From ea8461c105870851e4be4deffbfc1ccee7178ace Mon Sep 17 00:00:00 2001
From: sayrer <sayrer@gmail.com>
Date: Mon, 8 Dec 2025 09:11:27 -0800
Subject: [PATCH] Add needed features for hermetic builds on linux.

---
 swift/toolchains/swift_toolchain.bzl | 16 ++++++++++++++--
 tools/common/process.cc              |  4 ++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/swift/toolchains/swift_toolchain.bzl b/swift/toolchains/swift_toolchain.bzl
index 462c44a7e..40938d1f2 100644
--- a/swift/toolchains/swift_toolchain.bzl
+++ b/swift/toolchains/swift_toolchain.bzl
@@ -347,7 +347,8 @@ def _swift_unix_linkopts_cc_info(
         cpu,
         os,
         toolchain_label,
-        toolchain_root):
+        toolchain_root,
+        toolchain_files = None):
     """Returns a `CcInfo` containing flags that should be passed to the linker.
 
     The provider returned by this function will be used as an implicit
@@ -361,6 +362,8 @@ def _swift_unix_linkopts_cc_info(
         toolchain_label: The label of the Swift toolchain that will act as the
             owner of the linker input propagating the flags.
         toolchain_root: The toolchain's root directory.
+        toolchain_files: Optional depset of files from the Swift toolchain that
+            should be passed as additional inputs to the linker.
 
     Returns:
         A `CcInfo` provider that will provide linker flags to binaries that
@@ -396,6 +399,7 @@ def _swift_unix_linkopts_cc_info(
                 cc_common.create_linker_input(
                     owner = toolchain_label,
                     user_link_flags = depset(linkopts),
+                    additional_inputs = toolchain_files if toolchain_files else depset(),
                 ),
             ]),
         ),
@@ -450,6 +454,7 @@ def _swift_toolchain_impl(ctx):
             ctx.attr.os,
             ctx.label,
             toolchain_root,
+            ctx.attr.toolchain_files[DefaultInfo].files if ctx.attr.toolchain_files else None,
         )
 
     # TODO: Remove once we drop bazel 7.x support
@@ -494,7 +499,7 @@ def _swift_toolchain_impl(ctx):
         toolchain_root = toolchain_root,
         use_autolink_extract = SWIFT_FEATURE_USE_AUTOLINK_EXTRACT in ctx.features,
         use_module_wrap = SWIFT_FEATURE_USE_MODULE_WRAP in ctx.features,
-        additional_tools = [ctx.file.version_file],
+        additional_tools = [ctx.file.version_file] + (ctx.attr.toolchain_files[DefaultInfo].files.to_list() if ctx.attr.toolchain_files else []),
         tool_executable_suffix = ctx.attr.tool_executable_suffix,
     )
     all_action_configs = _all_action_configs(
@@ -635,6 +640,13 @@ configuration options that are applied to targets on a per-package basis.
             "root": attr.string(
                 mandatory = True,
             ),
+            "toolchain_files": attr.label(
+                doc = """\
+A filegroup containing all the files in the Swift toolchain. These files will be\
+passed as inputs to all Swift compile and link actions, enabling sandboxed builds.\
+""",
+                mandatory = False,
+            ),
             "version_file": attr.label(
                 mandatory = True,
                 allow_single_file = True,
diff --git a/tools/common/process.cc b/tools/common/process.cc
index e546a3756..1c123d896 100644
--- a/tools/common/process.cc
+++ b/tools/common/process.cc
@@ -353,8 +353,8 @@ void PosixSpawnIORedirector::ConsumeAllSubprocessOutput(
 // are controlled by the lifetime of the strings in args.
 std::vector<const char *> ConvertToCArgs(const std::vector<std::string> &args) {
   std::vector<const char *> c_args;
-  std::string filename = std::filesystem::path(args[0]).filename().string();
-  c_args.push_back(&*std::next(args[0].rbegin(), filename.length() - 1));
+  // Keep full path so Swift driver can find swift-frontend relative to argv[0]
+  c_args.push_back(args[0].c_str());
   for (int i = 1; i < args.size(); i++) {
     c_args.push_back(args[i].c_str());
   }