Skip to content

Fix for broken FIPS builds#41226

Merged
phlax merged 2 commits intoenvoyproxy:mainfrom
grnmeira:broken-fipss-build
Sep 25, 2025
Merged

Fix for broken FIPS builds#41226
phlax merged 2 commits intoenvoyproxy:mainfrom
grnmeira:broken-fipss-build

Conversation

@grnmeira
Copy link
Member

@grnmeira grnmeira commented Sep 25, 2025

This PR moved the Go dependency in FIPS builds to a Bazel http_archive. Once that was done, Bazel's filegroup doesn't seem to be dealing so well with non-UTF-8 characters present in a file name in Go's test suite, causing the build to fail.

#23 170.8 ERROR: /build/top/BUILD/envoy/build/bazel_root/base/external/boringssl_fips/BUILD.bazel:70:8: Executing genrule @@boringssl_fips//:build failed: error reading file '@@fips_go_linux_amd64//:test/fixedbugs/issue27836.dir/Þmain.go': /build/top/BUILD/envoy/build/bazel_root/base/external/fips_go_linux_amd64/test/fixedbugs/issue27836.dir/Þmain.go (No such file or directory)
#23 170.8 ERROR: /build/top/BUILD/envoy/build/bazel_root/base/external/boringssl_fips/BUILD.bazel:70:8: Executing genrule @@boringssl_fips//:build failed: 1 input file(s) are in error
#23 171.2 Target //distribution/binary:release failed to build

It's not fully understood what circumstances cause Bazel to behave like that, but it seems reasonable to remove the test directory from the exports. Once a bug is filed to the Bazel project I'll update the PR with the issue number.

Commit Message:
Additional Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

Signed-off-by: Gustavo <grnmeira@gmail.com>
@repokitteh-read-only repokitteh-read-only bot added the deps Approval required for changes to Envoy's external dependencies label Sep 25, 2025
@repokitteh-read-only
Copy link

CC @envoyproxy/dependency-shepherds: Your approval is needed for changes made to (bazel/.*repos.*\.bzl)|(bazel/dependency_imports\.bzl)|(api/bazel/.*\.bzl)|(.*/requirements\.txt)|(.*\.patch).
envoyproxy/dependency-shepherds assignee is @moderation

🐱

Caused by: #41226 was opened by grnmeira.

see: more, trace.

Signed-off-by: Gustavo <grnmeira@gmail.com>
Copy link
Member

@agrawroh agrawroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@phlax Could you please take a look as well?

Copy link
Member

@phlax phlax left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thanks @grnmeira

@phlax phlax enabled auto-merge (squash) September 25, 2025 16:47
@phlax phlax merged commit 54bcac8 into envoyproxy:main Sep 25, 2025
24 of 25 checks passed
@repokitteh-read-only repokitteh-read-only bot removed the deps Approval required for changes to Envoy's external dependencies label Sep 25, 2025
grnmeira added a commit to grnmeira/envoy that referenced this pull request Oct 17, 2025
[This PR](envoyproxy#39728) moved the Go
dependency in FIPS builds to a Bazel `http_archive`. Once that was done,
Bazel's `filegroup` doesn't seem to be dealing so well with non-UTF-8
characters present in a file name in Go's test suite, causing the build
to fail.

```
envoyproxy#23 170.8 ERROR: /build/top/BUILD/envoy/build/bazel_root/base/external/boringssl_fips/BUILD.bazel:70:8: Executing genrule @@boringssl_fips//:build failed: error reading file '@@fips_go_linux_amd64//:test/fixedbugs/issue27836.dir/Þmain.go': /build/top/BUILD/envoy/build/bazel_root/base/external/fips_go_linux_amd64/test/fixedbugs/issue27836.dir/Þmain.go (No such file or directory)
envoyproxy#23 170.8 ERROR: /build/top/BUILD/envoy/build/bazel_root/base/external/boringssl_fips/BUILD.bazel:70:8: Executing genrule @@boringssl_fips//:build failed: 1 input file(s) are in error
envoyproxy#23 171.2 Target //distribution/binary:release failed to build
```

It's not fully understood what circumstances cause Bazel to behave like
that, but it seems reasonable to remove the `test` directory from the
exports. Once a bug is filed to the Bazel project I'll update the PR
with the issue number.

Signed-off-by: Gustavo <grnmeira@gmail.com>
phlax pushed a commit that referenced this pull request Oct 17, 2025
[This PR](#39728) moved the Go
dependency in FIPS builds to a Bazel `http_archive`. Once that was done,
Bazel's `filegroup` doesn't seem to be dealing so well with non-UTF-8
characters present in a file name in Go's test suite, causing the build
to fail.

```
#23 170.8 ERROR: /build/top/BUILD/envoy/build/bazel_root/base/external/boringssl_fips/BUILD.bazel:70:8: Executing genrule @@boringssl_fips//:build failed: error reading file '@@fips_go_linux_amd64//:test/fixedbugs/issue27836.dir/Þmain.go': /build/top/BUILD/envoy/build/bazel_root/base/external/fips_go_linux_amd64/test/fixedbugs/issue27836.dir/Þmain.go (No such file or directory)
#23 170.8 ERROR: /build/top/BUILD/envoy/build/bazel_root/base/external/boringssl_fips/BUILD.bazel:70:8: Executing genrule @@boringssl_fips//:build failed: 1 input file(s) are in error
#23 171.2 Target //distribution/binary:release failed to build
```

It's not fully understood what circumstances cause Bazel to behave like
that, but it seems reasonable to remove the `test` directory from the
exports. Once a bug is filed to the Bazel project I'll update the PR
with the issue number.

Signed-off-by: Gustavo <grnmeira@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants