Add build salt

AlexDenisov · AlexDenisov · commit a23ef06701a1 · 2025-10-25T10:22:15.000+02:00
diff --git a/.bazelrc b/.bazelrc
@@ -2,3 +2,4 @@ common --test_output=errors
 
 try-import .bazel.buildbuddy.rc
 try-import .bazel.compilation_mode.bazelrc
+try-import .bazel.build_salt.bazelrc
diff --git a/.github/actions/setup-bazel-cache/action.yml b/.github/actions/setup-bazel-cache/action.yml
@@ -21,3 +21,11 @@ runs:
       shell: bash
       run: |
         echo "common --compilation_mode opt" > .bazel.compilation_mode.bazelrc
+    # https://arrdem.com/2024/01/11/bazel-glibc/
+    - name: Add build salt
+      shell: bash
+      run: |
+        SALT=$(./infrastructure/build_salt.sh)
+        echo "common --copt=-DPLATFORM_FINGERPRINT=$SALT" > .bazel.build_salt.bazelrc
+        echo "common --action_env=-DPLATFORM_FINGERPRINT=$SALT" > .bazel.build_salt.bazelrc
+        cat .bazel.build_salt.bazelrc
diff --git a/.github/workflows/ci-RHEL_10.0-arm64.yml b/.github/workflows/ci-RHEL_10.0-arm64.yml
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/rhel_10.0-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.rpm packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1
diff --git a/.github/workflows/ci-RHEL_10.0-x86_64.yml b/.github/workflows/ci-RHEL_10.0-x86_64.yml
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/rhel_10.0-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.rpm packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1
diff --git a/.github/workflows/ci-RHEL_9.6-arm64.yml b/.github/workflows/ci-RHEL_9.6-arm64.yml
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/rhel_9.6-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.rpm packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1
diff --git a/.github/workflows/ci-RHEL_9.6-x86_64.yml b/.github/workflows/ci-RHEL_9.6-x86_64.yml
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/rhel_9.6-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.rpm packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1
diff --git a/.github/workflows/ci-Ubuntu_22.04-arm64.yml b/.github/workflows/ci-Ubuntu_22.04-arm64.yml
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/ubuntu_22.04-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.deb packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1
diff --git a/.github/workflows/ci-Ubuntu_22.04-x86_64.yml b/.github/workflows/ci-Ubuntu_22.04-x86_64.yml
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/ubuntu_22.04-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.deb packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1
diff --git a/.github/workflows/ci-Ubuntu_24.04-arm64.yml b/.github/workflows/ci-Ubuntu_24.04-arm64.yml
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/ubuntu_24.04-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.deb packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1
diff --git a/.github/workflows/ci-Ubuntu_24.04-x86_64.yml b/.github/workflows/ci-Ubuntu_24.04-x86_64.yml
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/ubuntu_24.04-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.deb packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1
diff --git a/.gitignore b/.gitignore
@@ -27,3 +27,4 @@ MODULE.bazel.lock
 .mull-ci-cs-repo
 .bazel.buildbuddy.rc
 .bazel.compilation_mode.bazelrc
+.bazel.build_salt.bazelrc
diff --git a/infrastructure/build_salt.sh b/infrastructure/build_salt.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e
+
+case $OSTYPE in
+  linux*)
+    echo $(cat /etc/os-release) $(ldd --version) | sha256sum | awk ' { print $1 } '
+    ;;
+
+  darwin*)
+    echo $(sw_vers) | sha256sum | awk ' { print $1 } '
+    ;;
+
+  *)
+    echo "Unkown OS type: $OSTYPE"
+    exit 1
+    ;;
+esac
diff --git a/infrastructure/templates/github-actions/ci-linux.yml.mustache b/infrastructure/templates/github-actions/ci-linux.yml.mustache
@@ -33,10 +33,8 @@ jobs:
           configFile: ./.devcontainer/[[ OS_NAME_LOWER ]]_[[OS_VERSION]]-llvm-${{ matrix.LLVM_VERSION }}/devcontainer.json
           runCmd: |
             mkdir -p packages
-            # https://arrdem.com/2024/01/11/bazel-glibc/
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel build //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
-            bazel test //... --copt=-DPLATFORM_FINGERPRINT=$build_salt --action_env=PLATFORM_FINGERPRINT=$build_salt
+            bazel build //...
+            bazel test //...
             mv -v bazel-bin/Mull-*.[[PACKAGE_EXTENSION]] packages/
       - name: Publish package
         uses: devcontainers/ci@v0.3
@@ -47,20 +45,15 @@ jobs:
           push: never
           env: CLOUDSMITH_API_KEY
           runCmd: |
-            build_salt=`ldd --version | sha256sum | awk ' {print $1} '`
-            bazel run publish \
-              --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-              --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+            bazel run publish && exit 0
 
             max_attempts=3
             attempt=1
             until [ "$attempt" -ge "$max_attempts" ]
             do
               echo "Attempt $attempt failed. Retrying..."
               attempt=$((attempt+1))
-              bazel run publish \
-                --copt=-DPLATFORM_FINGERPRINT=$build_salt \
-                --action_env=PLATFORM_FINGERPRINT=$build_salt && exit 0
+              bazel run publish && exit 0
             done
             echo "All $max_attempts attempts failed."
             exit 1

Original file line number	Diff line number	Diff line change
`@@ -2,3 +2,4 @@ common --test_output=errors`
`2`	`2`
`3`	`3`	`try-import .bazel.buildbuddy.rc`
`4`	`4`	`try-import .bazel.compilation_mode.bazelrc`
	`5`	`+try-import .bazel.build_salt.bazelrc`