Rules_docker: Incorrect sha when fetching `com_github_google_go_containerregistry`

[SrodriguezO]

🐞 bug report

Affected Rule

The com_github_google_go_containerregistry external dep loaded by container_deps()

Is this a regression?

This started happening out of the blue.

Description

We started noticing these errors in our CI this evening:

ERROR: An error occurred during the fetch of repository 'com_github_google_go_containerregistry':
    Traceback (most recent call last):
File "/.../.cache/bazel/.../external/bazel_gazelle/internal/go_repository.bzl", line 31, column 33, in _go_repository_impl
        ctx.download_and_extract(
Error in download_and_extract: java.io.IOException: Error downloading [https://api.github.com/repos/google/go-containerregistry/tarball/8a2841911ffee4f6892ca0083e89752fb46c48dd] to ... Checksum was cadb09cb5bcbe00688c73d716d1c9e774d6e4959abec4c425a1b995faf33e964 but wanted 60b9a600affa5667bd444019a4e218b7752d8500cfa923c1ac54ce2f88f773e2

Downloading the artifact directly confirms the hash is now different from that expected in [go_repositories.bzl](https://github.com/bazelbuild/rules_docker/blob/master/repositories/go_repositories.bzl) I can't find any info on this artifact online, so I haven't been able to determine if the change is expected and legitimate. I suspect this will cause issues for other rules_docker users. ## 🔬 Minimal Reproduction Add rules_docker to the workspace as shown in the README and run a build that uses the rules. ## 🔥 Exception or Error

ERROR: An error occurred during the fetch of repository 'com_github_google_go_containerregistry':
    Traceback (most recent call last):
File "/.../.cache/bazel/.../external/bazel_gazelle/internal/go_repository.bzl", line 31, column 33, in _go_repository_impl
        ctx.download_and_extract(
Error in download_and_extract: java.io.IOException: Error downloading [https://api.github.com/repos/google/go-containerregistry/tarball/8a2841911ffee4f6892ca0083e89752fb46c48dd] to ... Checksum was cadb09cb5bcbe00688c73d716d1c9e774d6e4959abec4c425a1b995faf33e964 but wanted 60b9a600affa5667bd444019a4e218b7752d8500cfa923c1ac54ce2f88f773e2

## 🌍 Your Environment **Operating System:**

  
Ubuntu 20.04
  

Output of bazel version:

  
3.7.2
  

Rules_docker version:

  
0.16.0
  

Anything else relevant?

[neakor]

We've been having this issue the whole day as well.

[friendly-pineapple]

Same here.

[umeshkumhar]

We are facing also facing the same. I wonder, we have used specific commit id to pull the rules_docker and still we are also getting same error from last 14 hrs.

Any quick fix available?

[gregmagolan]

You can patch rules_docker with a patch files such as:

diff --git a/repositories/go_repositories.bzl b/repositories/go_repositories.bzl
index 58054f7..12e93eb 100644
--- a/repositories/go_repositories.bzl
+++ b/repositories/go_repositories.bzl
@@ -39,7 +39,7 @@ def go_deps():
             name = "com_github_google_go_containerregistry",
             urls = ["https://api.github.com/repos/google/go-containerregistry/tarball/8a2841911ffee4f6892ca0083e89752fb46c48dd"],  # v0.1.4
             strip_prefix = "google-go-containerregistry-8a28419",
-            sha256 = "60b9a600affa5667bd444019a4e218b7752d8500cfa923c1ac54ce2f88f773e2",
+            sha256 = "cadb09cb5bcbe00688c73d716d1c9e774d6e4959abec4c425a1b995faf33e964",
             importpath = "github.com/google/go-containerregistry",
             type = "tar.gz",
         )

for example,

    http_archive(
        name = "io_bazel_rules_docker",
        patch_args = ["-p1"],
        patches = ["//path/to:rules_docker_bad_checksum.patch"],
        sha256 = "95d39fd84ff4474babaf190450ee034d958202043e366b9fc38f438c9e6c3334",
        strip_prefix = "rules_docker-0.16.0",
        urls = ["https://github.com/bazelbuild/rules_docker/releases/download/v0.16.0/rules_docker-v0.16.0.tar.gz"],
    )

[gregmagolan]

The tarball is generated on the fly by api.github.com so something changed upstream at github.com from the looks of it

[naturalwarren]

The tarball is generated on the fly by api.github.com so something changed upstream at github.com from the looks of it

Yeah it did. To work around we re-uploaded a cached version of the original artifact to our artifact server, then forked this project to resolve against our server.

[ash2k]

I think the best way to fix it is to change all go_repository targets to use go module mode. https://github.com/bazelbuild/bazel-gazelle/blob/master/repository.rst#go_repository

[SrodriguezO]

It seems rules_docker is trying to use this project: https://github.com/google/go-containerregistry/releases/tag/v0.1.4

Oddly, neither the hash we're expecting 60b9a600affa5667bd444019a4e218b7752d8500cfa923c1ac54ce2f88f773e2 nor the hash we're getting cadb09cb5bcbe00688c73d716d1c9e774d6e4959abec4c425a1b995faf33e964 match any of the artifacts (or the source tar) for the version we're using (v0.1.4). I'm not sure how the artifact in https://api.github.com/repos/google/go-containerregistry/tarball/8a2841911ffee4f6892ca0083e89752fb46c48dd is controlled, but it seems safer to use the artifacts from the repo directly.

[uhthomas]

I've written some thoughts in the PR which fixes this. https://github.com/bazelbuild/rules_docker/pull/1815#discussion_r619684805

It looks like it could be related to how Kubernetes was embedding versions into the source code.

I've also opened https://github.com/google/go-containerregistry/issues/997 to see if we can get a more concrete answer. I imagine there's going to be a lot of work next week to fix upstream dependencies.

[rockwotj]

Just as an FYI you don't need to patch or fork this project to fix this issue. Pre-existing deps are ignored so if you just declare this dep before you load the dependencies for rules_docker then it will be resolved:

go_repository(
            name = "com_github_google_go_containerregistry",
            commit = "efb2d62d93a7705315b841d0544cb5b13565ff2a",
            importpath = "github.com/google/go-containerregistry",
        )

(This is the updated dep from #1829)

[asuffield]

I did a little digging and found this: https://github.com/libgit2/libgit2/issues/4343#issuecomment-328631745

TL;DR: do not use api.github.com/.../tarball links for this purposes, as their content is not expected to be byte-for-byte identical over time. Use release tarball links instead, or use a git-based downloading mode (such as go_repository's vcs or module mode).

[steeve]

Github branch/commit tarballs are dynamically generated. Don't depend on them having a stable SHA256. If the upstream rule is not distributing built artefacts, you'll need to use git_repository or go_repository or whatever rule that is stable.

[rockwotj]

@alexeagle would it be possible to cut a patch release for this fix?

[uhthomas]

https://github.com/bazelbuild/rules_docker/releases/tag/v0.17.0 has been released, but is missing the sum attribute for the go_repository target. I would avoid pulling this in until it's fixed.

[kalbasit]

@uhthomas is there an issue open for this?

[uhthomas]

@kalbasit No, but it is being worked on https://github.com/bazelbuild/rules_docker/pull/1831#issuecomment-827171703

[FBorowiec]

Updating the WORKSPACE to use the latest docker_rules: rules_docker/releases/tag/v0.17.0 did the trick for me.

[2Kable]

Same here 0.16 wasn't working but 0.17 is good 👍

[pwaterz]

Updating docker rules worked for me as well

http_archive(
    name = "io_bazel_rules_docker",
    sha256 = "59d5b42ac315e7eadffa944e86e90c2990110a1c8075f1cd145f487e999d22b3",
    strip_prefix = "rules_docker-0.17.0",
    urls = ["https://github.com/bazelbuild/rules_docker/releases/download/v0.17.0/rules_docker-v0.17.0.tar.gz"],
)