Support releasing aarch64 builds.

This change works around an issue in rules_pkg, described here:
  https://github.com/bazelbuild/rules_pkg/pull/263

PiperOrigin-RevId: 350869030

7 files changed, 60 insertions, 40 deletions

diff --git a/tools/bazel.mk b/tools/bazel.mk
index 7e06d09be..0a10bcddf 100644
--- a/tools/bazel.mk
+++ b/tools/bazel.mk
@@ -160,6 +160,12 @@ bazel-image: load-default ## Ensures that the local builder exists.
 	@docker commit $(BUILDER_NAME) gvisor.dev/images/builder >&2
 .PHONY: bazel-image
 
+# Note: when starting the bazel server, we tie the life of the container to the
+# bazel server's life, so that the container disappears naturally. We also call
+# bazel shutdown prior to startup, to ensure that any existing bazel instance in
+# the workspace (perhaps of a different architecture) stops. If the instance is
+# compatible and the container is already running, then the wrapper if statement
+# here will succeed, and we wouldn't have needed a new server at all.
 ifneq (true,$(shell $(wrapper echo true)))
 bazel-server: bazel-image ## Ensures that the server exists.
 	@$(call header,DOCKER RUN)
@@ -171,7 +177,7 @@ bazel-server: bazel-image ## Ensures that the server exists.
 	  --workdir "$(CURDIR)" \
 	  $(DOCKER_RUN_OPTIONS) \
 	  gvisor.dev/images/builder \
-	  bash -c "set -x; tail -f --pid=\$$($(BAZEL) info server_pid) /dev/null" >&2
+	  bash -c "set -x;  $(BAZEL) shutdown; tail -f --pid=\$$($(BAZEL) info server_pid) /dev/null"
 else
 bazel-server:
 	@
diff --git a/tools/bazeldefs/BUILD b/tools/bazeldefs/BUILD
index a4a605346..ebe90dfec 100644
--- a/tools/bazeldefs/BUILD
+++ b/tools/bazeldefs/BUILD
@@ -37,3 +37,11 @@ config_setting(
     },
     visibility = ["//visibility:private"],
 )
+
+genrule(
+    name = "version",
+    outs = ["version.txt"],
+    cmd = "cat bazel-out/stable-status.txt | grep STABLE_VERSION | cut -d' ' -f2- >$@",
+    stamp = True,
+    visibility = ["//:sandbox"],
+)
diff --git a/tools/bazeldefs/defs.bzl b/tools/bazeldefs/defs.bzl
index 58ced5167..7875bbaea 100644
--- a/tools/bazeldefs/defs.bzl
+++ b/tools/bazeldefs/defs.bzl
@@ -7,6 +7,7 @@ build_test = _build_test
 bzl_library = _bzl_library
 more_shards = 4
 most_shards = 8
+version = "//tools/bazeldefs:version"
 
 def short_path(path):
     return path
diff --git a/tools/bazeldefs/pkg.bzl b/tools/bazeldefs/pkg.bzl
index 56317d93f..ccc9bdeef 100644
--- a/tools/bazeldefs/pkg.bzl
+++ b/tools/bazeldefs/pkg.bzl
@@ -1,6 +1,7 @@
 """Packaging rules."""
 
-load("@rules_pkg//:pkg.bzl", _pkg_deb = "pkg_deb", _pkg_tar = "pkg_tar")
+# N.B. We refer to pkg_deb_impl to avoid the macro, which cannot use select.
+load("@rules_pkg//:pkg.bzl", _pkg_deb = "pkg_deb_impl", _pkg_tar = "pkg_tar")
 
 pkg_deb = _pkg_deb
 pkg_tar = _pkg_tar
diff --git a/tools/defs.bzl b/tools/defs.bzl
index 56c481f44..4be767432 100644
--- a/tools/defs.bzl
+++ b/tools/defs.bzl
@@ -8,7 +8,7 @@ change for Google-internal and bazel-compatible rules.
 load("//tools/go_stateify:defs.bzl", "go_stateify")
 load("//tools/go_marshal:defs.bzl", "go_marshal", "marshal_deps", "marshal_test_deps")
 load("//tools/nogo:defs.bzl", "nogo_test")
-load("//tools/bazeldefs:defs.bzl", _arch_genrule = "arch_genrule", _build_test = "build_test", _bzl_library = "bzl_library", _coreutil = "coreutil", _default_installer = "default_installer", _default_net_util = "default_net_util", _more_shards = "more_shards", _most_shards = "most_shards", _proto_library = "proto_library", _select_arch = "select_arch", _select_system = "select_system", _short_path = "short_path")
+load("//tools/bazeldefs:defs.bzl", _arch_genrule = "arch_genrule", _build_test = "build_test", _bzl_library = "bzl_library", _coreutil = "coreutil", _default_installer = "default_installer", _default_net_util = "default_net_util", _more_shards = "more_shards", _most_shards = "most_shards", _proto_library = "proto_library", _select_arch = "select_arch", _select_system = "select_system", _short_path = "short_path", _version = "version")
 load("//tools/bazeldefs:cc.bzl", _cc_binary = "cc_binary", _cc_flags_supplier = "cc_flags_supplier", _cc_grpc_library = "cc_grpc_library", _cc_library = "cc_library", _cc_proto_library = "cc_proto_library", _cc_test = "cc_test", _cc_toolchain = "cc_toolchain", _gbenchmark = "gbenchmark", _grpcpp = "grpcpp", _gtest = "gtest", _vdso_linker_option = "vdso_linker_option")
 load("//tools/bazeldefs:go.bzl", _gazelle = "gazelle", _go_binary = "go_binary", _go_embed_data = "go_embed_data", _go_grpc_and_proto_libraries = "go_grpc_and_proto_libraries", _go_library = "go_library", _go_path = "go_path", _go_proto_library = "go_proto_library", _go_test = "go_test", _select_goarch = "select_goarch", _select_goos = "select_goos")
 load("//tools/bazeldefs:pkg.bzl", _pkg_deb = "pkg_deb", _pkg_tar = "pkg_tar")
@@ -27,6 +27,7 @@ short_path = _short_path
 coreutil = _coreutil
 more_shards = _more_shards
 most_shards = _most_shards
+version = _version
 
 # C++ rules.
 cc_binary = _cc_binary
diff --git a/tools/make_apt.sh b/tools/make_apt.sh
index 13c5edd76..302ed8aa3 100755
--- a/tools/make_apt.sh
+++ b/tools/make_apt.sh
@@ -18,9 +18,16 @@ if [[ "$#" -le 3 ]]; then
   echo "usage: $0 <private-key> <suite> <root> <packages...>"
   exit 1
 fi
-declare -r private_key=$(readlink -e "$1"); shift
-declare -r suite="$1"; shift
-declare -r root="$1"; shift
+declare private_key
+declare suite
+declare root
+private_key="$(readlink -e "$1")"
+suite="$2"
+root="$(readlink -m "$3")"
+readonly private_key
+readonly suite
+readonly root
+shift; shift; shift # For "$@" below.
 
 # Ensure that we have the correct packages installed.
 function apt_install() {
@@ -56,9 +63,15 @@ mkdir -p "${release}"
 # Create a temporary keyring, and ensure it is cleaned up.
 # Using separate homedir allows us to install apt repositories multiple times
 # using the same key. This is a limitation in GnuPG pre-2.1.
-declare -r keyring=$(mktemp /tmp/keyringXXXXXX.gpg)
-declare -r homedir=$(mktemp -d /tmp/homedirXXXXXX)
-declare -r gpg_opts=("--no-default-keyring" "--secret-keyring" "${keyring}" "--homedir" "${homedir}")
+declare keyring
+declare homedir
+declare gpg_opts
+keyring="$(mktemp /tmp/keyringXXXXXX.gpg)"
+homedir="$(mktemp -d /tmp/homedirXXXXXX)"
+gpg_opts=("--no-default-keyring" "--secret-keyring" "${keyring}" "--homedir" "${homedir}")
+readonly keyring
+readonly homedir
+readonly gpg_opts
 cleanup() {
   rm -rf "${keyring}" "${homedir}"
 }
@@ -73,40 +86,29 @@ gpg "${gpg_opts[@]}" --import "${private_key}" || \
 
 # Copy the packages into the root.
 for pkg in "$@"; do
-  ext=${pkg##*.}
-  name=$(basename "${pkg}" ".${ext}")
-  arch=${name##*_}
-  if [[ "${name}" == "${arch}" ]]; then
-    continue # Not a regular package.
+  if ! [[ -f "${pkg}" ]]; then
+    continue
   fi
-  if [[ "${pkg}" =~ ^.*\.deb$ ]]; then
-    # Extract from the debian file.
-    version=$(dpkg --info "${pkg}" | grep -E 'Version:' | cut -d':' -f2)
-  elif [[ "${pkg}" =~ ^.*\.changes$ ]]; then
-    # Extract from the changes file.
-    version=$(grep -E 'Version:' "${pkg}" | cut -d':' -f2)
-  else
-    # Unsupported file type.
-    echo "Unknown file type: ${pkg}"
-    exit 1
+  ext=${pkg##*.}
+  if [[ "${ext}" != "deb" ]]; then
+    continue
   fi
 
-  # The package may already exist, in which case we leave it alone.
-  version=${version// /} # Trim whitespace.
+  # Extract package information.
+  name=$(basename "${pkg}" ".${ext}")
+  arch=$(dpkg --info "${pkg}" | grep 'Architecture:' | cut -d':' -f2)
+  version=$(dpkg --info "${pkg}" | grep 'Version:' | cut -d':' -f2)
+  arch=${arch// /} # Trim whitespace.
+  version=${version// /} # Ditto.
   destdir="${root}/pool/${version}/binary-${arch}"
-  target="${destdir}/${name}.${ext}"
-  if [[ -f "${target}" ]]; then
-    continue
-  fi
 
   # Copy & sign the package.
   mkdir -p "${destdir}"
-  cp -a "${pkg}" "${target}"
-  chmod 0644 "${target}"
-  if [[ "${ext}" == "deb" ]]; then
-    # We use [*] here to expand the gpg_opts array into a single shell-word.
-    dpkg-sig -g "${gpg_opts[*]}" --sign builder "${target}"
-  fi
+  cp -a -L "$(dirname "${pkg}")/${name}.deb" "${destdir}"
+  cp -a -L "$(dirname "${pkg}")/${name}.changes" "${destdir}"
+  chmod 0644 "${destdir}"/"${name}".*
+  # We use [*] here to expand the gpg_opts array into a single shell-word.
+  dpkg-sig -g "${gpg_opts[*]}" --sign builder "${destdir}/${name}.deb"
 done
 
 # Build the package list.
diff --git a/tools/make_release.sh b/tools/make_release.sh
index 9137dd9bb..10742dd54 100755
--- a/tools/make_release.sh
+++ b/tools/make_release.sh
@@ -38,12 +38,13 @@ done
 
 # install_raw installs raw artifacts.
 install_raw() {
-  mkdir -p "${root}/$1"
   for binary in "${binaries[@]}"; do
-    # Copy the raw file & generate a sha512sum.
+    # Copy the raw file & generate a sha512sum, sorted by architecture.
+    arch=$(file "${binary}" | cut -d',' -f2 | awk '{print $NF}' | tr '-' '_')
     name=$(basename "${binary}")
-    cp -f "${binary}" "${root}/$1"
-    (cd "${root}/$1" && sha512sum "${name}" > "${name}.sha512")
+    mkdir -p "${root}/$1/${arch}"
+    cp -f "${binary}" "${root}/$1/${arch}"
+    (cd "${root}/$1/${arch}" && sha512sum "${name}" > "${name}.sha512")
   done
 }