Add per-platform crate_universe feature and dependency exclusions

`crate_universe` resolves crate features once over the whole Cargo
workspace, so Cargo's workspace-wide feature unification activates a
feature requested by any member on the single shared target generated
for that crate, for every supported platform triple.

This forces features onto platforms that cannot build them: an
unconditional `tokio = { features = ["net"] }` anywhere in the
workspace pulls in the `net` feature for Tokio (and thus the
transitive `mio` and `socket2` dependencies). This happens even on
`wasm32-unknown-unknown`, where they do not compile.

This MR adds new `disabled_features` and `excluded_deps` attributes to
`crate.annotation` and `crate.annotation_select`. They allow a user to
trim the resolved feature and dependency sets of a crate. The removal
is scoped to a triple and it demotes a formerly unconditional value
onto the other supported triples. This way, only the named platform
loses it.

Because the trimming operates on the shared target's own resolved
attributes, it fixes the crate for every consumer at once, regardless
of which workspace member (or dev-dependency) unioned the feature in.

New unit tests have been added, as well as an integration test that
demonstrates the issue for Tokio compiled both with and without the
`net` feature.

Fixes #4163.

Author: mgeisler

.bazelci/presubmit.yml

@@ -773,6 +773,16 @@ tasks:
     run_targets:
       - "//:vendor_edit_test_in_tree"
 
+  # --- wasm_cfg_features (linux only; the wasm32 build is host-independent) ---
+  cu_integ_wasm_cfg_features_ubuntu2204:
+    name: Crate Universe - wasm_cfg_features
+    platform: ubuntu2204
+    working_directory: crate_universe/tests/integration/wasm_cfg_features
+    build_targets:
+      - "//..."
+    test_targets:
+      - "//..."
+
   example_bindgen_toolchain:
     name: Example custom bindgen toolchain registration
     platform: ubuntu2204

crate_universe/extensions.bzl

@@ -1417,6 +1417,12 @@ _ANNOTATION_SELECT_ATTRS = {
     "deps": _relative_label_list(
         doc = "A list of labels to add to a crate's `rust_library::deps` attribute.",
     ),
+    "disabled_features": attr.string_list(
+        doc = "A list of features to remove from a crate's resolved `rust_library::crate_features` attribute. Applied per-triple when set via `annotation_select`, preserving the feature on the other supported triples.",
+    ),
+    "excluded_deps": attr.string_list(
+        doc = "A list of dependency crate names to remove from a crate's resolved `rust_library::deps` attribute. Typically paired with `disabled_features` to also drop the optional dependencies a disabled feature would have activated.",
+    ),
     "link_deps": _relative_label_list(
         doc = "A list of labels to add to a crate's `rust_library::link_deps` attribute.",
     ),
@@ -1624,6 +1630,34 @@ crate = module_extension(
     doc = """\
 Crate universe module extensions.
 
+## Removing features and dependencies on specific platforms
+
+Cargo enables features additively. When one crate in the build turns on a
+feature of a shared dependency, that feature is enabled for every target that
+uses the dependency. This is usually fine, but sometimes it enables a feature on
+a platform that cannot build it.
+
+Take the `net` feature of `tokio`. It requires the `mio` and `socket2` crates,
+which do not compile for `wasm32-unknown-unknown`. If any crate in the build
+enables `net`, then `net` is enabled for `tokio` on every platform, and the Wasm
+build fails.
+
+The `disabled_features` and `excluded_deps` fields on an annotation remove
+features and dependencies from a crate. Pair them with `crate.annotation_select`
+to limit the removal to specific target triples. The feature or dependency stays
+enabled on the other triples, so only the platform you name loses it:
+
+```python
+crate.annotation_select(
+    crate = "tokio",
+    triples = ["wasm32-unknown-unknown"],
+    # For wasm32 only: drop `net` and the implicit `mio` and `socket2` features,
+    # and exclude the `mio` and `socket2` crates. `net` stays enabled elsewhere.
+    disabled_features = ["net", "mio", "socket2"],
+    excluded_deps = ["mio", "socket2"],
+)
+```
+
 Environment Variables:
 
 | variable | usage |

crate_universe/private/crate.bzl

@@ -107,6 +107,8 @@ def _annotation(
         compile_data_glob = None,
         compile_data_glob_excludes = None,
         crate_features = None,
+        disabled_features = None,
+        excluded_deps = None,
         data = None,
         data_glob = None,
         deps = None,
@@ -158,6 +160,14 @@ def _annotation(
             attribute.
         crate_features (optional): A list of strings to add to a crate's `rust_library::crate_features`
             attribute.
+        disabled_features (optional): Features to remove from a crate's resolved `crate_features`. Accepts a
+            list (applies to all platforms) or a `crate.select()` keyed by target triple (applies per-platform,
+            preserving the feature on the other supported triples). Use to remove a feature that ends up
+            activated on a platform where it cannot be built (e.g. tokio's `net` on `wasm32-unknown-unknown`).
+        excluded_deps (optional): Dependencies (by crate name) to remove from a crate's resolved `deps`. Follows
+            the same list / `crate.select()` semantics as `disabled_features` and is typically paired with it to
+            also drop the optional dependencies a disabled feature would have activated (e.g. `mio` and `socket2`
+            alongside tokio's `net`).
         data (list, optional): A list of labels to add to a crate's `rust_library::data` attribute.
         data_glob (list, optional): A list of glob patterns to add to a crate's `rust_library::data` attribute.
         deps (list, optional): A list of labels to add to a crate's `rust_library::deps` attribute.
@@ -221,6 +231,8 @@ def _annotation(
             compile_data_glob = compile_data_glob,
             compile_data_glob_excludes = compile_data_glob_excludes,
             crate_features = crate_features,
+            disabled_features = disabled_features,
+            excluded_deps = excluded_deps,
             data = _stringify_list(data),
             data_glob = data_glob,
             deps = _stringify_list(deps),

crate_universe/src/config.rs

@@ -290,6 +290,22 @@ pub(crate) struct CrateAnnotations {
     /// [crate_features](https://bazelbuild.github.io/rules_rust/defs.html#rust_library-crate_features) attribute.
     pub(crate) crate_features: Option<Select<BTreeSet<String>>>,
 
+    /// Features to remove from the target's `crate_features`. Values under a
+    /// specific target triple are dropped for that triple only (a feature that
+    /// was unconditional is preserved on the other supported triples); values
+    /// under the common configuration are dropped everywhere. Used to undo
+    /// features that whole-workspace feature unification forces onto a platform
+    /// that cannot support them (e.g. tokio's `net` on `wasm32-unknown-unknown`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub(crate) disabled_features: Option<Select<BTreeSet<String>>>,
+
+    /// Dependencies (by crate name) to remove from the target's `deps`. Follows
+    /// the same per-triple semantics as `disabled_features` and is typically
+    /// paired with it to drop the optional dependencies a disabled feature would
+    /// have activated (e.g. `mio`/`socket2` alongside tokio's `net`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub(crate) excluded_deps: Option<Select<BTreeSet<String>>>,
+
     /// Additional data to pass to  the target's
     /// [data](https://bazelbuild.github.io/rules_rust/defs.html#rust_library-data) attribute.
     pub(crate) data: Option<Select<BTreeSet<Label>>>,
@@ -452,6 +468,8 @@ impl Add for CrateAnnotations {
             proc_macro_deps: select_merge(self.proc_macro_deps, rhs.proc_macro_deps),
             link_deps: select_merge(self.link_deps, rhs.link_deps),
             crate_features: select_merge(self.crate_features, rhs.crate_features),
+            disabled_features: select_merge(self.disabled_features, rhs.disabled_features),
+            excluded_deps: select_merge(self.excluded_deps, rhs.excluded_deps),
             data: select_merge(self.data, rhs.data),
             data_glob: joined_extra_member!(self.data_glob, rhs.data_glob, BTreeSet::new, BTreeSet::extend),
             disable_pipelining: self.disable_pipelining || rhs.disable_pipelining,

crate_universe/src/context.rs

@@ -64,7 +64,7 @@ impl Context {
 
     pub(crate) fn new(annotations: Annotations, sources_are_present: bool) -> anyhow::Result<Self> {
         // Build a map of crate contexts
-        let crates: BTreeMap<CrateId, CrateContext> = annotations
+        let mut crates: BTreeMap<CrateId, CrateContext> = annotations
             .metadata
             .crates
             .values()
@@ -84,6 +84,21 @@ impl Context {
             })
             .collect::<Result<_, _>>()?;
 
+        // Apply per-platform `disabled_features` / `excluded_deps` annotations.
+        // These trim the resolver's whole-workspace feature/dependency output
+        // for specific target triples (e.g. dropping tokio's `net` feature and
+        // its `mio`/`socket2` deps on `wasm32-unknown-unknown`). Done here, after
+        // every crate context exists, because the re-pinning of a formerly
+        // unconditional value needs the full set of supported platform triples.
+        for (crate_id, context) in crates.iter_mut() {
+            if let Some(paired_extras) = annotations.pairred_extras.get(crate_id) {
+                context.apply_exclusions(
+                    &paired_extras.crate_extra,
+                    &annotations.config.supported_platform_triples,
+                );
+            }
+        }
+
         // Filter for any crate that contains a binary
         let binary_crates: BTreeSet<CrateId> = crates
             .iter()

crate_universe/src/context/crate_context.rs

@@ -6,13 +6,14 @@ use camino::Utf8PathBuf;
 use cargo_metadata::{Node, Package, PackageId};
 use serde::{Deserialize, Serialize};
 
-use crate::config::{AliasRule, CrateId, GenBinaries};
+use crate::config::{AliasRule, CrateAnnotations, CrateId, GenBinaries};
 use crate::metadata::{
     CrateAnnotation, Dependency, PairedExtras, SourceAnnotation, TreeResolverMetadata,
 };
-use crate::select::Select;
+use crate::select::{Select, SelectableOrderedValue};
 use crate::utils::sanitize_module_name;
 use crate::utils::starlark::{Glob, Label};
+use crate::utils::target_triple::TargetTriple;
 
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
 pub struct CrateDependency {
@@ -377,6 +378,93 @@ pub(crate) struct CrateContext {
     pub(crate) override_targets: BTreeMap<String, Label>,
 }
 
+/// Remove values from a `Select` according to a removal spec keyed by
+/// configuration.
+///
+/// * A name listed under the common configuration (`None`) removes every
+///   matching value from every configuration.
+/// * A name listed under a specific target triple removes matching values for
+///   that triple only. A matching value that was unconditional (`common`) is
+///   first demoted onto every *other* supported triple so those platforms keep
+///   it; only the named triple loses it.
+///
+/// `matches` decides whether a value in the `Select` corresponds to a name in
+/// the removal spec (feature-name equality for `crate_features`, crate-name
+/// equality for `deps`).
+fn remove_selected<T, F>(
+    select: Select<BTreeSet<T>>,
+    removals: &Select<BTreeSet<String>>,
+    supported_platform_triples: &BTreeSet<String>,
+    matches: F,
+) -> Select<BTreeSet<T>>
+where
+    T: SelectableOrderedValue,
+    F: Fn(&T, &str) -> bool,
+{
+    let (mut common, mut selects) = select.into_parts();
+
+    // Partition the removal spec into names to drop everywhere (common) and
+    // names to drop for a specific triple.
+    let mut global: BTreeSet<String> = BTreeSet::new();
+    let mut per_triple: BTreeMap<String, BTreeSet<String>> = BTreeMap::new();
+    for (config, name) in removals.items() {
+        match config {
+            None => {
+                global.insert(name);
+            }
+            Some(triple) => {
+                per_triple.entry(triple).or_default().insert(name);
+            }
+        }
+    }
+
+    let matches_any = |value: &T, names: &BTreeSet<String>| names.iter().any(|n| matches(value, n));
+
+    // Global removals: drop from the common set and every configuration.
+    if !global.is_empty() {
+        common.retain(|value| !matches_any(value, &global));
+        for set in selects.values_mut() {
+            set.retain(|value| !matches_any(value, &global));
+        }
+    }
+
+    if !per_triple.is_empty() {
+        // Values in `common` that at least one triple wants removed must be
+        // demoted: dropped from `common` and re-pinned onto every supported
+        // triple that still wants them.
+        let demote: BTreeSet<T> = common
+            .iter()
+            .filter(|value| per_triple.values().any(|names| matches_any(value, names)))
+            .cloned()
+            .collect();
+        for value in &demote {
+            common.remove(value);
+            for triple in supported_platform_triples {
+                let removed_here = per_triple
+                    .get(triple)
+                    .is_some_and(|names| matches_any(value, names));
+                if !removed_here {
+                    selects
+                        .entry(triple.clone())
+                        .or_default()
+                        .insert(value.clone());
+                }
+            }
+        }
+
+        // Drop values that were pinned to a specific triple's set.
+        for (triple, names) in &per_triple {
+            if let Some(set) = selects.get_mut(triple) {
+                set.retain(|value| !matches_any(value, names));
+            }
+        }
+    }
+
+    selects.retain(|_, set| !set.is_empty());
+
+    Select::from_parts(common, selects)
+}
+
 impl CrateContext {
     #[allow(clippy::too_many_arguments)]
     pub(crate) fn new(
@@ -576,6 +664,46 @@ impl CrateContext {
         .with_overrides(extras))
     }
 
+    /// Apply the `disabled_features` / `excluded_deps` annotations, trimming the
+    /// resolver-provided `crate_features` and `deps` for the requested target
+    /// triples. This is the escape hatch for whole-workspace feature unification
+    /// forcing a feature (and its optional deps) onto a platform that cannot
+    /// build it — see [`crate::config::CrateAnnotations::disabled_features`].
+    pub(crate) fn apply_exclusions(
+        &mut self,
+        extra: &CrateAnnotations,
+        supported_platform_triples: &BTreeSet<TargetTriple>,
+    ) {
+        if extra.disabled_features.is_none() && extra.excluded_deps.is_none() {
+            return;
+        }
+
+        let triples: BTreeSet<String> = supported_platform_triples
+            .iter()
+            .map(TargetTriple::to_bazel)
+            .collect();
+
+        if let Some(disabled) = &extra.disabled_features {
+            let features = std::mem::take(&mut self.common_attrs.crate_features);
+            self.common_attrs.crate_features =
+                remove_selected(features, disabled, &triples, |feature, name| feature == name);
+        }
+
+        if let Some(excluded) = &extra.excluded_deps {
+            let deps = std::mem::take(&mut self.common_attrs.deps);
+            self.common_attrs.deps =
+                remove_selected(deps, excluded, &triples, |dep, name| dep.id.name == name);
+
+            // Also trim dev-dependencies: a feature unioned onto the shared
+            // target from a workspace member's dev-dependencies (e.g. a test
+            // HTTP server pulling tokio `net`) can drag the same optional deps
+            // into `deps_dev`.
+            let deps_dev = std::mem::take(&mut self.common_attrs.deps_dev);
+            self.common_attrs.deps_dev =
+                remove_selected(deps_dev, excluded, &triples, |dep, name| dep.id.name == name);
+        }
+    }
+
     fn with_overrides(mut self, extras: &BTreeMap<CrateId, PairedExtras>) -> Self {
         let id = CrateId::new(self.name.clone(), self.version.clone());
 
@@ -935,6 +1063,69 @@ mod test {
         .unwrap()
     }
 
+    fn triples(names: &[&str]) -> BTreeSet<String> {
+        names.iter().map(|n| n.to_string()).collect()
+    }
+
+    fn features(values: &[(Option<&str>, &str)]) -> Select<BTreeSet<String>> {
+        let mut select = Select::<BTreeSet<String>>::new();
+        for (config, value) in values {
+            select.insert(value.to_string(), config.map(str::to_string));
+        }
+        select
+    }
+
+    #[test]
+    fn remove_selected_demotes_unconditional_feature_off_one_triple() {
+        // `net` is unconditional (forced on by whole-workspace unification);
+        // disabling it on wasm32 must keep it active on the other triples.
+        let input = features(&[(None, "sync"), (None, "net")]);
+        let disabled = features(&[(Some("wasm32-unknown-unknown"), "net")]);
+        let supported = triples(&[
+            "wasm32-unknown-unknown",
+            "x86_64-unknown-linux-gnu",
+            "aarch64-apple-darwin",
+        ]);
+
+        let (common, selects) =
+            remove_selected(input, &disabled, &supported, |f, n| f == n).into_parts();
+
+        assert_eq!(common, triples(&["sync"]));
+        assert_eq!(selects.get("wasm32-unknown-unknown"), None);
+        assert_eq!(selects["x86_64-unknown-linux-gnu"], triples(&["net"]));
+        assert_eq!(selects["aarch64-apple-darwin"], triples(&["net"]));
+    }
+
+    #[test]
+    fn remove_selected_drops_triple_specific_value() {
+        // `net` is only present on wasm32 already; disabling it there removes it
+        // entirely without touching other triples.
+        let input = features(&[(None, "sync"), (Some("wasm32-unknown-unknown"), "net")]);
+        let disabled = features(&[(Some("wasm32-unknown-unknown"), "net")]);
+        let supported = triples(&["wasm32-unknown-unknown", "x86_64-unknown-linux-gnu"]);
+
+        let (common, selects) =
+            remove_selected(input, &disabled, &supported, |f, n| f == n).into_parts();
+
+        assert_eq!(common, triples(&["sync"]));
+        assert!(selects.is_empty());
+    }
+
+    #[test]
+    fn remove_selected_common_config_removes_everywhere() {
+        // A removal keyed to the common config drops the value from every
+        // configuration.
+        let input = features(&[(None, "net"), (Some("x86_64-unknown-linux-gnu"), "net")]);
+        let disabled = features(&[(None, "net")]);
+        let supported = triples(&["wasm32-unknown-unknown", "x86_64-unknown-linux-gnu"]);
+
+        let (common, selects) =
+            remove_selected(input, &disabled, &supported, |f, n| f == n).into_parts();
+
+        assert!(common.is_empty());
+        assert!(selects.is_empty());
+    }
+
     #[test]
     fn new_context() {
         let annotations = common_annotations();