From 311c9b2c8b51b25c80a486641d97c7e6911c2fb9 Mon Sep 17 00:00:00 2001
From: Malte Poll <mp@edgeless.systems>
Date: Tue, 31 Jan 2023 13:13:33 +0100
Subject: [PATCH] build: pin java toolchain

---
 .bazelrc                 |  6 ++++
 WORKSPACE.bazel          |  4 +++
 toolchains/java_deps.bzl | 59 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+)
 create mode 100644 toolchains/java_deps.bzl

diff --git a/.bazelrc b/.bazelrc
index b5a2a45c0..eb28164ad 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -1,6 +1,12 @@
 build --incompatible_enable_cc_toolchain_resolution
 build --platforms @zig_sdk//libc_aware/platform:linux_amd64_gnu.2.34
 build --extra_toolchains @zig_sdk//libc_aware/toolchain:linux_amd64_gnu.2.34
+build --incompatible_use_toolchain_resolution_for_java_rules
+build --java_runtime_version=pinned_remotejdk_11
+build --tool_java_runtime_version=pinned_remotejdk_11
+test --java_runtime_version=pinned_remotejdk_11
+test --tool_java_runtime_version=pinned_remotejdk_11
+test --incompatible_use_toolchain_resolution_for_java_rules
 
 build:linux_amd64 --platforms @zig_sdk//libc_aware/platform:linux_amd64_gnu.2.34
 build:linux_amd64 --extra_toolchains @zig_sdk//libc_aware/toolchain:linux_amd64_gnu.2.34
diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index cb0d77301..5f9694227 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -1,3 +1,7 @@
+load("//toolchains:java_deps.bzl", "java_deps")
+
+java_deps()
+
 # proto toolchain
 load("//toolchains:proto_deps.bzl", "proto_deps")
 
diff --git a/toolchains/java_deps.bzl b/toolchains/java_deps.bzl
new file mode 100644
index 000000000..8dbc3d427
--- /dev/null
+++ b/toolchains/java_deps.bzl
@@ -0,0 +1,59 @@
+"""Java toolchain dependencies for Bazel.
+
+Defines hermetic java toolchains.
+"""
+
+load("@bazel_tools//tools/jdk:remote_java_repository.bzl", "remote_java_repository")
+
+HASHES = {
+    "linux_aarch64": "9f5ac83b584a297c792cc5feb67c752a2d9fc1259abec3a477e96be8b672f452",
+    "linux_x86_64": "6fae6811b0f3aebb14c3e59a5fde14481cff412ef8ca23221993f1ab33269aab",
+    "osx_aarch64": "2a3f56af83f9d180dfce5d6e771a292bbbd68a77c7c18ed3bdb607e86d773704",
+    "osx_x86_64": "6234ebb7567c416ff28e2f080569e67656ae8fcdb3b601d8348d4d504ca79e68",
+}
+
+OS = {
+    "linux": "linux",
+    "osx": "macosx",
+}
+
+ARCH = {
+    "aarch64": "aarch64",
+    "x86_64": "x64",
+}
+
+def java_deps():
+    for os in OS:
+        for arch in ["x86_64", "aarch64"]:
+            _java_repository(
+                os = os,
+                arch = arch,
+                zulu_version = "11.62.17",
+                jdk_version = "11.0.18",
+            )
+
+def _java_repository(os, arch, zulu_version, jdk_version, jdk_major = 11):
+    """Defines a java repository for the given os and architecture.
+
+    Args:
+      os: The os of the java repository.
+      arch: The architecture of the java repository.
+      jdk_major: The major version of the java repository.
+      zulu_version: The zulu version of the java repository.
+      jdk_version: The jdk version of the java repository.
+    """
+    path = "zulu-embedded" if os == "linux" and arch == "aarch64" else "zulu"
+    remote_java_repository(
+        name = "pinned_remotejdk%s_%s_%s" % (jdk_major, os, arch),
+        prefix = "pinned_remotejdk",
+        sha256 = HASHES["%s_%s" % (os, arch)],
+        strip_prefix = "zulu%s-ca-jdk%s-%s_%s" % (zulu_version, jdk_version, OS[os], ARCH[arch]),
+        target_compatible_with = [
+            "@platforms//os:" + os,
+            "@platforms//cpu:" + arch,
+        ],
+        urls = [
+            "https://cdn.azul.com/%s/bin/zulu%s-ca-jdk%s-%s_%s.tar.gz" % (path, zulu_version, jdk_version, OS[os], ARCH[arch]),
+        ],
+        version = jdk_major,
+    )