sdk%feat(build): add barebones support for Bazel as alternate build system, use FHS layout in Nix environment, mimic Xcode.app layout for macOS SDK, rewrite smoke test in Python, update probe to validate sysroots

.bazelignore

@@ -0,0 +1,5 @@
+.cache
+.venv
+docs/.site
+public
+target

.bazeliskrc

@@ -0,0 +1,2 @@
+# Bazelisk runs `bazel/bazel` in place of the Bazel release it fetched.
+BAZELISK_WRAPPER_DIRECTORY=bazel

.bazelrc

@@ -0,0 +1,5 @@
+# The output root is placed in `.cache` (see `bazel/shim.py`), and the repo contents cache cannot live in-tree.
+common --repo_contents_cache=
+
+# Keeps the convenience symlinks out of the repository root.
+build --symlink_prefix=.cache/bazel-

.bazelversion

@@ -0,0 +1 @@
+9.1.0

.cargo/mutants.toml

@@ -5,7 +5,7 @@ additional_cargo_test_args = [
   "fail-fast",
 ]
 build_timeout_multiplier = 5.0
-exclude_globs = ["pkgs/dev/**", "pkgs/pow/**"]
+exclude_globs = ["meta/dev/**", "pkgs/pow/**"]
 features = ["full"]
 gitignore = true
 profile = "mutants"

.editorconfig

@@ -11,8 +11,14 @@ trim_trailing_whitespace = true
 [*.Dockerfile]
 indent_size = 4
 
+[*.bat]
+end_of_line = crlf
+
 [*.md]
 trim_trailing_whitespace = false
 
-[Justfile]
+[{Justfile,*.just}]
+indent_size = 4
+
+[{*.bzl,BUILD.bazel,MODULE.bazel}]
 indent_size = 4

.gitattributes

@@ -1,2 +1,6 @@
 *                 text=auto eol=lf
-fuzz/*/corpora/** binary linguist-generated
+*.bat             text      eol=crlf
+*.lock                      linguist-generated
+*.lock.yml                  linguist-generated
+*.rs                        diff=rust
+fuzz/*/corpora/** binary    linguist-generated

.github/workflows/build_bazel.yml

@@ -0,0 +1,55 @@
+name: Build with Bazel
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  bazel:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-24.04
+          - ubuntu-24.04-arm
+          - macos-latest
+          - macos-15-intel
+          - windows-latest
+
+    name: ${{ matrix.os }} (bazel)
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Install just
+        uses: taiki-e/install-action@v2
+        with:
+          tool: just
+
+      # Windows images ship Bazel beside Bazelisk, and either may come first.
+      - name: Uninstall Bazel
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          if (choco list bazel --exact --limit-output) {
+            choco uninstall bazel --yes --no-progress
+          }
+
+      - name: Build every target
+        run: just zbuild
+
+      - name: Check the output root
+        shell: bash
+        run: test -d .cache/bazel/install

.github/workflows/build_cross.yml

@@ -41,7 +41,7 @@ jobs:
         run: nix develop ./contrib/nix#dev --command true
 
       - name: Validate toolchains
-        run: nix develop ./contrib/nix#dev --command ./contrib/nix/smoke_test.sh
+        run: nix develop ./contrib/nix#dev --command ./contrib/smoke_test.py
 
   build:
     name: ${{ matrix.target }}

Cargo.toml

@@ -1,6 +1,7 @@
 [workspace]
 members = [
-  "pkgs/dev",
+  "meta/bazel",
+  "meta/dev",
   "pkgs/num",
   "pkgs/params",
   "pkgs/p2p_core",

Justfile

@@ -8,6 +8,8 @@ export RUSTDOCFLAGS := "-D warnings"
 
 mod fuzz "fuzz/mod.just"
 
+import "bazel/mod.just"
+
 each := "cargo hack --workspace --exclude-features default --each-feature"
 powerset := "cargo hack --workspace --exclude-features default --feature-powerset"
 
@@ -51,3 +53,6 @@ test:
     {{ each }} test --doc
     cargo doc --workspace --no-deps --features full
     {{ each }} test --benches
+
+zbuild *flags:
+    bazel build {{ flags }} //...

MODULE.bazel

@@ -0,0 +1,4 @@
+module(
+    name = "dash_base_sdk",
+    version = "0.0.0",
+)

bazel/bazel

@@ -0,0 +1 @@
+shim.py

bazel/bazel.bat

@@ -0,0 +1,3 @@
+@echo off
+python "%~dp0shim.py" %*
+exit /b %ERRORLEVEL%

bazel/mod.just

@@ -0,0 +1,4 @@
+# Bazel settings shared by the root and crate justfiles.
+
+# Read by bazelisk, which otherwise downloads Bazel into the user's cache.
+export BAZELISK_HOME := justfile_directory() + "/.cache/bazelisk"

bazel/shim.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+# coding: latin-1
+
+#
+# Copyright (c) 2026-present, The Dash Core developers
+# SPDX-License-Identifier: MIT
+# See the accompanying file LICENSE or https://opensource.org/license/MIT
+#
+
+"""Shim that runs Bazel with its output root in `.cache/bazel`."""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+OUTPUT_ROOT = Path(__file__).resolve().parents[1] / ".cache" / "bazel"
+
+
+def main() -> int:
+  real = os.environ.get("BAZEL_REAL")
+  if not real:
+    print("bazel: run bazelisk, which sets BAZEL_REAL", file=sys.stderr)
+    return 2
+  argv = [real, f"--output_user_root={OUTPUT_ROOT}", *sys.argv[1:]]
+  if os.name == "nt":
+    return subprocess.run(argv, check=False).returncode  # noqa: S603
+  os.execv(real, argv)  # noqa: S606
+
+
+if __name__ == "__main__":
+  sys.exit(main())

contrib/README.md

@@ -100,6 +100,33 @@ cargo install --locked cargo-deny
 sudo dnf install -y cargo-deny git just nodejs24
 ```
 
+## Bazel
+
+> [!NOTE]
+> Bazel isn't installed directly. Instead, [Bazelisk](https://github.com/bazelbuild/bazelisk) is installed as `bazel`,
+> which uses the version pinned by [`.bazelversion`](../.bazelversion). It is accompanied by
+> [buildifier](https://github.com/bazelbuild/buildtools), used to lint Starlark (the DSL used by Bazel) files.
+
+<!-- pyml disable-next-line no-duplicate-heading -->
+### macOS (with [Homebrew](https://brew.sh/))
+
+> [!WARNING]
+> `bazelisk` conflicts with the `bazel` formula. If the latter has been installed, it must be uninstalled first.
+
+```bash
+brew install bazelisk buildifier
+```
+
+<!-- pyml disable-next-line no-duplicate-heading -->
+### Linux/WSL
+
+Neither Bazelisk nor buildifier are available in official Debian or Fedora repositories. Both are published to the npm
+registry and can be installed with the `npm` CLI tool (a part of Node.js, an existing dependency).
+
+```bash
+npm install -g @bazel/bazelisk @bazel/buildifier
+```
+
 <!-- [end:setup] -->
 
 <!-- [start:bisect] -->

contrib/docker/docker-compose.yml

@@ -34,6 +34,10 @@ services:
       nix_daemon:
         condition: "service_healthy"
     init: true
+    # `fhs-run` uses bubblewrap, which needs user namespaces and unmasked procfs generally denied by Docker by default.
+    security_opt:
+      - "seccomp=unconfined"
+      - "systempaths=unconfined"
     user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
     environment:
       NIX_REMOTE: "daemon"

contrib/docker/entrypoint

@@ -26,7 +26,7 @@ if ! git rev-parse --git-dir > /dev/null 2>&1; then
 fi
 
 if (( $# > 0 )); then
-  exec nix develop ./contrib/nix#dev --command "$@"
+  exec nix develop ./contrib/nix#dev --command fhs-run "$@"
 else
-  exec nix develop ./contrib/nix#dev
+  exec nix develop ./contrib/nix#dev --command fhs-run bash
 fi

contrib/nix/flake.nix

@@ -8,6 +8,8 @@
 
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
 
+    nixpkgs-llvm.url = "github:NixOS/nixpkgs/3e2cf88148e732abc1d259286123e06a9d8c964a";
+
     pyproject-build-systems = {
       url = "github:pyproject-nix/build-system-pkgs";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -35,6 +37,7 @@
   outputs =
     {
       nixpkgs,
+      nixpkgs-llvm,
       nixpkgs-unstable,
       rust-overlay,
       ...
@@ -63,18 +66,24 @@
               inherit system;
               config.allowUnfree = true;
             };
+            llvm = (import nixpkgs-llvm { inherit system; }).llvmPackages_20;
           }
         );
     in
     {
       devShells = eachSystem (
-        { pkgs, unstable }:
+        {
+          pkgs,
+          unstable,
+          llvm,
+        }:
         let
           ctx = import ./shell/common.nix {
             inherit
               pkgs
               lib
               inputs
+              llvm
               unstable
               ;
             root = ../..;

contrib/nix/mods/bazel.nix

@@ -0,0 +1,23 @@
+# Bazel through bazelisk, with buildifier.
+
+{ pkgs }:
+
+let
+  # nixpkgs builds Bazel from source, whose lockfiles differ from those of the
+  # release binaries. Bazelisk fetches the release hosts without Nix run too.
+  bazelisk = pkgs.writeShellScriptBin "bazel" ''
+    exec ${pkgs.bazelisk}/bin/bazelisk "$@"
+  '';
+in
+{
+  packages = [
+    bazelisk
+    pkgs.buildifier
+  ];
+
+  shellHook = ''
+    if root=$(git rev-parse --show-toplevel 2> /dev/null); then
+      export BAZELISK_HOME="$root/.cache/bazelisk"
+    fi
+  '';
+}