Merge branch 'secretflow:main' into main

.bazelrc

@@ -29,32 +29,10 @@ build:macos --host_copt=-Wa,--noexecstack
 
 # platform specific config
 # Bazel will automatic pick platform config since we have enable_platform_specific_config set
-
 build:macos --features=-supports_dynamic_linker
-build:macos --cxxopt -Wno-deprecated-enum-enum-conversion
-build:macos --cxxopt -Wno-deprecated-anon-enum-enum-conversion
-
-build:asan --strip=never
-build:asan --copt -fno-sanitize-recover=all
-build:asan --copt -fsanitize=address
-build:asan --copt -Og
-build:asan --copt -g
-build:asan --copt -fno-omit-frame-pointer
-build:asan --linkopt -fsanitize=address
-
-build:ubsan --strip=never
-build:ubsan --copt -fno-sanitize-recover=all
-build:ubsan --copt -fsanitize=undefined
-build:ubsan --copt -Og
-build:ubsan --copt -g
-build:ubsan --copt -fno-omit-frame-pointer
-build:ubsan --linkopt -fsanitize=undefined
 
-# see https://github.com/bazelbuild/bazel/issues/6932, _FORTIFY_SOURCE=1 is enabled by default
-# on Mac OS, which breaks ASAN. bazel has officially added sanitizer support to Apple Platforms,
-# see commit: https://github.com/bazelbuild/bazel/commit/6ab161e2d5b8ad9cf191be1b362cd4619f3bb956
-build:macos-asan --features=asan
-build:macos-ubsan --features=ubsan
+build:asan --features=asan
+build:ubsan --features=ubsan
 
 test --keep_going
 test --test_output=errors

.github/workflows/buildifier.yml

@@ -1,11 +1,12 @@
 ---
-name: Bazel files check
-on: [push]
+name: Bazel files linter
+on:
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
 jobs:
-  formatting-check:
-    name: Run buildifier check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run buildifier
-        uses: jbajic/buildifier@v1
+  bazel-formatting-check:
+    uses: secretflow/.github/.github/workflows/bazel-linter.yml@main

.github/workflows/cla.yml

@@ -1,54 +1,11 @@
-# Copyright 2023 Ant Group Co., Ltd.
-# 
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-# 
-#   http://www.apache.org/licenses/LICENSE-2.0
-# 
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-name: "CLA Assistant"
+---
+name: CLA Assistant
 on:
   issue_comment:
     types: [created]
   pull_request_target:
-    types: [opened,closed,synchronize]
-
+    types: [opened, closed, synchronize]
 jobs:
   CLAssistant:
-    runs-on: ubuntu-latest
-    steps:
-      - name: "CLA Assistant"
-        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        # Beta Release
-        uses: cla-assistant/github-action@v2.1.3-beta
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # the below token should have repo scope and must be manually added by you in the repository's secret
-          PERSONAL_ACCESS_TOKEN : ${{ secrets.CLA_PERSONAL_ACCESS_TOKEN }}
-        with:
-          path-to-document: 'https://github.com/secretflow/.github/blob/main/CLA.md' # e.g. a CLA or a DCO document
-
-          # branch should not be protected
-          lock-pullrequest-aftermerge: True
-          path-to-signatures: 'signatures/version1/cla.json'
-          remote-organization-name: secretflow
-          remote-repository-name: cla.db
-          branch: 'main'
-          allowlist: 'test'
-
-          #below are the optional inputs - If the optional inputs are not given, then default values will be taken
-          #remote-organization-name: enter the remote organization name where the signatures should be stored (Default is storing the signatures in the same repository)
-          #remote-repository-name:  enter the  remote repository name where the signatures should be stored (Default is storing the signatures in the same repository)
-          #create-file-commit-message: 'For example: Creating file for storing CLA Signatures'
-          #signed-commit-message: 'For example: $contributorName has signed the CLA in #$pullRequestNo'
-          #custom-notsigned-prcomment: 'pull request comment with Introductory message to ask new contributors to sign'
-          #custom-pr-sign-comment: 'The signature to be committed in order to sign the CLA'
-          #custom-allsigned-prcomment: 'pull request comment when all contributors has signed, defaults to **CLA Assistant Lite bot** All Contributors have signed the CLA.'
-          #lock-pullrequest-aftermerge: false - if you don't want this bot to automatically lock the pull request after merging (default - true)
-          #use-dco-flag: true - If you are using DCO instead of CLA
+    uses: secretflow/.github/.github/workflows/cla.yml@main
+    secrets: inherit

.github/workflows/clang-format-linter.yml

@@ -1,13 +1,12 @@
+---
 name: Run clang-format Linter
-
-on: [push, pull_request]
-
+on:
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v2
-    - uses: DoozyX/clang-format-lint-action@v0.16.2
-      with:
-        extensions: 'h,cc'
-        clangFormatVersion: 16.0.3
+  run-clang-format:
+    uses: secretflow/.github/.github/workflows/clang-format.yml@main

.github/workflows/stale.yml

@@ -0,0 +1,9 @@
+---
+name: Mark stale issues and pull requests
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 40 9 * * *
+jobs:
+  stale:
+    uses: secretflow/.github/.github/workflows/stale.yml@main

.github/workflows/yaml-lint.yml

@@ -1,17 +1,12 @@
 ---
 name: Yaml Lint
-on: [push]  # yamllint disable-line rule:truthy
+on:
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
 jobs:
-  lintAllTheThings:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: yaml-lint
-        uses: ibiqlik/action-yamllint@v3
-        with:
-          config_data: |
-            rules:
-              line-length:
-                max: 300
-                allow-non-breakable-words: true
-                allow-non-breakable-inline-mappings: true
+  yaml-linter:
+    uses: secretflow/.github/.github/workflows/yaml-linter.yml@main

.pre-commit-config.yaml

@@ -0,0 +1,46 @@
+#  Copyright 2022 Ant Group Co., Ltd.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+# Install hooks to run automatically on git commit:
+#  >>    pre-commit install
+#
+# More helps: https://pre-commit.com/
+
+repos:
+  # Built-in hooks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: "v4.4.0"
+    hooks:
+      - id: trailing-whitespace
+
+  # buildifier
+  - repo: local
+    hooks:
+      - id: buildifier
+        name: buildifier
+        entry: buildifier # -mode check
+        language: system
+        files: '^(.*/)?(BUILD\.bazel|BUILD|WORKSPACE|WORKSPACE\.bazel|WORKSPACE\.bzlmod|MODULE\.bazel)$|\.BUILD$|\.bzl$'
+
+  # clang-format
+  - repo: https://github.com/pre-commit/mirrors-clang-format
+    rev: "v16.0.6"
+    hooks:
+      - id: clang-format
+
+  # Check for spelling
+  - repo: https://github.com/codespell-project/codespell
+    rev: "v2.2.5"
+    hooks:
+      - id: codespell

bazel/patches/ippcp.patch

@@ -147,4 +147,26 @@ index ea1641d..f98fc2d 100644
  # Optimization level = 3, no-debug definition (turns off asserts)
  set(CMAKE_C_FLAGS_RELEASE " -O3 -DNDEBUG")
  set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
-
+
+diff --git a/sources/cmake/linux/Clang9.0.0.cmake b/sources/cmake/linux/Clang9.0.0.cmake
+index 0015431..f93411c 100644
+--- a/sources/cmake/linux/Clang9.0.0.cmake
++++ b/sources/cmake/linux/Clang9.0.0.cmake
+@@ -79,7 +79,7 @@ endif()
+ set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fcf-protection=full")
+
+ # Security flag that adds compile-time and run-time checks
+-set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -D_FORTIFY_SOURCE=2")
++set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
+
+ if(NOT NONPIC_LIB)
+   # Position Independent Execution (PIE)
+@@ -107,7 +107,7 @@ if(SANITIZERS)
+ endif(SANITIZERS)
+
+ # Optimization level = 3, no-debug definition (turns off asserts), warnings=errors
+-set (CMAKE_C_FLAGS_RELEASE " -O3 -DNDEBUG -Werror")
++set (CMAKE_C_FLAGS_RELEASE " -O3 -DNDEBUG -Werror -Wno-unused-function -Wno-missing-braces -Wno-unused-but-set-variable -Wno-unknown-pragmas")
+
+ # DEBUG flags - optimization level = 0, generation GDB information (-g)
+ set (CMAKE_C_FLAGS_DEBUG " -O0 -g")

bazel/repositories.bzl

@@ -301,11 +301,11 @@ def _com_github_dltcollab_sse2neon():
     maybe(
         http_archive,
         name = "com_github_dltcollab_sse2neon",
-        sha256 = "06f4693219deccb91b457135d836fc514a1c0a57e9fa66b143982901d2d19677",
-        strip_prefix = "sse2neon-1.6.0",
+        sha256 = "66e3d92571bfc9ce05dc1737421ba2f68e1fcb4552def866055676619955bdaa",
+        strip_prefix = "sse2neon-fb160a53e5a4ba5bc21e1a7cb80d0bd390812442",
         type = "tar.gz",
         urls = [
-            "https://github.com/DLTcollab/sse2neon/archive/refs/tags/v1.6.0.tar.gz",
+            "https://github.com/DLTcollab/sse2neon/archive/fb160a53e5a4ba5bc21e1a7cb80d0bd390812442.tar.gz",
         ],
         build_file = "@yacl//bazel:sse2neon.BUILD",
     )
@@ -314,15 +314,15 @@ def _com_github_libtom_libtommath():
     maybe(
         http_archive,
         name = "com_github_libtom_libtommath",
-        sha256 = "60f9955270032bc548b5ba1823ace419f704df280b4570d508c3fb8e73bdf012",
+        sha256 = "da0759723645d974b82f134a26a1933a08fee887580132f55482c606ec688188",
         type = "tar.gz",
-        strip_prefix = "libtommath-0df542cb70f621bbeec207be1949832fb1442479",
+        strip_prefix = "libtommath-7f96509df1a6b44867bbda56bbf2cb92524be8ef",
         patch_args = ["-p1"],
         patches = [
             "@yacl//bazel:patches/libtommath.patch",
         ],
         urls = [
-            "https://github.com/libtom/libtommath/archive/0df542cb70f621bbeec207be1949832fb1442479.tar.gz",
+            "https://github.com/libtom/libtommath/archive/7f96509df1a6b44867bbda56bbf2cb92524be8ef.tar.gz",
         ],
         build_file = "@yacl//bazel:libtommath.BUILD",
     )

bazel/yacl.bzl

@@ -23,13 +23,7 @@ WARNING_FLAGS = [
     "-Wall",
     "-Wextra",
     "-Werror",
-    "-Wno-unused-parameter",
-    "-Wnon-virtual-dtor",
-] + select({
-    "@bazel_tools//src/conditions:linux_aarch64": ["-Wno-uninitialized"],
-    "@bazel_tools//src/conditions:darwin": ["-Wunused-const-variable"],
-    "//conditions:default": ["-Wunused-const-variable=1"],
-})
+]
 
 # set `SPDLOG_ACTIVE_LEVEL=1(SPDLOG_LEVEL_DEBUG)` to enable debug level log
 DEBUG_FLAGS = ["-DSPDLOG_ACTIVE_LEVEL=1", "-O0", "-g"]
@@ -39,8 +33,7 @@ FAST_FLAGS = ["-O1"]
 AES_COPT_FLAGS = select({
     "@platforms//cpu:aarch64": ["-O3"],
     "//conditions:default": [
-        "-march=haswell",
-        "-mavx2",
+        "-mavx",
         "-maes",
     ],
 })

yacl/base/exception.h

@@ -86,8 +86,7 @@ class Exception : public std::exception {
   Exception() = default;
   explicit Exception(std::string msg) : msg_(std::move(msg)) {}
   explicit Exception(const char* msg) : msg_(msg) {}
-  explicit Exception(std::string msg, void** stacks, int dep)
-      : msg_(std::move(msg)) {
+  explicit Exception(const std::string& msg, void** stacks, int dep) {
     for (int i = 0; i < dep; ++i) {
       std::array<char, 2048> tmp;
       const char* symbol = "(unknown)";
@@ -96,6 +95,8 @@ class Exception : public std::exception {
       }
       stack_trace_.append(fmt::format("#{} {}+{}\n", i, symbol, stacks[i]));
     }
+
+    msg_ = fmt::format("{}\nStacktrace:\n{}", msg, stack_trace_);
   }
   const char* what() const noexcept override { return msg_.c_str(); }
 

yacl/base/int128.h

@@ -76,14 +76,31 @@ std::pair<uint64_t, uint64_t> DecomposeUInt128(uint128_t v);
 
 }  // namespace yacl
 
-#ifdef __GNUC__
+#if !defined(__GNUC__)
+#error "YACL only supports GCC and clang"
+#endif
+
+#if defined(__GLIBCXX_TYPE_INT_N_0) && (__GLIBCXX_TYPE_INT_N_0 == __int128)
+#define WITH_GLIBCXX_INT128
+#endif
+
+#if defined(_LIBCPP_HAS_NO_INT128)
+#define WITHOUT_CLANG_INT128
+#endif
+
+#ifdef __clang__  // clang mode
 #define HAS_INT128_LIMITS
-#if defined(__clang__) || \
-    (defined(__GLIBCXX_TYPE_INT_N_0) && (__GLIBCXX_TYPE_INT_N_0 == __int128))
+#if defined(__GLIBCXX__) || defined(__GLIBCPP__)  // clang with libstdc++
+#ifdef WITH_GLIBCXX_INT128
+#define HAS_INT128_TRAITS
+#endif
+#elif !defined(WITHOUT_CLANG_INT128)
+#define HAS_INT128_TRAITS
+#endif
+#else  // gcc
+#ifdef WITH_GLIBCXX_INT128
 #define HAS_INT128_TRAITS
 #endif
-#else
-#error "YACL only supports GCC and clang"
 #endif
 
 namespace std {