Issues in bazel build chain (from OSS-Fuzz)

[DavidKorczynski]

Hi all!

OSS-Fuzz is running into an issue when building the java base image, with the following error:

8.552 HEAD is now at b12d1ea8 deploy: Prepare release v0.17.1
8.552 + cat
8.554 + bazel build //src/main/java/com/code_intelligence/jazzer:jazzer_standalone_deploy.jar //deploy:jazzer-api //launcher:jazzer
8.562 2024/02/18 21:37:30 Using unreleased version at commit 8482c7cf494686eb7498cec6ee58dad03b07ef0d
8.562 2024/02/18 21:37:30 Downloading https://storage.googleapis.com/bazel-builds/artifacts/ubuntu1404/8482c7cf494686eb7498cec6ee58dad03b07ef0d/bazel...
10.85 Extracting Bazel installation...
13.22 Starting local Bazel server and connecting to it...
14.51 Loading: 
15.51 Loading: 
16.51 Loading: 
17.75 Loading: 
18.46 WARNING: Download from https://github.com/grailbio/bazel-toolchain/archive/refs/tags/0.6.3.tar.gz failed: class com.google.devtools.build.lib.bazel.repository.downloader.UnrecoverableHttpException Checksum was a0a45349bf5d57bbefe2669225cda802c5d9ab8ea412a5e683f52bdcf3f16c65 but wanted da607faed78c4cb5a5637ef74a36fdd2286f85ca5192222c4664efec2d529bb8
18.46 INFO: Repository com_grail_bazel_toolchain instantiated at:
18.46   /src/jazzer/WORKSPACE.bazel:34:13: in <toplevel>
18.46 Repository rule http_archive defined at:
18.46   /root/.cache/bazel/_bazel_root/e3c2be7f6be7a238950c8073a90fc93c/external/bazel_tools/tools/build_defs/repo/http.bzl:372:31: in <toplevel>
18.47 ERROR: An error occurred during the fetch of repository 'com_grail_bazel_toolchain':
18.47    Traceback (most recent call last):
18.47   File "/root/.cache/bazel/_bazel_root/e3c2be7f6be7a238950c8073a90fc93c/external/bazel_tools/tools/build_defs/repo/http.bzl", line 132, column 45, in _http_archive_impl
18.47           download_info = ctx.download_and_extract(
18.47 Error in download_and_extract: java.io.IOException: Error downloading [https://github.com/grailbio/bazel-toolchain/archive/refs/tags/0.6.3.tar.gz] to /root/.cache/bazel/_bazel_root/e3c2be7f6be7a238950c8073a90fc93c/external/com_grail_bazel_toolchain/temp6596007316104794476/0.6.3.tar.gz: Checksum was a0a45349bf5d57bbefe2669225cda802c5d9ab8ea412a5e683f52bdcf3f16c65 but wanted da607faed78c4cb5a5637ef74a36fdd2286f85ca5192222c4664efec2d529bb8
18.47 ERROR: /src/jazzer/WORKSPACE.bazel:34:13: fetching http_archive rule //external:com_grail_bazel_toolchain: Traceback (most recent call last):
18.47   File "/root/.cache/bazel/_bazel_root/e3c2be7f6be7a238950c8073a90fc93c/external/bazel_tools/tools/build_defs/repo/http.bzl", line 132, column 45, in _http_archive_impl
18.47           download_info = ctx.download_and_extract(
18.47 Error in download_and_extract: java.io.IOException: Error downloading [https://github.com/grailbio/bazel-toolchain/archive/refs/tags/0.6.3.tar.gz] to /root/.cache/bazel/_bazel_root/e3c2be7f6be7a238950c8073a90fc93c/external/com_grail_bazel_toolchain/temp6596007316104794476/0.6.3.tar.gz: Checksum was a0a45349bf5d57bbefe2669225cda802c5d9ab8ea412a5e683f52bdcf3f16c65 but wanted da607faed78c4cb5a5637ef74a36fdd2286f85ca5192222c4664efec2d529bb8
18.48 ERROR: Error computing the main repository mapping: no such package '@com_grail_bazel_toolchain//toolchain': java.io.IOException: Error downloading [https://github.com/grailbio/bazel-toolchain/archive/refs/tags/0.6.3.tar.gz] to /root/.cache/bazel/_bazel_root/e3c2be7f6be7a238950c8073a90fc93c/external/com_grail_bazel_toolchain/temp6596007316104794476/0.6.3.tar.gz: Checksum was a0a45349bf5d57bbefe2669225cda802c5d9ab8ea412a5e683f52bdcf3f16c65 but wanted da607faed78c4cb5a5637ef74a36fdd2286f85ca5192222c4664efec2d529bb8
------
Dockerfile:24
--------------------
  22 |     ENV JAZZER_API_PATH "/usr/local/lib/jazzer_api_deploy.jar"
  23 |     
  24 | >>> RUN install_java.sh
--------------------

Is this something you can assist with?

Ref: google/oss-fuzz#11613

[DavidKorczynski]

I guess the solution here is really just to bump jazzer on OSS-Fuzz?

[DavidKorczynski]

I suggested a fix on OSS-Fuzz here: google/oss-fuzz#11614

This was the analysis I ended with:

This dependency in jazzer's WORKSPACE:

http_archive(
    name = "com_grail_bazel_toolchain",
    sha256 = "da607faed78c4cb5a5637ef74a36fdd2286f85ca5192222c4664efec2d529bb8",
    strip_prefix = "bazel-toolchain-0.6.3",
    urls = ["https://github.com/grailbio/bazel-toolchain/archive/refs/tags/0.6.3.tar.gz"],
)

is no longer valid. The URL now downloads toolchains_llvm-0.6.3 instead, and this looks to be because they renamed the repo https://github.com/grailbio/bazel-toolchain which now redirects to https://github.com/bazel-contrib/toolchains_llvm

I did a quick fix in OSS-Fuzz but I think it may not be enough for this repo (since I just rename/change the sum of the minimum).

[bertschneider]

Glad, that you already found a workaround. And indeed, a simple dependency update does not seem to work for Jazzer. We will look into into it.

[bertschneider]

Now the dependency points to the new location. Could you give it another try with the current main branch?

[DavidKorczynski]

Thanks @bertschneider -- am testing the latest on OSS-Fuzz now