gvisor - Container Runtime Sandbox

Age	Commit message (Collapse)	Author
2020-10-28	Traversal embedded libraries, even for go_library rules.	Adin Scannell
	PiperOrigin-RevId: 339570821
2020-10-26	Add nogo configuration.	Adin Scannell
	This splits the nogo rules into a separate configuration yaml file, and allows for multiple files to be provided. Because attrs cannot be passed down to aspects, this required that all findings are propagated up the aspect Provider. This doesn't mean that any extra work must be done, just that this information must be carried through the graph, and some additional starlark complexity is required. PiperOrigin-RevId: 339076357
2020-10-19	Remove legacy bazel configurations.	Adin Scannell
	Using the newer bazel rules necessitates a transition from proto1 to proto2. In order to resolve the incompatibility between proto2 and gogoproto, the cri runtimeoptions proto must be vendored. Further, some of the semantics of bazel caching changed during the transition. It is now necessary to: - Ensure that :gopath depends only on pure library targets, as the propagation of go_binary build attributes (pure, static) will affected the generated files (though content remains the same, there are conflicts with respect to the gopath). - Update bazel.mk to include the possibility of binaries in the bazel-out directory, as it will now put runsc and others there. This required some refinements to the mechanism of extracting paths, since some the existing regex resulted in false positives. - Change nogo rules to prevent escape generation on binary targets. For some reason, the newer version of bazel attempted to run the nogo analysis on the binary targets, which fails due to the fact that objdump does not work on the final binary. This must be due to a change in the semantics of aspects in bazel3. PiperOrigin-RevId: 337958324
2020-10-16	Refactor shared starlark files.	Adin Scannell
	PiperOrigin-RevId: 337581114
2020-10-16	Refactor nogo to better support ARM.	Adin Scannell
	PiperOrigin-RevId: 337544107
2020-10-09	Minor nogo restructuring.	Adin Scannell
	PiperOrigin-RevId: 336343819
2020-10-08	Minor nogo cleanup.	Adin Scannell
	PiperOrigin-RevId: 336126583
2020-08-31	Change nogo failures to test failures, instead of build failures.	Adin Scannell
	PiperOrigin-RevId: 329408633
2020-08-26	Support stdlib analyzers with nogo.	Adin Scannell
	This immediately revealed an escape analysis violation (!), where the sync.Map was being used in a context that escapes were not allowed. This is a relatively minor fix and is included. PiperOrigin-RevId: 328611237
2020-08-25	Add nogo support to go_binary and go_test targets.	Adin Scannell
	Updates #3374 PiperOrigin-RevId: 328378700
2020-07-23	Internal change	Michael Pratt
	PiperOrigin-RevId: 322788791
2020-04-20	Add internal nogo analysis & checkescape tool.	Adin Scannell
	See tools/nogo/README.md. The checkescape tool is able to perform recursive escape analysis, using the actual generated binary to confirm the results produced by the compiler itself. As an initial use case, this replaces the manual escape analysis tests used for go_marshal, and validates that the CopyIn and CopyOut paths will not require any allocation or stack splits. Updates #2243 PiperOrigin-RevId: 307532986