bazel: import C libraries from nix as cc_libary

This also includes aliases to select the correct library based on the target platform.

WORKSPACE.bazel

@@ -98,6 +98,10 @@ nixpkgs_package(
     repository = "@nixpkgs",
 )
 
+load("//nix/cc:nixpkgs_cc_libraries.bzl", "nixpkgs_cc_library_deps")
+
+nixpkgs_cc_library_deps()
+
 load("//bazel/mkosi:mkosi_configure.bzl", "register_mkosi")
 
 register_mkosi(
@@ -201,7 +205,10 @@ load("@hermetic_cc_toolchain//toolchain:defs.bzl", zig_toolchains = "toolchains"
 
 zig_toolchains()
 
-nixpkgs_cc_configure(repository = "@nixpkgs")
+nixpkgs_cc_configure(
+    name = "nixpkgs_cc_toolchain",
+    repository = "@nixpkgs",
+)
 
 register_toolchains(
     "@zig_sdk//libc_aware/toolchain:linux_amd64_gnu.2.23",

nix/cc/BUILD.bazel

@@ -0,0 +1,68 @@
+load("@bazel_skylib//lib:selects.bzl", "selects")
+
+alias(
+    name = "org_openssl",
+    actual = select({
+        ":aarch64-darwin": "@org_openssl_aarch64-darwin//:org_openssl",
+        ":aarch64-linux": "@org_openssl_aarch64-linux//:org_openssl",
+        ":x86_64-darwin": "@org_openssl_x86_64-darwin//:org_openssl",
+        ":x86_64-linux": "@org_openssl_x86_64-linux//:org_openssl",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "cryptsetup",
+    actual = select({
+        ":x86_64-linux": "@cryptsetup_x86_64-linux//:cryptsetup",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "libvirt",
+    actual = select({
+        ":x86_64-linux": "@libvirt_x86_64-linux//:libvirt",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "cryptsetup_rpath",
+    actual = select({
+        ":x86_64-linux": "@cryptsetup_x86_64-linux//:rpath",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+selects.config_setting_group(
+    name = "aarch64-linux",
+    match_all = [
+        "@platforms//cpu:aarch64",
+        "@platforms//os:linux",
+    ],
+)
+
+selects.config_setting_group(
+    name = "aarch64-darwin",
+    match_all = [
+        "@platforms//cpu:aarch64",
+        "@platforms//os:macos",
+    ],
+)
+
+selects.config_setting_group(
+    name = "x86_64-darwin",
+    match_all = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:macos",
+    ],
+)
+
+selects.config_setting_group(
+    name = "x86_64-linux",
+    match_all = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:linux",
+    ],
+)

nix/cc/nixpkgs_cc_libraries.bzl

@@ -0,0 +1,109 @@
+""" Bazel cc_library definitions for Nixpkgs. """
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_flake_package")
+
+def nixpkgs_cc_library_deps():
+    """ Generate cc_library rules for Nixpkgs. """
+    return [
+        nixpkgs_flake_package(
+            name = "org_openssl_%s" % system,
+            nix_flake_file = "//:flake.nix",
+            nix_flake_lock_file = "//:flake.lock",
+            package = "packages.%s.openssl" % system,
+            build_file_content = OPENSSL_BUILD,
+        )
+        for system in openssl_systems
+    ] + [
+        nixpkgs_flake_package(
+            name = "cryptsetup_%s" % system,
+            nix_flake_file = "//:flake.nix",
+            nix_flake_lock_file = "//:flake.lock",
+            package = "cryptsetup",
+            build_file_content = CRYPTSETUP_BUILD,
+        )
+        for system in cryptsetup_systems
+    ] + [
+        nixpkgs_flake_package(
+            name = "libvirt_%s" % system,
+            nix_flake_file = "//:flake.nix",
+            nix_flake_lock_file = "//:flake.lock",
+            package = "libvirt",
+            build_file_content = LIBVIRT_BUILD,
+        )
+        for system in libvirt_systems
+    ]
+
+openssl_systems = [
+    "aarch64-linux",
+    "aarch64-darwin",
+    "x86_64-linux",
+    "x86_64-darwin",
+]
+
+cryptsetup_systems = [
+    "x86_64-linux",
+]
+
+libvirt_systems = [
+    "x86_64-linux",
+]
+
+OPENSSL_BUILD = """\
+load("@rules_cc//cc:defs.bzl", "cc_library")
+filegroup(
+    name = "include",
+    srcs = glob(["include/**/*.h"]),
+    visibility = ["//visibility:public"],
+)
+cc_library(
+    name = "org_openssl",
+    srcs = glob(["lib/**/*.a"]),
+    hdrs = [":include"],
+    strip_include_prefix = "include",
+    visibility = ["//visibility:public"],
+)
+"""
+
+CRYPTSETUP_BUILD = """\
+exports_files(["closure.tar", "rpath", "dynamic-linker"])
+filegroup(
+    name = "include",
+    srcs = glob(["include/**/*.h"]),
+    visibility = ["//visibility:public"],
+)
+cc_library(
+    name = "cryptsetup",
+    srcs = glob(["lib/**/*.so*"]),
+    hdrs = [":include"],
+    strip_include_prefix = "include",
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    visibility = ["//visibility:public"],
+)
+"""
+
+LIBVIRT_BUILD = """\
+exports_files(["bin-linktree.tar", "closure.tar", "rpath", "dynamic-linker"])
+load("@rules_cc//cc:defs.bzl", "cc_library")
+filegroup(
+    name = "include",
+    srcs = glob(["include/**/*.h"]),
+    visibility = ["//visibility:public"],
+)
+cc_library(
+    name = "libvirt",
+    srcs = glob([
+        "lib/*.so",
+        "lib/*.so.*",
+    ]),
+    hdrs = [":include"],
+    strip_include_prefix = "include",
+    target_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+    visibility = ["//visibility:public"],
+)
+"""