chore: upgrade llvm module to 0.7.1, fix macos 403s

MODULE.bazel

@@ -90,13 +90,34 @@ use_repo(tel, "aspect_tools_telemetry_report")
 # Dev deps are the remainder of the file
 
 # LLVM configuration
-bazel_dep(name = "llvm", version = "0.7.0", dev_dependency = IS_RELEASE)
+bazel_dep(name = "llvm", version = "0.7.1", dev_dependency = IS_RELEASE)
+
+# Patch http_bsdtar_archive to tolerate missing `--include` patterns.
+# See https://github.com/hermeticbuild/hermetic-llvm/issues/34.
+single_version_override(
+    module_name = "llvm",
+    patch_strip = 1,
+    patches = ["//bazel/patches/llvm:http_bsdtar_archive_tolerant.patch"],
+    version = "0.7.1",
+)
 
 register_toolchains(
     "@llvm//toolchain:all",
     dev_dependency = IS_RELEASE,
 )
 
+# Override the macOS SDK with a community mirror; Apple's swcdn 403s CI IPs.
+# See https://github.com/hermeticbuild/hermetic-llvm/issues/34.
+osx = use_extension("@llvm//extensions:osx.bzl", "osx", dev_dependency = IS_RELEASE)
+osx.from_archive(
+    sha256 = "beee7212d265a6d2867d0236cc069314b38d5fb3486a6515734e76fa210c784c",
+    strip_prefix = "MacOSX26.1.sdk",
+    type = "tar.xz",
+    urls = [
+        "https://github.com/joseluisq/macosx-sdks/releases/download/26.1/MacOSX26.1.sdk.tar.xz",
+    ],
+)
+
 # Rust configuration
 bazel_dep(name = "rules_rust", version = "0.68.1", dev_dependency = IS_RELEASE)
 

bazel/patches/llvm/BUILD.bazel

@@ -0,0 +1,8 @@
+# Patches applied to the `llvm` Bazel module via single_version_override
+# in //MODULE.bazel.
+exports_files(
+    [
+        "http_bsdtar_archive_tolerant.patch",
+    ],
+    visibility = ["//visibility:public"],
+)

bazel/patches/llvm/http_bsdtar_archive_tolerant.patch

@@ -0,0 +1,22 @@
+Tolerate bsdtar's "Not found in archive" warnings.
+See https://github.com/hermeticbuild/hermetic-llvm/issues/34.
+
+--- a/http_bsdtar_archive.bzl
++++ b/http_bsdtar_archive.bzl
+@@ -187,7 +187,16 @@
+
+     host_bsdtar = _host_bsdtar_label(rctx)
+     res = rctx.execute([rctx.path(host_bsdtar)] + args)
++
++    benign = False
+     if res.return_code != 0:
++        stderr_lines = [l for l in res.stderr.strip().splitlines() if l.strip()]
++        benign = bool(stderr_lines) and all([
++            ("Not found in archive" in l) or ("Error exit delayed from previous errors" in l)
++            for l in stderr_lines
++        ])
++
++    if res.return_code != 0 and not benign:
+         fail("Failed to extract archive: {}\n{}".format(res.stderr, res.stdout))
+
+     if keep_file:

e2e/MODULE.bazel

@@ -8,7 +8,7 @@ bazel_dep(name = "rules_cc", version = "0.2.16")
 bazel_dep(name = "tar.bzl", version = "0.5.5")
 bazel_dep(name = "rules_python", version = "1.0.0")
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "llvm", version = "0.7.0")
+bazel_dep(name = "llvm", version = "0.7.1")
 bazel_dep(name = "rules_oci", version = "2.2.7")
 bazel_dep(name = "rules_rust", version = "0.68.1")
 bazel_dep(name = "rules_shell", version = "0.4.1")

examples/debugger/MODULE.bazel

@@ -5,7 +5,7 @@ bazel_dep(name = "bazel_skylib", version = "1.4.2")
 bazel_dep(name = "rules_cc", version = "0.2.16")
 bazel_dep(name = "rules_python", version = "1.0.0")
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "llvm", version = "0.7.0")
+bazel_dep(name = "llvm", version = "0.7.1")
 
 local_path_override(
     module_name = "aspect_rules_py",

examples/dev_deps/MODULE.bazel

@@ -5,7 +5,7 @@ bazel_dep(name = "bazel_skylib", version = "1.4.2")
 bazel_dep(name = "rules_cc", version = "0.2.16")
 bazel_dep(name = "rules_python", version = "1.0.0")
 bazel_dep(name = "platforms", version = "1.0.0")
-bazel_dep(name = "llvm", version = "0.7.0")
+bazel_dep(name = "llvm", version = "0.7.1")
 
 local_path_override(
     module_name = "aspect_rules_py",