Bazel build fails with "Error cloning repository" but only on Circle CI

We are trying to run bazel build //… on a custom base container. The build is successfully locally, successful in the base container when run outside of Circle CI, but when run on Circle CI fails with

Error cloning repository: ssh://git@github.com/bazelbuild/bazel-skylib: Algorithm negotiation fail caused by ssh://git@github.com/bazelbuild/bazel-skylib.

Could this be related to this angular build error https://github.com/angular/angular/issues/22405 which suggest this github change https://blog.github.com/2018-02-23-weak-cryptographic-standards-removed/ as a possible cause?

We have replaced all git_repository rules with http_archive rules, but still get the failure.

Is the custom container of the same hash both local and remote? My custom images are build both locally and remotely, and I suspect they often come out of sync!

hi @halfer - thanks for the suggestion. I checked and the container is the same hash locally and remote.

Any CircleCI employees able to weigh in on whether this could be related to the network layer?

This seems to be the same issue and the solution they suggest is to use http_archive instead.

Is there anyway to keep using git_repository?

I don’t know if you can keep using git_repository, but we have been using http_archive with exact commits like this:

SHA256 = "<sha256>"

http_archive(
  name = "rule_name",
  sha256 = SHA256,
  url = "https://github.com/<org>/<repo>/archive/<commit/tag>.tar.gz",
)

taking advantage of the auto-generated archives provided by google, and generating the sha256 ourselves offline.

I should add that we also ended up forking some dependencies in order to switch some git_repository to http_archive in the dependency WORKSPACE.

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.