Bazel treats local_jdk as a "can run anywhere" toolchain

[illicitonion]

Description of the bug:

I have a shell test which tries to run Java, and fetches it by adding "@bazel_tools//tools/jdk:current_java_runtime" to both toolchains and data.

If I have not configured any Java toolchains, and try to run this test from my host (which is a Mac) remotely on an Linux remote execution worker (exec=target=linux), rather than failing because no toolchain could be located, it brings along the local_jdk toolchain, which is a Mac toolchain.

This appears to be because the local_java_repository doesn't constraint the toolchain target it generates at all: https://cs.opensource.google/bazel/bazel/+/e8cedf459936895f939906474d9f9878a8a45edc:tools/jdk/local_java_repository.bzl;l=91-96

What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

BUILD file:

sh_test(
    name = "list_test",
    srcs = ["list_test.sh"],
    env = {
        "JAVA": "$(JAVA)",
    },
    toolchains = ["@bazel_tools//tools/jdk:current_java_runtime"],
    data = ["@bazel_tools//tools/jdk:current_java_runtime"],
)

list_test.sh:

#!/bin/bash -eux

if [[ "${JAVA}" == external/* ]]; then
  JAVA="${JAVA:9}"
fi
"${RUNFILES_DIR}/${JAVA}"

Command run on a Mac:

% bazel test :list_test --platforms=@some_linux_platform --extra_execution_platforms=@some_linux_platform --remote_executor=grpcs://linux-remote-execution-server

If I run locally on my Mac, I get the output of java help printed, if I run remotely, I get:

==================== Test output for //:list_test:
+ [[ external/local_jdk/bin/java == external/* ]]
+ JAVA=local_jdk/bin/java
+ /runner/build/4fde3789d4c6a2f3/root/bazel-out/darwin-fastbuild/bin/list_test.runfiles/local_jdk/bin/java
/runner/build/4fde3789d4c6a2f3/root/bazel-out/darwin-fastbuild/bin/list_test.runfiles/__main__/list_test: line 6: /runner/build/4fde3789d4c6a2f3/root/bazel-out/darwin-fastbuild/bin/list_test.runfiles/local_jdk/bin/java: cannot execute binary file: Exec format error

Which operating system are you running Bazel on?

macOS

What is the output of bazel info release?

release 6.1.1

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse master; git rev-parse HEAD ?

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

/cc @fmeum who was helping me debug, and has #18262 as a possible solution

[fmeum]

My attempt at a fix at #18262 results in a cycle being reported - I don't know why.

[hvadehra]

We need to wait for Bazel 6.4.0 to see if #18262 fixes this.

[iancha1992]

A fix for this issue has been included in Bazel 7.0.0 RC2. Please test out the release candidate and report any issues as soon as possible. Thanks!