Missing integrity attr on pybind11 http_archive

[lalten]

Getting this a lot:

DEBUG: Rule 'pybind11_bazel~~internal_configure_extension~pybind11' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-QR93OAxDeYUGs57FlPx/K1MqE8TbZ0/PKxyjRO+u+2g="
DEBUG: Repository pybind11_bazel~~internal_configure_extension~pybind11 instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /mnt/data/bazel-user-root/27884f8c6ca1cf5fd7f4e20c15176f40/external/bazel_tools/tools/build_defs/repo/http.bzl:382:31: in <toplevel>

The reason is that

pybind11_bazel/internal_configure.bzl

Lines 19 to 25 in 0cded48

	version = version.split(".bzl.")[0]
	http_archive(
	name = "pybind11",
	build_file = "//:pybind11-BUILD.bazel",
	strip_prefix = "pybind11-%s" % version,
	urls = ["https://github.com/pybind/pybind11/archive/v%s.zip" % version],
	)

doesn't pass a sha256 or integrity attr.

Would be nice to improve this :)

[drigz]

Thanks for fixing this, I just looked into the warning today so perfect timing. Will you also issue a new release with the fixed internal_configure.bzl?

[jiawen]

Thanks for fixing this, I just looked into the warning today so perfect timing. Will you also issue a new release with the fixed internal_configure.bzl?

I'll try to find some cycles on Monday? I have never cut a release before, nor have I submitted anything to BCR. It should be straightforward but will probably take an hour or two.

[drigz]

I'll try to find some cycles on Monday? I have never cut a release before, nor have I submitted anything to BCR. It should be straightforward but will probably take an hour or two.

If you only have time to create the pybind11_bazel release that's still helpful as anyone can bump the BCR version. Since there's a Release GitHub action I think you'd just need to:

git checkout main
git pull
git tag v2.13.6
git push origin v2.13.6

I expect the BCR update is slightly more involved as it requires calculation of the archive hash and duplication of the 2.12.0 directory, so let me know if you don't find time for that: https://github.com/bazelbuild/bazel-central-registry/tree/9b307de274431f4ee27fd1b787c12c19cebbc518/modules/pybind11_bazel/2.12.0

EDIT: there are instructions here to bump the version: https://github.com/bazelbuild/bazel-central-registry/blob/main/docs/README.md#contribute-a-bazel-module which says:

If you are the project owner, you can set up the Publish to BCR Github App for your repository to automatically send a PR to the BCR when cutting a new release.

[drigz]

@jiawen Friendly ping to create a new tag: #102 (comment), don't worry about the BCR update if you're short on time.

[jiawen]

@jiawen Friendly ping to create a new tag: #102 (comment), don't worry about the BCR update if you're short on time.

Done. Sorry about that - crunch time at work yadda yadda.

[drigz]

NP, a reasonable decision in hindsight as this was not as easy as it looked. The new release lacks the static archives from https://github.com/pybind/pybind11_bazel/releases/tag/v2.12.0 and the BCR refuses to use the new release: pybind11_bazel@2.13.6 is using an unstable source url: https://github.com/pybind/pybind11_bazel/archive/refs/tags/v2.13.6.zip

It seems that either you followed a different process to just pushing a tag or GitHub decided to automatically create a release, and this blocked the Release action which failed with Release.tag_name already exists.

If the former, you could presumably delete the release and then click Rerun on the action.

[jiawen]

Ack, it's my first raygun. Let me try that again. If you need higher bandwidth, feel free to find me at the same handle on the Bazel slack.

[jiawen]

@drigz Give that a spin? I think your instructions worked a lot better. I tried being lazy and doing it from the GitHub releases page and it created the tag and release but failed to actually trigger some of the actions.

[drigz]

https://github.com/bazelbuild/bazel-central-registry/pull/3002/files This was not smooth, I had to extract archives to figure out prefixes to strip, manually copy and edit the MODULE.bazel etc, so if you want to try this next time maybe you should go straight to trying https://github.com/apps/publish-to-bcr.

[drigz]

Final followup: renovate pulled in the new version and the warning is gone - thank you!