portage: Move ebuild validator back to ebuild rule

bazelbuild/bazel#19624 has been fixed, so we
no longer need the hash_tracer to apply the ebuild validation action.
This also means we can disable it by default. If someone wants to enable
it, they can add `--config=hash_tracer` to their bazel build command
line.

BUG=b:304895109
TEST=BOARD=amd64-generic bazel build @portage//internal/packages/stage1/target/board/chromiumos/sys-libs/glibc:2.35-r25
TEST=BOARD=amd64-generic bazel build --config=hash_tracer @portage//internal/packages/stage1/target/board/chromiumos/sys-libs/glibc:2.35-r25

Change-Id: I335abf89aabdec83dc0279af42e718c0d9cd717f
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/bazel/+/4950206
Commit-Queue: Raul Rangel <rrangel@chromium.org>
Tested-by: Raul Rangel <rrangel@chromium.org>
Reviewed-by: Shuhei Takahashi <nya@chromium.org>

bazelrcs/common.bazelrc

@@ -144,6 +144,5 @@ build:nohermetic_rust --no//bazel/module_extensions/toolchains/rust:hermetic
 
 build --config=nohermetic_toolchains
 
-# Enable printing artifact hashes + verifying ebuilds
-build --aspects //bazel/portage/build_defs:hash_tracer.bzl%hash_tracer,//bazel/portage/build_defs:hash_tracer.bzl%hash_tracer_validator
-build:hash_tracer --aspects_parameters hash_tracer_enabled=true
+# Enable printing artifact hashes
+build:hash_tracer --aspects //bazel/portage/build_defs:hash_tracer.bzl%hash_tracer,//bazel/portage/build_defs:hash_tracer.bzl%hash_tracer_validator

portage/build_defs/ebuild.bzl

@@ -300,8 +300,8 @@ def _get_basename(ctx):
 
     return src_basename
 
-def generate_ebuild_validation_action(ctx, binpkg):
-    src_basename = _get_basename(ctx.rule)
+def _generate_ebuild_validation_action(ctx, binpkg):
+    src_basename = _get_basename(ctx)
 
     validation_file = ctx.actions.declare_file(src_basename + ".validation")
 
@@ -313,12 +313,12 @@ def generate_ebuild_validation_action(ctx, binpkg):
         "--package",
         binpkg,
     ])
-    args.add_joined("--use-flags", ctx.rule.attr.use_flags, join_with = ",", omit_if_empty = False)
+    args.add_joined("--use-flags", ctx.attr.use_flags, join_with = ",", omit_if_empty = False)
 
     ctx.actions.run(
         inputs = depset([binpkg]),
         outputs = [validation_file],
-        executable = ctx.rule.executable._xpaktool,
+        executable = ctx.executable._xpaktool,
         arguments = [args],
         mnemonic = "EbuildValidation",
         progress_message = "Building %{label}",
@@ -452,11 +452,18 @@ def _ebuild_impl(ctx):
         ],
     )
 
+    validation_files = [
+        _generate_ebuild_validation_action(ctx, output_binary_package_file),
+    ]
+
     return [
         DefaultInfo(files = depset(
             [output_binary_package_file, output_log_file] +
             interface_library_outputs,
         )),
+        OutputGroupInfo(
+            _validation = depset(validation_files),
+        ),
         package_info,
         package_set_info,
     ] + interface_library_providers

portage/build_defs/hash_tracer.bzl

@@ -3,7 +3,6 @@
 # found in the LICENSE file.
 
 load("//bazel/portage/build_defs:common.bzl", "BinaryPackageInfo", "SDKInfo")
-load("//bazel/portage/build_defs:ebuild.bzl", "generate_ebuild_validation_action")
 
 HashTracerInfo = provider(
     """
@@ -136,33 +135,23 @@ def _hash_tracer_impl(target, ctx):
         "cc_library",
         "py_library",
     ]:
-        if ctx.attr.hash_tracer_enabled:
-            direct_outputs.append(_generate_hash_action(ctx, target.files))
+        direct_outputs.append(_generate_hash_action(ctx, target.files))
 
     elif ctx.rule.kind in ["build_sdk", "sdk_update", "sdk_install_deps", "sdk_from_archive"]:
         layers = target[SDKInfo].layers
 
         # We only want to hash the layer that the rule created.
+        # TODO: Refactor rules to return only newly created layers in their
+        # DefaultInfo provider.
         last_layer = layers[-1]
 
-        if ctx.attr.hash_tracer_enabled:
-            direct_outputs.append(_generate_hash_action(ctx, [last_layer]))
+        direct_outputs.append(_generate_hash_action(ctx, [last_layer]))
         transitive_outputs.extend(_processes_rule(ctx.rule))
 
     elif ctx.rule.kind in ["ebuild"]:
-        binpkg = target[BinaryPackageInfo].file
-
-        files = [binpkg]
-
-        # Only one rule or aspect can currently generate the _validation output group.
-        # So we have this very ebuild specific validator defined here.
-        # See https://github.com/bazelbuild/bazel/issues/19624
-        # Once this bug is fixed, we can move the validator back to ebuild.bzl.
-        direct_outputs.append(generate_ebuild_validation_action(ctx, binpkg))
-
-        if ctx.attr.hash_tracer_enabled:
-            direct_outputs.append(_generate_hash_action(ctx, files))
+        files = [target[BinaryPackageInfo].file]
 
+        direct_outputs.append(_generate_hash_action(ctx, files))
         transitive_outputs.extend(_processes_rule(ctx.rule))
     else:
         # For all the intermediary nodes we just propagate the dependencies.
@@ -174,15 +163,6 @@ hash_tracer = aspect(
     implementation = _hash_tracer_impl,
     doc = "Prints out the sha256 of all dependent tar, go_binary, and rust_binary targets, etc.",
     attr_aspects = ["*"],
-    attrs = {
-        "hash_tracer_enabled": attr.bool(
-            doc = """
-            Enables the hash tracer. The `ebuild` validation action will run
-            regardless of this flag.
-            """,
-            default = False,
-        ),
-    },
 )
 
 def _hash_tracer_validator_impl(target, ctx):