feat: Add EBcLfSA 2.0.0-beta3 high integrity toolchain

.github/workflows/ebclfsa.yml

@@ -24,6 +24,25 @@ on:
     types: [checks_requested]
   workflow_call:
 jobs:
+  aarch64-ebclfsa-hi:
+    runs-on: ubuntu-24.04
+    name: Bazel Test (Aarch64-Linux)(ebclfsa HI)
+    defaults:
+      run:
+        working-directory: ./tests
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v6
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+      - name: Install AArch64 userspace emulator
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends qemu-user
+      - name: Verify high-integrity configuration and restrictions
+        run: |
+          bazel test --lockfile_mode=error --config=aarch64-linux-ebclfsa-hi --test_lang_filters=-cc -- //:ebclfsa_hi_tests //:guardrail_tests
+      - name: Run high-integrity runtime test
+        run: |
+          bazel test --lockfile_mode=error --config=aarch64-linux-ebclfsa-hi --run_under=/usr/bin/qemu-aarch64 -- //ebclfsa_hi:runtime_test
   aarch64-ebclfsa:
     runs-on: ubuntu-24.04
     strategy:

docs/maintenance.md

@@ -88,16 +88,22 @@ it defines no features of its own.
   `sysroot_link_flags`, ...), including the capability markers (`dbg`, `opt`,
   `supports_pic`, ...). These mirror the removed legacy Bazel C++ features
   one-for-one.
-- `features/custom/linux/` and `features/custom/qnx/`: OS-specific features
+- `features/custom/linux/`, `features/custom/qnx/`, and
+  `features/custom/ebclfsa_hi/`: OS-specific features
   not covered by the native set (QNX `sdp_env`, `gcc_version_flags`), plus
   `make_cc_features.bzl`, which defines the ordered `_LINUX_FEATURES` /
-  `_QNX_FEATURES` lists of `(label, initially_enabled)` pairs. Order here
+  `_QNX_FEATURES` / `_EBCLFSA_HI_FEATURES` lists of
+  `(label, initially_enabled)` pairs. Order here
   mirrors the previous templates' `features = [...]` order exactly, since
   feature order determines command-line flag order. `get_feature_lists()`
   returns `(known_features, enabled_features)`, and `templates/BUILD.template`
   passes those straight into `cc_toolchain_config`'s `known_features` /
   `enabled_features` attributes — this is what the generated toolchain
   actually uses.
+  The repository rule selects `ebclfsa_hi` for Linux toolchains with
+  `runtime_ecosystem = "ebclfsa-hi"`; otherwise it selects the target OS.
+  This keeps the restricted HI compile flags and feature list separate from
+  generic Linux without changing platform OS constraints.
 - Per-instance features whose content is dynamic per toolchain instance —
   `extra_compile_flags`, `extra_c_compile_flags`, `extra_cxx_compile_flags`,
   `extra_link_flags`, `compiler_library_search_paths`, `sysroot_link_flags` —

docs/repository_layout.md

@@ -54,7 +54,8 @@ required extra flags.
 Holds declarative `cc_feature` / `cc_args` toolchain-feature definitions built
 with `@rules_cc//cc/toolchains`. `features/native/` has one reusable target
 per toolchain feature (mirroring the legacy Bazel C++ features); the
-OS-specific `features/custom/linux/` and `features/custom/qnx/` packages hold
+OS-specific `features/custom/linux/`, `features/custom/qnx/`, and
+`features/custom/ebclfsa_hi/` packages hold
 platform-only features (e.g. QNX `sdp_env`, `gcc_version_flags`) plus the
 ordered `known_features`/`enabled_features` lists that
 `templates/BUILD.template` passes to `cc_toolchain_config`.
@@ -64,7 +65,8 @@ ordered `known_features`/`enabled_features` lists that
 Holds the shared template files rendered by repository rules into the
 generated toolchain repository: `BUILD.template`,
 `cc_toolchain_config.bzl.template`, and `cc_gcov_wrapper.template`. A single
-template pair now covers both Linux and QNX; OS-specific behavior comes from
+template pair covers Linux, QNX, and the EBcLfSA HI feature profile;
+OS-specific behavior comes from
 placeholder substitution in `rules/gcc.bzl` and from the OS-specific feature
 lists in `features/custom/`, not from separate template directories.
 

features/custom/ebclfsa_hi/BUILD

@@ -0,0 +1,22 @@
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+"""EBcLfSA High Integrity-specific compiler features."""
+
+load("@rules_cc//cc/toolchains:feature.bzl", "cc_feature")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_feature(
+    name = "compile_flags",
+    args = [
+        "//features/native/default_compile_flags:c_std_c11_args",
+        "//features/native/default_compile_flags:c_std_gnu11_args",
+        "//features/native/default_compile_flags:c_std_c99_args",
+        "//features/native/default_compile_flags:default_cxx_compile_flags_args",
+        "//features/native/default_compile_flags:dbg_compile_flags_args",
+        "//features/native/default_compile_flags:opt_compile_flags_args",
+    ],
+    feature_name = "default_compile_flags",
+)

features/custom/ebclfsa_hi/make_cc_features.bzl

@@ -0,0 +1,62 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+_EBCLFSA_HI_FEATURES = [
+    ("@score_bazel_cpp_toolchains//features/native/markers:no_legacy_features", True),
+    (":compiler_library_search_paths", True),  # per-instance, see templates/BUILD.template
+    ("@score_bazel_cpp_toolchains//features/native/markers:dbg", False),
+    ("@score_bazel_cpp_toolchains//features/native/unfiltered_compile_flags", True),
+    ("@score_bazel_cpp_toolchains//features/native/markers:gnu11", False),
+    ("@score_bazel_cpp_toolchains//features/native/markers:c_std_c99", False),
+    ("@score_bazel_cpp_toolchains//features/custom/ebclfsa_hi:compile_flags", True),
+    ("@score_bazel_cpp_toolchains//features/native/random_seed", True),
+    ("@score_bazel_cpp_toolchains//features/native/include_paths", True),
+    ("@score_bazel_cpp_toolchains//features/native/preprocessor_defines", True),
+    (":extra_compile_flags", True),  # per-instance, see templates/BUILD.template
+    (":extra_c_compile_flags", True),  # per-instance, see templates/BUILD.template
+    (":extra_cxx_compile_flags", True),  # per-instance, see templates/BUILD.template
+    ("@score_bazel_cpp_toolchains//features/native/user_compile_flags", True),
+    ("@score_bazel_cpp_toolchains//features/native/compiler_input_flags", True),
+    ("@score_bazel_cpp_toolchains//features/native/compiler_output_flags", True),
+    ("@score_bazel_cpp_toolchains//features/native/dependency_file", True),
+    ("@score_bazel_cpp_toolchains//features/native/per_object_debug_info", True),
+    ("@score_bazel_cpp_toolchains//features/native/includes", True),
+    ("@score_bazel_cpp_toolchains//features/native/archiver_flags", True),
+    ("@score_bazel_cpp_toolchains//features/native/linker_param_file", True),
+    ("@score_bazel_cpp_toolchains//features/native/library_search_directories", True),
+    ("@score_bazel_cpp_toolchains//features/native/output_execpath_flags", True),
+    ("@score_bazel_cpp_toolchains//features/native/libraries_to_link", True),
+    ("@score_bazel_cpp_toolchains//features/native/user_link_flags", True),
+    (":extra_link_flags", True),  # per-instance, see templates/BUILD.template
+    ("@score_bazel_cpp_toolchains//features/native/linkstamps", True),
+    ("@score_bazel_cpp_toolchains//features/native/force_pic_flags", True),
+    ("@score_bazel_cpp_toolchains//features/native/strip_debug_symbols", True),
+    ("@score_bazel_cpp_toolchains//features/native/fully_static_link", False),
+    (":sysroot_link_flags", True),  # per-instance, see templates/BUILD.template
+    ("@score_bazel_cpp_toolchains//features/native/use_pthread", True),
+    ("@score_bazel_cpp_toolchains//features/native/markers:opt", False),
+    ("@score_bazel_cpp_toolchains//features/native/markers:supports_pic", True),
+    ("@score_bazel_cpp_toolchains//features/native/pic", True),
+    ("@score_bazel_cpp_toolchains//features/native/markers:supports_header_path_normalization", True),
+]
+
+def get_feature_lists():
+    """Returns ordered known/enabled feature labels for EBcLfSA High Integrity.
+
+    Returns:
+        (known_features, enabled_features) tuple of flat label lists.
+    """
+    return (
+        [label for label, _enabled in _EBCLFSA_HI_FEATURES],
+        [label for label, enabled in _EBCLFSA_HI_FEATURES if enabled],
+    )

features/native/default_compile_flags/BUILD

@@ -79,20 +79,23 @@ cc_args(
     requires_any_of = [
         ":is_c99",
     ],
+    visibility = ["//visibility:public"],
 )
 
 cc_args(
     name = "c_std_c11_args",
     actions = ["@rules_cc//cc/toolchains/actions:c_compile"],
     args = ["-std=c11"],
     requires_any_of = [":is_c11"],
+    visibility = ["//visibility:public"],
 )
 
 cc_args(
     name = "c_std_gnu11_args",
     actions = ["@rules_cc//cc/toolchains/actions:c_compile"],
     args = ["-std=gnu11"],
     requires_any_of = [":is_gnu11"],
+    visibility = ["//visibility:public"],
 )
 
 cc_args(
@@ -105,6 +108,7 @@ cc_args(
                ],
                "//conditions:default": [],
            }),
+    visibility = ["//visibility:public"],
 )
 
 cc_feature_constraint(
@@ -120,6 +124,7 @@ cc_args(
         "-g3",
     ],
     requires_any_of = [":is_dbg"],
+    visibility = ["//visibility:public"],
 )
 
 cc_feature_constraint(
@@ -143,6 +148,7 @@ cc_args(
         ":is_opt",
         ":is_fastbuild",
     ],
+    visibility = ["//visibility:public"],
 )
 
 cc_args(

packages/linux/aarch64/ebclfsa/2.0.0-beta3/BUILD

@@ -13,4 +13,5 @@
 
 exports_files([
     "ebclfsa.BUILD",
+    "ebclfsa_hi.BUILD",
 ])

packages/linux/aarch64/ebclfsa/2.0.0-beta3/ebclfsa_hi.BUILD

@@ -0,0 +1,67 @@
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+"""Clang/musl/libc++ tools from the EBcLfSA beta3 SDK."""
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "all_files",
+    srcs = glob(
+        [
+            "opt/**/*",
+            "usr/**/*",
+            "lib/**/*",
+        ],
+        exclude = [
+            "usr/share/ca-certificates/**",
+            "usr/lib/ssl/certs/**",
+            "lib/ssl/certs/**",
+            "usr/share/man/**",
+            "usr/share/perl/**",
+        ],
+    ),
+)
+
+filegroup(
+    name = "ar",
+    srcs = ["usr/bin/aarch64-linux-gnu-ar"],
+)
+
+filegroup(
+    name = "cc",
+    srcs = ["usr/lib/llvm-20/bin/clang"],
+)
+
+filegroup(
+    name = "cxx",
+    srcs = ["usr/lib/llvm-20/bin/clang++"],
+)
+
+filegroup(
+    name = "gcov",
+    srcs = ["usr/bin/aarch64-linux-gnu-gcov-14"],
+)
+
+filegroup(
+    name = "strip",
+    srcs = ["usr/bin/aarch64-linux-gnu-strip"],
+)
+
+filegroup(
+    name = "readelf",
+    srcs = ["usr/bin/aarch64-linux-gnu-readelf"],
+)
+
+filegroup(
+    name = "elf-enabler",
+    srcs = ["usr/bin/lisa-elf-enabler"],
+)
+
+filegroup(
+    name = "sysroot_dir",
+    srcs = ["."],
+)
+
+filegroup(name = "cxx_builtin_include_directories")

packages/version_matrix.bzl

@@ -384,3 +384,61 @@ VERSION_MATRIX = {
         "gcc_version": "12.2.0",
     },
 }
+
+# Both integrity variants share archive metadata; the HI profile additionally
+# repairs LLVM's host-library lookup without exporting LD_LIBRARY_PATH.
+_EBCLFSA_HI_ROOT = "external/%{toolchain_pkg}%"
+_EBCLFSA_HI_C_FLAGS = [
+    "--target=aarch64-linux-gnu",
+    "-nostdinc",
+    "-isystem",
+    _EBCLFSA_HI_ROOT + "/opt/lisa-libc/include",
+    "-isystem",
+    _EBCLFSA_HI_ROOT + "/usr/lib/llvm-20/lib/clang/20/include",
+    "-fno-omit-frame-pointer",
+    "-ffunction-sections",
+    "-fdata-sections",
+]
+VERSION_MATRIX["aarch64-linux-sdk_2.0.0-beta3-ebclfsa-hi"] = dict(
+    VERSION_MATRIX["aarch64-linux-sdk_2.0.0-beta3-ebclfsa"],
+    compiler = "clang",
+    target_libc = "musl",
+    build_file = "@score_bazel_cpp_toolchains//packages/linux/aarch64/ebclfsa/2.0.0-beta3:ebclfsa_hi.BUILD",
+    # Keep host libraries local to the tools, not in the action environment:
+    # LD_LIBRARY_PATH would also affect Bazel's host process-wrapper.
+    patch_cmds = [
+        "set -eu; sdk=$(pwd); libs=$sdk/usr/lib/x86_64-linux-gnu; " +
+        "loader=$libs/ld-linux-x86-64.so.2; " +
+        "tmp=$(mktemp -d); trap 'rm -rf \"$tmp\"' EXIT; " +
+        "cp \"$sdk/usr/bin/patchelf\" \"$tmp/patchelf\"; " +
+        "run_patchelf() { \"$loader\" --library-path \"$libs/sdk-libc:$libs\" \"$tmp/patchelf\" \"$@\"; }; " +
+        "for binary in usr/lib/llvm-20/bin/clang usr/lib/llvm-20/bin/lld " +
+        "usr/bin/aarch64-linux-gnu-ar usr/bin/aarch64-linux-gnu-strip " +
+        "usr/bin/aarch64-linux-gnu-readelf usr/bin/lisa-elf-enabler; do " +
+        "run_patchelf --set-interpreter \"$loader\" \"$binary\"; " +
+        "run_patchelf --force-rpath --set-rpath \"$libs/sdk-libc:$libs\" \"$binary\"; " +
+        "done; " +
+        "run_patchelf --force-rpath --set-rpath '$ORIGIN/sdk-libc:$ORIGIN' \"$libs/libLLVM.so.20.1\"",
+    ],
+    extra_c_compile_flags = _EBCLFSA_HI_C_FLAGS,
+    extra_cxx_compile_flags = [
+        "-nostdinc++",
+        "-isystem",
+        _EBCLFSA_HI_ROOT + "/opt/lisa-libcxx/include/c++/v1",
+        "-fno-exceptions",
+        "-fno-rtti",
+    ] + _EBCLFSA_HI_C_FLAGS,
+    extra_link_flags = [
+        "--target=aarch64-linux-gnu",
+        "--ld-path=" + _EBCLFSA_HI_ROOT + "/usr/lib/llvm-20/bin/ld.lld",
+        "-nostdlib",
+        "-static",
+        "-Wl,--start-group",
+        _EBCLFSA_HI_ROOT + "/opt/lisa-libcxx/lib/libc++.a",
+        _EBCLFSA_HI_ROOT + "/opt/lisa-libcxx/lib/libc++abi.a",
+        _EBCLFSA_HI_ROOT + "/usr/lib/llvm-20/lib/clang/20/lib/linux/libclang_rt.builtins-aarch64.a",
+        _EBCLFSA_HI_ROOT + "/opt/lisa-libc/lib/aarch64-linux-gnu/crt1.o",
+        _EBCLFSA_HI_ROOT + "/opt/lisa-libc/lib/aarch64-linux-gnu/libc.a",
+        "-Wl,--end-group",
+    ],
+)

rules/gcc.bzl

@@ -280,6 +280,7 @@ def _impl(rctx):
             "%{tc_cpu}": rctx.attr.tc_cpu,
             "%{tc_identifier}": tc_identifier,
             "%{tc_os}": rctx.attr.tc_os,
+            "%{tc_feature_os}": "ebclfsa_hi" if rctx.attr.tc_os == _OS_LINUX and rctx.attr.tc_runtime_ecosystem == "ebclfsa-hi" else rctx.attr.tc_os,
             "%{tc_pkg_repo}": rctx.attr.tc_pkg_repo,
             "%{tc_runtime_es}": rctx.attr.tc_runtime_ecosystem,
             "%{tc_version}": rctx.attr.gcc_version,

templates/BUILD.template

@@ -15,7 +15,7 @@
 """
 
 load("@rules_cc//cc:defs.bzl", "cc_toolchain")
-load("@score_bazel_cpp_toolchains//features/custom/%{tc_os}:make_cc_features.bzl", "get_feature_lists")
+load("@score_bazel_cpp_toolchains//features/custom/%{tc_feature_os}:make_cc_features.bzl", "get_feature_lists")
 load("@score_bazel_cpp_toolchains//features/native/extra_compile_flags:features.bzl", "make_extra_compile_features")
 load("@score_bazel_cpp_toolchains//features/native/extra_link_flags:features.bzl", "make_extra_link_features")
 load("@score_bazel_cpp_toolchains//features/native/compiler_library_search_paths:features.bzl", "make_compiler_library_search_paths")

tests/.bazelrc

@@ -114,3 +114,7 @@ build:aarch64-linux-ebclfsa-2.0.0-beta2 --extra_toolchains=@score_ebclfsa_2.0.0-
 build:aarch64-linux-ebclfsa-2.0.0-beta3 --config=shared
 build:aarch64-linux-ebclfsa-2.0.0-beta3 --platforms=@score_bazel_platforms//:aarch64-linux-sdk_2.0.0-beta3-ebclfsa
 build:aarch64-linux-ebclfsa-2.0.0-beta3 --extra_toolchains=@score_ebclfsa_2.0.0-beta3_toolchain//:aarch64-linux-sdk_2.0.0-beta3-ebclfsa
+
+build:aarch64-linux-ebclfsa-hi --config=shared
+build:aarch64-linux-ebclfsa-hi --platforms=@score_bazel_platforms//:aarch64-linux-sdk_2.0.0-beta3-ebclfsa-hi
+build:aarch64-linux-ebclfsa-hi --extra_toolchains=@score_ebclfsa_hi_toolchain//:aarch64-linux-sdk_2.0.0-beta3-ebclfsa-hi

tests/BUILD

@@ -60,6 +60,7 @@ test_suite(
 test_suite(
     name = "guardrail_tests",
     tests = [
+        "//guardrails:feature_lists_test",
         "//guardrails:no_legacy_features_guard_test",
     ],
 )
@@ -71,9 +72,20 @@ test_suite(
 # target so new tests only need to be added to the relevant suite above.
 # ============================================================================
 
+test_suite(
+    name = "ebclfsa_hi_tests",
+    tests = [
+        "//ebclfsa_hi:configuration_test",
+        "//ebclfsa_hi:exceptions_rejected_test",
+        "//ebclfsa_hi:rtti_rejected_test",
+        "//ebclfsa_hi:runtime_test",
+    ],
+)
+
 test_suite(
     name = "all_tests",
     tests = [
+        ":ebclfsa_hi_tests",
         ":feature_verification_tests",
         ":guardrail_tests",
         ":language_and_standards_tests",