Bazel build fails with "Error cloning repository" but only on Circle CI

Build Environment
1

We are trying to run bazel build //… on a custom base container. The build is successfully locally, successful in the base container when run outside of Circle CI, but when run on Circle CI fails with

Error cloning repository: ssh://git@github.com/bazelbuild/bazel-skylib: Algorithm negotiation fail caused by ssh://git@github.com/bazelbuild/bazel-skylib.

Could this be related to this angular build error https://github.com/angular/angular/issues/22405 which suggest this github change https://blog.github.com/2018-02-23-weak-cryptographic-standards-removed/ as a possible cause?

We have replaced all git_repository rules with http_archive rules, but still get the failure.

2

Is the custom container of the same hash both local and remote? My custom images are build both locally and remotely, and I suspect they often come out of sync!

3

hi @halfer - thanks for the suggestion. I checked and the container is the same hash locally and remote.

Any CircleCI employees able to weigh in on whether this could be related to the network layer?

4

This seems to be the same issue and the solution they suggest is to use http_archive instead.

Is there anyway to keep using git_repository?

5

I don’t know if you can keep using git_repository, but we have been using http_archive with exact commits like this:

SHA256 = "<sha256>"

http_archive(
  name = "rule_name",
  sha256 = SHA256,
  url = "https://github.com/<org>/<repo>/archive/<commit/tag>.tar.gz",
)

taking advantage of the auto-generated archives provided by google, and generating the sha256 ourselves offline.

6

I should add that we also ended up forking some dependencies in order to switch some git_repository to http_archive in the dependency WORKSPACE.

7

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.