Bazel: Ubuntu 18.04 / Miniconda: Empty trust anchor

[Hoeze]

Description of the problem / feature request:

When installing Bazel on Ubuntu 18.04 or installing Bazel on Miniconda, I get the following error message whenever I try to build something:

java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

Bugs: what's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Install Ubuntu 18.04 or Miniconda and try to run Bazel on it

What operating system are you running Bazel on?

Ubuntu 18.04

What's the output of bazel info release?

Miniconda: release 0.11.1- (@non-git)
Ubuntu 18.04: release 0.12.0

If bazel info release returns "development version" or "(@non-git)", tell us how you built Bazel.

Miniconda: conda install bazel

Have you found anything relevant by searching the web?

Seems like a problem with the CA certificates.
I tried the fix from here: https://github.com/bazelbuild/bazel/issues/4332

$ sudo apt-get install ca-certificates-java
$ sudo update-ca-certificates -f
$ bazel shutdown

Nothing changed.

Any other information, logs, or outputs that you want to share?

I tried compiling tensorflow:

bazel build --config=mkl --config=opt //tensorflow/tools/pip_package:build_pip_package
.........
ERROR: error loading package '': Encountered error while reading extension file 'closure/defs.bzl': no such package '@io_bazel_rules_closure//closure': Error downloading [https://mirror.bazel.build/github.com/bazelbuild/rules_closure/archive/dbb96841cc0a5fb2664c37822803b06dab20c7d1.tar.gz, https://github.com/bazelbuild/rules_closure/archive/dbb96841cc0a5fb2664c37822803b06dab20c7d1.tar.gz] to /home/hoelzlwimmerf/.cache/bazel/_bazel_hoelzlwimmerf/20b747b5896a556e0b493e9e90c43fcf/external/io_bazel_rules_closure/dbb96841cc0a5fb2664c37822803b06dab20c7d1.tar.gz: All mirrors are down: [java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]
ERROR: error loading package '': Encountered error while reading extension file 'closure/defs.bzl': no such package '@io_bazel_rules_closure//closure': Error downloading [https://mirror.bazel.build/github.com/bazelbuild/rules_closure/archive/dbb96841cc0a5fb2664c37822803b06dab20c7d1.tar.gz, https://github.com/bazelbuild/rules_closure/archive/dbb96841cc0a5fb2664c37822803b06dab20c7d1.tar.gz] to /home/hoelzlwimmerf/.cache/bazel/_bazel_hoelzlwimmerf/20b747b5896a556e0b493e9e90c43fcf/external/io_bazel_rules_closure/dbb96841cc0a5fb2664c37822803b06dab20c7d1.tar.gz: All mirrors are down: [java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]
INFO: Elapsed time: 16.764s
FAILED: Build did NOT complete successfully (0 packages loaded)

[meteorcloudy]

@jart Can you take a look at this?

[skywalkerytx]

same error without miniconda.
using ubuntu18.04LTS with default-jdk ,which is java10
meet this error when trying to compile tensorflow:v1.8.0
using deb downloaded in releases/0.12.0
however, if i use the same bazel deb in docker image nvidia/cuda:9.1-cudnn7-devel, which is 16.04LTS, everything works fine.

[gorset]

We experienced the same problem when using bazel-0.13.0-linux-x86_64 as tools/bazel. We managed to solve it by switching to bazel-real from bazel-0.13.0-installer-linux-x86_64.sh (copied bazel-real to tools/bazel). I was surprised to see that these two binaries are different. Removing tools/bazel and using bazel from the installer installed to /usr/local/{bin,share/bazel} worked too, of course.

[meteorcloudy]

@ulfjack Any idea on this?

[tmysik]

The problem seems to be in Ubuntu. This workaround works for me:

• download Oracle JDK
• copy its cacerts to /etc/ssl/certs/java

This should work.
(Of course, one can use the downloaded Oracle JDK directly and it should work as well.)

[jart]

Yes this is purely Java system environment issue. We had someone file a similar issue with TensorFlow a long time in the past. I'd be highly surprised if it had anything to do with TF or Bazel.

[gorset]

Yes, sounds like it. The reason why bazel-0.13.0-linux-x86_64 was not working for us is that it's not bundling the jdk, while bazel-0.13.0-installer-linux-x86_64.sh is. This is not entire obvious unless you look at the file size.

[plumbusfactory]

@tmysik Your answer just saved me from 2 hours of frustration

[antoncyrol]

Could anyone explain to non-experts like me what @tmysik means by

copy its cacerts to /etc/ssl/certs/java ?

(I don't want to risk screwing up my newly installed 18.04 ... thanks a lot!)

[tmysik]

@antoncyrol

cp -i /path/to/oracle-jdk/jre/lib/security/cacerts /etc/ssl/certs/java

Of course, it is a good idea to make a backup of /etc/ssl/certs/java/cacerts first ;)

[Hoeze]

Why the hell does bazel require custom certificates from Oracle?!?

[cacsar]

I believe this is the appropriate Ubuntu issue. https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/1770553 . Basically Ubuntu 18.04 appears to have shipped with a truststore for Java that is incompatible with the java used by default for many tools including maven.

[dslomov]

I believe this is now fixed