Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing integrity attr on pybind11 http_archive #102

Closed
lalten opened this issue Aug 30, 2024 · 10 comments · Fixed by #103
Closed

Missing integrity attr on pybind11 http_archive #102

lalten opened this issue Aug 30, 2024 · 10 comments · Fixed by #103

Comments

@lalten
Copy link
Contributor

lalten commented Aug 30, 2024

Getting this a lot:

DEBUG: Rule 'pybind11_bazel~~internal_configure_extension~pybind11' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-QR93OAxDeYUGs57FlPx/K1MqE8TbZ0/PKxyjRO+u+2g="
DEBUG: Repository pybind11_bazel~~internal_configure_extension~pybind11 instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /mnt/data/bazel-user-root/27884f8c6ca1cf5fd7f4e20c15176f40/external/bazel_tools/tools/build_defs/repo/http.bzl:382:31: in <toplevel>

The reason is that

version = version.split(".bzl.")[0]
http_archive(
name = "pybind11",
build_file = "//:pybind11-BUILD.bazel",
strip_prefix = "pybind11-%s" % version,
urls = ["https://github.com/pybind/pybind11/archive/v%s.zip" % version],
)
doesn't pass a sha256 or integrity attr.

Would be nice to improve this :)

@drigz
Copy link

drigz commented Sep 27, 2024

Thanks for fixing this, I just looked into the warning today so perfect timing. Will you also issue a new release with the fixed internal_configure.bzl?

@jiawen
Copy link
Collaborator

jiawen commented Sep 27, 2024

Thanks for fixing this, I just looked into the warning today so perfect timing. Will you also issue a new release with the fixed internal_configure.bzl?

I'll try to find some cycles on Monday? I have never cut a release before, nor have I submitted anything to BCR. It should be straightforward but will probably take an hour or two.

@drigz
Copy link

drigz commented Sep 30, 2024

I'll try to find some cycles on Monday? I have never cut a release before, nor have I submitted anything to BCR. It should be straightforward but will probably take an hour or two.

If you only have time to create the pybind11_bazel release that's still helpful as anyone can bump the BCR version. Since there's a Release GitHub action I think you'd just need to:

git checkout main
git pull
git tag v2.13.6
git push origin v2.13.6

I expect the BCR update is slightly more involved as it requires calculation of the archive hash and duplication of the 2.12.0 directory, so let me know if you don't find time for that: https://github.com/bazelbuild/bazel-central-registry/tree/9b307de274431f4ee27fd1b787c12c19cebbc518/modules/pybind11_bazel/2.12.0

EDIT: there are instructions here to bump the version: https://github.com/bazelbuild/bazel-central-registry/blob/main/docs/README.md#contribute-a-bazel-module which says:

If you are the project owner, you can set up the Publish to BCR Github App for your repository to automatically send a PR to the BCR when cutting a new release.

@drigz
Copy link

drigz commented Oct 21, 2024

@jiawen Friendly ping to create a new tag: #102 (comment), don't worry about the BCR update if you're short on time.

@jiawen
Copy link
Collaborator

jiawen commented Oct 21, 2024

@jiawen Friendly ping to create a new tag: #102 (comment), don't worry about the BCR update if you're short on time.

Done. Sorry about that - crunch time at work yadda yadda.

@drigz
Copy link

drigz commented Oct 21, 2024

NP, a reasonable decision in hindsight as this was not as easy as it looked. The new release lacks the static archives from https://github.com/pybind/pybind11_bazel/releases/tag/v2.12.0 and the BCR refuses to use the new release: pybind11_bazel@2.13.6 is using an unstable source url: https://github.com/pybind/pybind11_bazel/archive/refs/tags/v2.13.6.zip

It seems that either you followed a different process to just pushing a tag or GitHub decided to automatically create a release, and this blocked the Release action which failed with Release.tag_name already exists.

If the former, you could presumably delete the release and then click Rerun on the action.

@jiawen
Copy link
Collaborator

jiawen commented Oct 21, 2024

Ack, it's my first raygun. Let me try that again. If you need higher bandwidth, feel free to find me at the same handle on the Bazel slack.

@jiawen
Copy link
Collaborator

jiawen commented Oct 21, 2024

@drigz Give that a spin? I think your instructions worked a lot better. I tried being lazy and doing it from the GitHub releases page and it created the tag and release but failed to actually trigger some of the actions.

@drigz
Copy link

drigz commented Oct 22, 2024

https://github.com/bazelbuild/bazel-central-registry/pull/3002/files This was not smooth, I had to extract archives to figure out prefixes to strip, manually copy and edit the MODULE.bazel etc, so if you want to try this next time maybe you should go straight to trying https://github.com/apps/publish-to-bcr.

@drigz
Copy link

drigz commented Nov 4, 2024

Final followup: renovate pulled in the new version and the warning is gone - thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants