KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#dsh #dsh-plugin #ai-agents #developer-tools #codex #claude-code #mcp #rust #deepseek-harness #typescript #ai-agent #cli

bazeldnf

★ 38 Open GitHub ↗

Build multi-arch base containers based on RPM with bazel.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# bazeldnf

Bazel library which allows dealing with the whole RPM dependency lifecycle
solely with pure go rules and a static go binary.

## Bazel rules

### rpm rule

The `rpm` rule represents a pure RPM dependency. This dependency is not
processed in any way.  They can be added to your `WORKSPACE` file like this:

```python
load("@bazeldnf//bazeldnf:deps.bzl", "rpm")

rpm(
    name = "libvirt-devel-11.0.0-1.fc42.x86_64.rpm",
    sha256 = "aac272a2ace134b5ef60a41e6624deb24331e79c76699ef6cef0dca22d94ac7e",
    urls = [
        "https://kojipkgs.fedoraproject.org//packages/libvirt/11.0.0/1.fc42/x86_64/libvirt-libs-11.0.0-1.fc42.x86_64.rpm",
    ],
)
```

### rpmtree

`rpmtree` Takes a list of `rpm` dependencies and merges them into a single
`tar` package.  `rpmtree` rules can be added like this to your `BUILD` files:

```python
load("@bazeldnf//bazeldnf:defs.bzl", "rpmtree")

rpmtree(
    name = "rpmarchive",
    rpms = [
        "@libvirt-libs-11.0.0-1.fc42.x86_64.rpm//rpm",
        "@libvirt-devel-11.0.0-1.fc42.x86_64.rpm//rpm",
    ],
)
```

Since `rpmarchive` is just a tar archive, it can be put into a container
immediately:

```python
container_layer(
    name = "gcloud-layer",
    tars = [
        ":rpmarchive",
    ],
)
```

rpmtrees allow injecting relative symlinks (`pkg_tar` can only inject absolute
symlinks) and xattrs `capabilities`.  The following example adds a relative
link and gives one binary the `cap_net_bind_service` capability to connect to
privileged ports:

```yaml
rpmtree(
    name = "rpmarchive",
    rpms = [
        "@libvirt-libs-11.0.0-1.fc42.x86_64.rpm//rpm",
        "@libvirt-devel-11.0.0-1.fc42.x86_64.rpm//rpm",
    ],
    symlinks = {
        "/var/run": "../run",
    },
    capabilities = {
        "/usr/libexec/qemu-kvm": [
            "cap_net_bind_service",
        ],
    },
)
```

## Running bazeldnf with bazel

The bazeldnf repository needs to be added  to your `WORKSPACE`:

```python
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_archive(
    name = "bazeldnf",
    sha256 = "fb24d80ad9edad0f7bd3000e8cffcfbba89cc07e495c47a7d3b1f803bd527a40",
    urls = [
        "https://github.com/rmohr/bazeldnf/releases/download/v0.5.9/bazeldnf-v0.5.9.tar.gz",
    ],
)

load("@bazeldnf//bazeldnf:deps.bzl", "bazeldnf_dependencies")

bazeldnf_dependencies()
```

Define the `bazeldnf` executable rule in your `BUILD.bazel` file:
```python
load("@bazeldnf//bazeldnf:defs.bzl", "bazeldnf")

bazeldnf(name = "bazeldnf")
```

After adding this code, you can run bazeldnf with Bazel:

```bash
bazel run //:bazeldnf -- --help
```

## Libraries and Headers

One important use-case is to expose headers and libraries inside the RPMs to build targets in bazel.
If we would just blindly expose all libraries to build targets, bazel would try to link any one of them to our binary.
This would obviously not work. Therefore we need a mediator
between `cc_library` and `rpmtree`. This mediator is the `tar2files` target. This target allows extracting
a subset of libraries and headers and providing them to `cc_library` targets.

An example:

```python
load("@bazeldnf//bazeldnf:defs.bzl", "rpm", "rpmtree", "tar2files")

tar2files(
    name = "libvirt-libs",
    files = {
        "/usr/include/libvirt": [
            "libvirt-admin.h",
            "libvirt-common.h",
            "libvirt-domain-checkpoint.h",
            "libvirt-domain-snapshot.h",
            "libvirt-domain.h",
            "libvirt-event.h",
        ],
        "/usr/lib64": [
            "libacl.so.1",
            "libacl.so.1.1.2253",
            "libattr.so.1",
        ],
    },
    tar = ":libvirt-devel",
    visibility = ["//visibility:public"],
)
```

`tar` can take any input which is a tar archive. Conveniently this is what `rpmtree` creates as the default target.
So any `rpmtree` can be used here.
The `files` section contains then files per folder which one wants to expose to `cc_library`:

```python
cc_library(
    name = "rpmlibs",
    srcs = [
        ":libvirt-libs/usr/lib64",
    ],
    hdrs = [
        ":libvirt-libs/usr/include/libvirt",
    ],
    strip_include_prefix="/libvirt-libs/",
    prefix= "libvirt",
)
```

At this point source code linking to these libraries can be compiled, but unit tests would only work if we would manually
list any transitive library. This would be tedious and error prone. However bazeldnf can introspect for you shared libraries
and create `tar2files` rules for you, based on a provided set of libraries.

First define a target like this:

```python
load("@bazeldnf//bazeldnf:defs.bzl", "bazeldnf", "rpm", "rpmtree", "tar2files")

bazeldnf(
    name = "ldd",
    command = "ldd",
    libs = [
        "/usr/lib64/libvirt-lxc.so.0",
        "/usr/lib64/libvirt-qemu.so.0",
        "/usr/lib64/libvirt.so.0",
    ],
    rpmtree = ":libvirt-devel",
    rulename = "libvirt-libs",
)
```

`rulename` containes the `tar2files` target name, `rpmtree` references a given `rpmtree` and `libs` contains
libraries which one wants to link. When now executing the target like this:

```bash
bazel run //:ldd
```

the `tar2files` target will be updated with all transitive library dependencies for  the specified libraries.
In addition, all header directories are updated too for convenience.

## Dependency resolution

One key part of managing RPM dependencies and RPM repository updates via bazel
is the ability to resolve RPM dependencies from repos without external tools
like `dnf` or `yum` and write the resolved dependencies to your `WORKSPACE`.

Here an example on how to add libvirt and bash to your WORKSPACE and BUILD
files.

First write the `repo.yaml` file which contains some basic rpm repos to query:

```bash
bazeldnf init --fc 32 # write a repo.yaml file containing the usual release and update repos for fc32
```

Then write a `rpmtree` rule called `libvirttree` to your BUILD file and all
corresponding RPM dependencies into your WORKSPACE for libvirt:
```bash
bazeldnf rpmtree --workspace /my/WORKSPACE --buildfile /my/BUILD.bazel --name libvirttree libvirt
```

Do the same for bash with a `bashrpmtree` target:

```bash
bazeldnf rpmtree --workspace /my/WORKSPACE --buildfile /my/BUILD.bazel --name bashtree bash
```

Finally prune all unreferenced old RPM files:

```bash
bazeldnf prune --workspace /my/WORKSPACE --buildfile /my/BUILD.bazel
```

By default `bazeldnf rpmtree` will try to find a solution which only contains
the newest packages of all involved repositories. The only exception are pinned
versions themselves. If pinned version require other outdated packages,
the `--nobest` option can be supplied. With this option all packages are
considered. Newest packages will have the higest weight but it may not always be
able to choose them and older packages may be pulled in instead.

### Lock files

bazeldnf can use lock files as the source of RPMs in lieu of using the WORKSPACE file. These
can be hand written or generated with `bazeldnf rpmtree` similarly to how WORKSPACE files work.
Lock files can *only* be used when working in bzlmod mode, not in workspace mode.

To generate lock files you can run the following:

```bash
bazeldnf rpmtree --lockfile rpms.json --configname myrpms --name libvirttree libvirt
```

The lock file JSON format is as follows:
```
{
    "name": "bazeldnf-rpms",
    "rpms": [
        {
            "name": "libvirt-libs",
            "sha256": "aac272a2ace134b5ef60a41e6624deb24331e79c76699ef6cef0dca22d94ac7e",
            "urls": [
                "https://kojipkgs.fedoraproject.org//packages/libvirt/11.0.0/1.fc42/x86_64/libvirt-libs-11.0.0-1.fc42.x86_64.rpm"
            ]
        }
    ]
}

```

### Authentication

During the build, downloading the resolved rpm files is handled by Bazel and authentication is also handled by Bazel.
By default, Bazel will read the `.netrc` file, but more advanced mechanisms, such as the credential helper are also
available.

During dependency resolution authentication is handled by the bazeldnf command. At the moment only `.netrc` basic auth
is supported. Credentials will be read from the file indicated by the `NETRC` environment variable if it is set,
otherwise the `~/.netrc` file will be read.

### Dependency resolution limitations

##### Missing features

* Resolving `requires` entries which contain boolean logic like `(gcc if something)`

##### Deliberately not supported

The goal is to build minimal containers with RPMs based on scratch containers.
Therefore the following RPM repository hints will be ignored:

* `recommends`
 * `supplements`
 * `suggests`
 * `enhances`

bazeldnf

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README