feat: verify protoc as a validation action

Gives some protection against a repo accidentally registering a protoc binary on the toolchain that doesnt behave as expected.
Based on #23539

Author: alexeagle

bazel/private/prebuilt_tool_integrity.bzl

@@ -8,6 +8,7 @@ The checked in content is only here to allow load() statements in the sources to
 
 # An arbitrary version of protobuf that includes pre-built binaries.
 # See /examples/example_without_cc_toolchain which uses this for testing.
+# TODO(alexeagle): add some automation to update this version occasionally.
 _TEST_VERSION = "v33.0"
 _TEST_SHAS = dict()
 # Add a couple platforms which are commonly used for testing.

bazel/private/proto_library_rule.bzl

@@ -106,14 +106,18 @@ def _proto_library_impl(ctx):
         files = [proto_info.direct_descriptor_set],
         transitive_files = depset(transitive = [proto_info.transitive_sources]),
     )
-    return [
+    providers = [
         proto_info,
         DefaultInfo(
             files = depset([proto_info.direct_descriptor_set]),
             default_runfiles = ctx.runfiles(),  # empty
             data_runfiles = data_runfiles,
         ),
     ]
+    if ctx.attr._authenticity_validation:
+        # Forward the validation group so that it's triggered by proto_library rules.
+        providers.append(OutputGroupInfo(_validation = ctx.attr._authenticity_validation[OutputGroupInfo]._validation))
+    return providers
 
 def _process_srcs(ctx, srcs, import_prefix, strip_import_prefix):
     """Returns proto_path and sources, optionally symlinking them to _virtual_imports.
@@ -375,6 +379,10 @@ List of files containing extension declarations. This attribute is only allowed
 for use with MessageSet.
 """,
         ),
+        "_authenticity_validation": attr.label(
+            default = "//bazel/private/toolchains/prebuilt:authenticity_validation",
+            doc = "Validate that the binary registered on the toolchain is produced by protobuf team",
+        ),
         # buildifier: disable=attr-license (calling attr.license())
         "licenses": attr.license() if hasattr(attr, "license") else attr.string_list(),
         "_experimental_proto_descriptor_sets_include_source_info": attr.label(

bazel/private/toolchains/prebuilt/BUILD.bazel

@@ -4,6 +4,7 @@ Ensures that Bazel only downloads required binaries for selected toolchains.
 In particular, see comment below on the toolchain#toolchain attribute.
 """
 
+load(":protoc_authenticity.bzl", "protoc_authenticity")
 load("//toolchain:platforms.bzl", "PROTOBUF_PLATFORMS")
 [
     toolchain(
@@ -18,3 +19,9 @@ load("//toolchain:platforms.bzl", "PROTOBUF_PLATFORMS")
     )
     for platform, meta in PROTOBUF_PLATFORMS.items()
 ]
+
+# Support verification of user-registered toolchains
+protoc_authenticity(
+    name = "authenticity_validation",
+    visibility = ["//visibility:public"],
+)

bazel/private/toolchains/prebuilt/protoc_authenticity.bzl

@@ -0,0 +1,46 @@
+"Validate that the protoc binary is authentic and not spoofed by a malicious actor."
+load("//bazel/common:proto_common.bzl", "proto_common")
+load("//bazel/private:toolchain_helpers.bzl", "toolchains")
+load("//bazel/private:prebuilt_tool_integrity.bzl", "RELEASE_VERSION")
+
+def _protoc_authenticity_impl(ctx):
+    # When this flag is disabled, then users have no way to replace the protoc binary with their own toolchain registration.
+    # Therefore there's no validation to perform.
+    if not proto_common.INCOMPATIBLE_ENABLE_PROTO_TOOLCHAIN_RESOLUTION:
+        return []
+    toolchain = ctx.toolchains[toolchains.PROTO_TOOLCHAIN]
+    if not toolchain:
+        fail("Protocol compiler toolchain could not be resolved.")
+    proto_lang_toolchain_info = toolchain.proto
+    validation_output = ctx.actions.declare_file("validation_output.txt")
+
+    ctx.actions.run_shell(
+        outputs = [validation_output],
+        tools = [proto_lang_toolchain_info.proto_compiler],
+        command = """\
+        {protoc} --version > {validation_output}
+        grep -q "^libprotoc {RELEASE_VERSION}" {validation_output} || {{
+          echo >&2 'ERROR: protoc version does not match protobuf Bazel module; we do not support this. To suppress this error, run Bazel with --norun_validations'
+          exit 1
+        }}
+        """.format(
+            protoc = proto_lang_toolchain_info.proto_compiler.executable.path,
+            validation_output = validation_output.path,
+            RELEASE_VERSION = RELEASE_VERSION.removeprefix("v"),
+        ),
+    )
+    return [OutputGroupInfo(_validation = depset([validation_output]))]
+
+protoc_authenticity = rule(
+    implementation = _protoc_authenticity_impl,
+    fragments = ["proto"],
+    attrs = toolchains.if_legacy_toolchain({
+        "_proto_compiler": attr.label(
+            cfg = "exec",
+            executable = True,
+            allow_files = True,
+            default = "//src/google/protobuf/compiler:protoc_minimal",
+        ),
+    }),
+    toolchains = toolchains.use_toolchain(toolchains.PROTO_TOOLCHAIN),
+)