[Bug]: Referencing tar directly allows for System32 shadowing on Windows.

[timbess]

What happened?

When using npm_import it seems that on Windows, if you have a dependency that is a .tar.bz2, it will hang forever trying to extract it.

Basically the main issue is that this is impossible to fix without doing cp $(which tar) . or somehow putting the tar executable in a place where System32 can't shadow it. Locally I edited this line to use rctx.execute([rctx.which("tar"), ...]) and it works. Though I suspect ya'll may want to use some hermetic method of accessing tar instead.

Version

Development (host) and target OS/architectures: Windows 10 and Windows 2022 (Github CI runner)

Output of bazel --version:
bazel 6.2.1

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file:
http_archive(
name = "aspect_rules_js",
sha256 = "71895e99936ab4cdb2c2ed6f076134cf5799c478c33ae3fa934f279b585a9b38",
strip_prefix = "rules_js-1.29.0",
url = "https://github.com/aspect-build/rules_js/releases/download/v1.29.0/rules_js-v1.29.0.tar.gz",
)

Language(s) and/or frameworks involved:
Javascript

How to reproduce

npm_import any .tar.bz2 on Windows.

Any other information?

I suspect these binaries may be dropped in System32 when WSL installed, but I don't know that to be the case for certain.

[timbess]

I initially filed a bug with Bazel directly and they suggested using rctx.extract BTW bazelbuild/bazel#18995

[alexeagle]

This looks great, want to send a PR for it?

[alexeagle]

Note, we are thinking of having a tar toolchain in bazel-lib: bazel-contrib/bazel-lib#470

[timbess]

I'd be happy to, but my hack seems not as nice as actually having a tar toolchain. For the time being I removed the Js build from our windows artifact, so if ya'll are already making a concerted effort to migrate to a tar toolchain, that seems like a better approach.

[alexeagle]

Oh well this is in a repository rule context, where toolchains aren't yet resolved. So I don't think the hermetic tar toolchain from bazel-lib will be useful.