buildBazelPackage: cleanup hacks and enforce them for all builds

Timestamp verification skip is no longer needed (not sure why). Generally we
better off always using the environment hack for all packages because that
ensures all NIX_* flags are correctly applied.

One possible improvement in future is to filter only NIX_* variables to
passthru in Bazel.

1 files changed, 13 insertions, 30 deletions

diff --git a/pkgs/build-support/build-bazel-package/default.nix b/pkgs/build-support/build-bazel-package/default.nix
index 7c9fc83e0f1b..4e19b244f3cb 100644
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, bazel, cacert, enableNixHacks ? true }:
+{ stdenv, bazel, cacert }:
 
 args@{ name, bazelFlags ? [], bazelTarget, buildAttrs, fetchAttrs, ... }:
 
@@ -37,7 +37,15 @@ in stdenv.mkDerivation (fBuildAttrs // {
 
       # We disable multithreading for the fetching phase since it can lead to timeouts with many dependencies/threads:
       # https://github.com/bazelbuild/bazel/issues/6502
-      BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 USER=homeless-shelter bazel --output_base="$bazelOut" --output_user_root="$bazelUserRoot" fetch --loading_phase_threads=1 $bazelFlags $bazelTarget
+      BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
+      USER=homeless-shelter \
+      bazel \
+        --output_base="$bazelOut" \
+        --output_user_root="$bazelUserRoot" \
+        fetch \
+        --loading_phase_threads=1 \
+        $bazelFlags \
+        $bazelTarget
 
       runHook postBuild
     '';
@@ -74,12 +82,14 @@ in stdenv.mkDerivation (fBuildAttrs // {
     '';
 
     dontFixup = true;
+    allowedRequisites = [];
+
     outputHashMode = "recursive";
     outputHashAlgo = "sha256";
     outputHash = fetchAttrs.sha256;
   });
 
-  nativeBuildInputs = fBuildAttrs.nativeBuildInputs or [] ++ [ (if enableNixHacks then (bazel.override { enableNixHacks = true; }) else bazel) ];
+  nativeBuildInputs = fBuildAttrs.nativeBuildInputs or [] ++ [ (bazel.override { enableNixHacks = true; }) ];
 
   preHook = fBuildAttrs.preHook or "" + ''
     export bazelOut="$NIX_BUILD_TOP/output"
@@ -99,29 +109,6 @@ in stdenv.mkDerivation (fBuildAttrs // {
   buildPhase = fBuildAttrs.buildPhase or ''
     runHook preBuild
 
-    # Bazel sandboxes the execution of the tools it invokes, so even though we are
-    # calling the correct nix wrappers, the values of the environment variables
-    # the wrappers are expecting will not be set. So instead of relying on the
-    # wrappers picking them up, pass them in explicitly via `--copt`, `--linkopt`
-    # and related flags.
-    #
-    copts=()
-    host_copts=()
-    for flag in $NIX_CFLAGS_COMPILE; do
-      copts+=( "--copt=$flag" )
-      host_copts+=( "--host_copt=$flag" )
-    done
-    for flag in $NIX_CXXSTDLIB_COMPILE; do
-      copts+=( "--copt=$flag" )
-      host_copts+=( "--host_copt=$flag" )
-    done
-    linkopts=()
-    host_linkopts=()
-    for flag in $NIX_LD_FLAGS; do
-      linkopts+=( "--linkopt=$flag" )
-      host_linkopts+=( "--host_linkopt=$flag" )
-    done
-
     BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
     USER=homeless-shelter \
     bazel \
@@ -129,10 +116,6 @@ in stdenv.mkDerivation (fBuildAttrs // {
       --output_user_root="$bazelUserRoot" \
       build \
       -j $NIX_BUILD_CORES \
-      "''${copts[@]}" \
-      "''${host_copts[@]}" \
-      "''${linkopts[@]}" \
-      "''${host_linkopts[@]}" \
       $bazelFlags \
       $bazelTarget