+    "DiskArbitration",
+    # ATS (inside the ApplicationServices umbrella) has .tbd symlinks into
+    # the FontServices private framework; without it they dangle and bazel
+    # rejects the sysroot ("file type is not supported").
+    "FontServices",
+    "GSS",
+    "IOKit",
+    "IOSurface",
+    "ImageIO",
+    "Metal",
+    # MetalKit's MTKModel.h includes ModelIO/ModelIO.h.
+    "MetalKit",
+    "ModelIO",
+    "OpenGL",
+    # PrintCore is inside the ApplicationServices umbrella, but must be
+    # named for the SDK subset to keep usr/include/cups (its ObjC headers
+    # import <cups/ppd.h>).
+    "PrintCore",
+    "QuartzCore",
+    # AppKit reaches these on macOS: NSImageView.h includes Symbols
+    # unconditionally; NSText*.h take the non-UIKit branch into the
+    # UIFoundation private framework; NSSharingService pulls CloudKit.
+    "CloudKit",
+    "Symbols",
+    "UIFoundation",
+    "UniformTypeIdentifiers",
+])
+
 python = use_extension("@rules_python//python/extensions:python.bzl", "python")
 python.toolchain(
     ignore_root_user_error = True,