Skip to content

Conversation

@octo-sts
Copy link
Contributor

@octo-sts octo-sts bot commented Jul 27, 2025

@octo-sts octo-sts bot added request-version-update request for a newer version of a package automated pr binutils P1 This label indicates our scanning found High, Medium or Low CVEs for these packages. labels Jul 27, 2025
@octo-sts
Copy link
Contributor Author

octo-sts bot commented Jul 27, 2025

🔄 Build Failed: Git Checkout Error

FAIL Expected commit 815d9a14cbbb3b81843f7566222c87fb22e7255d for binutils-2_45, found 2bc7af1ff7732451b6a7b09462a815c3284f9613

Build Details

Category Details
Build System melange
Failure Point git checkout in the git-checkout step

Root Cause Analysis 🔍

The build expected a specific commit hash (815d9a14cbbb3b81843f7566222c87fb22e7255d) when checking out the binutils-2_45 tag, but found a different commit hash (2bc7af1ff7732451b6a7b09462a815c3284f9613). This indicates that the Git repository tag may have been updated or force-pushed since the package definition was created.


🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

Suggested Changes

File: binutils.yaml

  • replace at line 51 (expected-commit value in git-checkout step)
    Original:
expected-commit: 815d9a14cbbb3b81843f7566222c87fb22e7255d

Replacement:

expected-commit: 2bc7af1ff7732451b6a7b09462a815c3284f9613

Content:

      expected-commit: 2bc7af1ff7732451b6a7b09462a815c3284f9613
Click to expand fix analysis

Analysis

The pattern observed across all similar fixed build failures is that the Git repository tag was updated or force-pushed, causing a mismatch between the expected commit hash and the actual commit hash. In all three examples, the solution was to update the expected-commit hash in the melange YAML file to match the current commit hash for the specified tag. Some fixes also involved incrementing the epoch or version number to signal a package update, though you've asked to ignore epoch bumps. The key pattern is keeping the expected-commit hash in sync with the current state of the repository tag.

Click to expand fix explanation

Explanation

The build is failing because the expected commit hash (815d9a14cbbb3b81843f7566222c87fb22e7255d) for the binutils-2_45 tag no longer matches the actual commit hash (2bc7af1ff7732451b6a7b09462a815c3284f9613) in the repository. This discrepancy occurs when the upstream repository either retagged the binutils-2_45 release or force-pushed changes to the tag.

By updating the expected-commit hash to match the current commit that the tag points to (2bc7af1ff7732451b6a7b09462a815c3284f9613), we're telling the build system to expect the new commit hash instead of the old one. This simple change aligns the package definition with the current state of the upstream repository.

This is a common scenario in Git-based package management where tags in upstream repositories can sometimes change. The Wolfi build system is correctly detecting this change and preventing a potentially unexpected build by requiring an explicit acknowledgment of the new commit hash.

Click to expand alternative approaches

Alternative Approaches

  • You could also consider using a specific commit hash instead of a tag if you need to pin to a specific version that won't change, but this would make updates more difficult to track.
  • If you believe the tag change might be temporary or incorrect, you could reach out to the upstream maintainers to verify if the tag change was intentional before updating your expected commit hash.
  • Rather than updating the expected-commit, you could fork the repository at the specific commit you want and point to your fork instead, giving you more control over the source code used for builds.

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

@octo-sts octo-sts bot added the ai/skip-comment Stop AI from commenting on PR label Jul 27, 2025
@OddBloke OddBloke self-assigned this Jul 28, 2025
@OddBloke OddBloke force-pushed the wolfictl-1c567472-108c-4cc9-8896-d9a7ad25a635 branch from dd3490a to 42bf818 Compare July 28, 2025 14:39
@octo-sts octo-sts bot added the bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages. label Jul 28, 2025
@OddBloke OddBloke requested a review from a team July 28, 2025 14:48
@OddBloke OddBloke enabled auto-merge July 28, 2025 14:48
@OddBloke OddBloke merged commit fa51399 into main Jul 28, 2025
18 checks passed
@OddBloke OddBloke deleted the wolfictl-1c567472-108c-4cc9-8896-d9a7ad25a635 branch July 28, 2025 15:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ai/skip-comment Stop AI from commenting on PR automated pr bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages. binutils manual/review-needed P1 This label indicates our scanning found High, Medium or Low CVEs for these packages. request-version-update request for a newer version of a package

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants