Fix sysroot .so plugins and registry auth

- Exclude GCC plugin .so files from sysroot (Bazel can't handle them)
- Only copy GCC headers and static libs needed for cross-compilation
- Add tarball structure verification to build script
- Fix DO registry auth by setting DOCKER_CONFIG env var for Bazel

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/docker_build.yml

@@ -42,9 +42,14 @@ jobs:
           mkdir -p ~/.docker
           AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
           echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          # Also set for current directory in case Bazel uses different home
+          mkdir -p .docker
+          cp ~/.docker/config.json .docker/
 
       - name: Push Eagle image to DO registry
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DOCKER_CONFIG: ${{ github.workspace }}/.docker
         run: bazel run //ci:eagle_server_push
 
   build-shardok:
@@ -66,7 +71,12 @@ jobs:
           mkdir -p ~/.docker
           AUTH=$(echo -n "${DO_TOKEN}:${DO_TOKEN}" | base64)
           echo "{\"auths\":{\"registry.digitalocean.com\":{\"auth\":\"${AUTH}\"}}}" > ~/.docker/config.json
+          # Also set for current directory in case Bazel uses different home
+          mkdir -p .docker
+          cp ~/.docker/config.json .docker/
 
       - name: Push Shardok image to DO registry
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
+        env:
+          DOCKER_CONFIG: ${{ github.workspace }}/.docker
         run: bazel run --platforms=//:linux_x86_64 //ci:shardok_server_push

MODULE.bazel

@@ -72,9 +72,8 @@ use_repo(llvm, "llvm_toolchain", "llvm_toolchain_linux")
 sysroot = use_repo_rule("@toolchains_llvm//toolchain:sysroot.bzl", "sysroot")
 sysroot(
     name = "linux_sysroot",
-    # TODO: Update sha256 after running sysroot build workflow with version v2
-    sha256 = "PLACEHOLDER_RUN_SYSROOT_WORKFLOW_FIRST",
-    urls = ["https://eagle0.sfo3.digitaloceanspaces.com/sysroot/v2/ubuntu_noble_amd64_sysroot.tar.xz"],
+    sha256 = "aadb60a2e2c776ac000bb2e29f3039fd81b5b031500cf4a1651b365712819d1f",
+    urls = ["https://eagle0-windows.sfo3.digitaloceanspaces.com/sysroot/v2/ubuntu_noble_amd64_sysroot.tar.xz"],
 )
 
 #

tools/sysroot/Dockerfile

@@ -36,5 +36,9 @@ RUN cp -a /usr/include /sysroot/ && \
     mkdir -p /sysroot/lib && \
     cp -a /lib/x86_64-linux-gnu /sysroot/lib/ && \
     # Copy GCC installation directory - Clang uses this to find libstdc++ headers
-    mkdir -p /sysroot/usr/lib/gcc && \
-    cp -a /usr/lib/gcc/x86_64-linux-gnu /sysroot/usr/lib/gcc/
+    # Only copy headers and static libs, exclude plugins (.so files) that Bazel can't handle
+    mkdir -p /sysroot/usr/lib/gcc/x86_64-linux-gnu/13 && \
+    cp -a /usr/lib/gcc/x86_64-linux-gnu/13/include /sysroot/usr/lib/gcc/x86_64-linux-gnu/13/ && \
+    cp -a /usr/lib/gcc/x86_64-linux-gnu/13/include-fixed /sysroot/usr/lib/gcc/x86_64-linux-gnu/13/ 2>/dev/null || true && \
+    cp /usr/lib/gcc/x86_64-linux-gnu/13/*.a /sysroot/usr/lib/gcc/x86_64-linux-gnu/13/ 2>/dev/null || true && \
+    cp /usr/lib/gcc/x86_64-linux-gnu/13/*.o /sysroot/usr/lib/gcc/x86_64-linux-gnu/13/ 2>/dev/null || true

tools/sysroot/build_sysroot.sh

@@ -30,6 +30,7 @@ echo "Extracting sysroot..."
 CONTAINER_ID=$(docker create sysroot-builder)
 
 # Create the sysroot structure expected by toolchains_llvm
+# The tarball should extract to create a 'sysroot' directory at the root
 TEMP_DIR=$(mktemp -d)
 SYSROOT_DIR="${TEMP_DIR}/sysroot"
 mkdir -p "${SYSROOT_DIR}/usr/lib" "${SYSROOT_DIR}/lib"
@@ -40,17 +41,21 @@ docker cp "${CONTAINER_ID}:/sysroot/usr_lib" "${SYSROOT_DIR}/usr/lib/x86_64-linu
 docker cp "${CONTAINER_ID}:/sysroot/lib/x86_64-linux-gnu" "${SYSROOT_DIR}/lib/"
 
 # Copy GCC installation directory - Clang uses this to find libstdc++ headers
-# The path /usr/lib/gcc/x86_64-linux-gnu/13 is where clang looks for GCC
+# Only copy what the Dockerfile prepared (headers and static libs, no .so plugins)
 docker cp "${CONTAINER_ID}:/sysroot/usr/lib/gcc" "${SYSROOT_DIR}/usr/lib/"
 
 # Also need lib64 symlink for some builds
 ln -sf lib "${SYSROOT_DIR}/lib64"
 
-# Create the tarball
+# Create the tarball - use strip-components-friendly structure
+# The tarball extracts directly, MODULE.bazel label points to //sysroot
 echo "Creating tarball..."
 cd "${TEMP_DIR}"
 tar -cJf "${OUTPUT_DIR}/${SYSROOT_NAME}.tar.xz" sysroot
 
+echo "Verifying tarball structure..."
+tar -tf "${OUTPUT_DIR}/${SYSROOT_NAME}.tar.xz" | head -20
+
 # Compute SHA256
 echo "Computing SHA256..."
 SHA256=$(shasum -a 256 "${OUTPUT_DIR}/${SYSROOT_NAME}.tar.xz" | cut -d' ' -f1)