Skip to content

Commit 14219c4

Browse files
bazel-iofmeum
bazel-io
and
fmeum
authored
[8.1.0] Use digest function matching the checksum in gRPC remote downloader (#25225)
Fixes https://bazelbuild.slack.com/archives/CA31HN1T3/p1738763759125489 Closes #25206. PiperOrigin-RevId: 724267755 Change-Id: Ia23bdae310231bd0ee5763311b948f3465aa8ed0 Commit ef45e02 Co-authored-by: Fabian Meumertzheim <[email protected]>
1 parent aa4531d commit 14219c4

File tree

2 files changed

+29
-17
lines changed

2 files changed

+29
-17
lines changed

‎src/main/java/com/google/devtools/build/lib/remote/downloader/GrpcRemoteDownloader.java

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ public class GrpcRemoteDownloader implements AutoCloseable, Downloader {
7070
private final Optional<CallCredentials> credentials;
7171
private final RemoteRetrier retrier;
7272
private final RemoteCacheClient cacheClient;
73-
private final DigestFunction.Value digestFunction;
73+
private final DigestFunction.Value defaultDigestFunction;
7474
private final RemoteOptions options;
7575
private final boolean verboseFailures;
7676
@Nullable private final Downloader fallbackDownloader;
@@ -100,7 +100,7 @@ public GrpcRemoteDownloader(
100100
Optional<CallCredentials> credentials,
101101
RemoteRetrier retrier,
102102
RemoteCacheClient cacheClient,
103-
DigestFunction.Value digestFunction,
103+
DigestFunction.Value defaultDigestFunction,
104104
RemoteOptions options,
105105
boolean verboseFailures,
106106
@Nullable Downloader fallbackDownloader) {
@@ -110,7 +110,7 @@ public GrpcRemoteDownloader(
110110
this.credentials = credentials;
111111
this.retrier = retrier;
112112
this.cacheClient = cacheClient;
113-
this.digestFunction = digestFunction;
113+
this.defaultDigestFunction = defaultDigestFunction;
114114
this.options = options;
115115
this.verboseFailures = verboseFailures;
116116
this.fallbackDownloader = fallbackDownloader;
@@ -149,7 +149,7 @@ public void download(
149149
urls,
150150
checksum,
151151
canonicalId,
152-
digestFunction,
152+
defaultDigestFunction,
153153
headers,
154154
credentials);
155155
try {
@@ -200,14 +200,12 @@ static FetchBlobRequest newFetchBlobRequest(
200200
List<URL> urls,
201201
Optional<Checksum> checksum,
202202
String canonicalId,
203-
DigestFunction.Value digestFunction,
203+
DigestFunction.Value defaultDigestFunction,
204204
Map<String, List<String>> headers,
205205
Credentials credentials)
206206
throws IOException {
207207
FetchBlobRequest.Builder requestBuilder =
208-
FetchBlobRequest.newBuilder()
209-
.setInstanceName(instanceName)
210-
.setDigestFunction(digestFunction);
208+
FetchBlobRequest.newBuilder().setInstanceName(instanceName);
211209
for (int i = 0; i < urls.size(); i++) {
212210
var url = urls.get(i);
213211
requestBuilder.addUris(url.toString());
@@ -233,12 +231,21 @@ static FetchBlobRequest newFetchBlobRequest(
233231
}
234232

235233
if (checksum.isPresent()) {
234+
requestBuilder.setDigestFunction(
235+
switch (checksum.get().getKeyType()) {
236+
case SHA1 -> DigestFunction.Value.SHA1;
237+
case SHA256 -> DigestFunction.Value.SHA256;
238+
case SHA384 -> DigestFunction.Value.SHA384;
239+
case SHA512 -> DigestFunction.Value.SHA512;
240+
case BLAKE3 -> DigestFunction.Value.BLAKE3;
241+
});
236242
requestBuilder.addQualifiers(
237243
Qualifier.newBuilder()
238244
.setName(QUALIFIER_CHECKSUM_SRI)
239245
.setValue(checksum.get().toSubresourceIntegrity())
240246
.build());
241247
} else {
248+
requestBuilder.setDigestFunction(defaultDigestFunction);
242249
// If no checksum is provided, never accept cached content.
243250
// Timestamp is offset by an hour to account for clock skew.
244251
requestBuilder.setOldestContentAccepted(

‎src/test/java/com/google/devtools/build/lib/remote/downloader/GrpcRemoteDownloaderTest.java

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
import build.bazel.remote.asset.v1.FetchGrpc.FetchImplBase;
3030
import build.bazel.remote.asset.v1.Qualifier;
3131
import build.bazel.remote.execution.v2.Digest;
32+
import build.bazel.remote.execution.v2.DigestFunction;
3233
import build.bazel.remote.execution.v2.RequestMetadata;
3334
import build.bazel.remote.execution.v2.ServerCapabilities;
3435
import com.google.auth.Credentials;
@@ -96,8 +97,10 @@ public class GrpcRemoteDownloaderTest {
9697

9798
private static final ManualClock clock = new ManualClock();
9899

100+
// Use an unusual default to verify that the hash function used to generate a given Checksum is
101+
// propagated correctly.
99102
private static final DigestUtil DIGEST_UTIL =
100-
new DigestUtil(SyscallCache.NO_CACHE, DigestHashFunction.SHA256);
103+
new DigestUtil(SyscallCache.NO_CACHE, DigestHashFunction.SHA1);
101104

102105
private final MutableHandlerRegistry serviceRegistry = new MutableHandlerRegistry();
103106
private final String fakeServerName = "fake server for " + getClass();
@@ -277,7 +280,8 @@ public void fetchBlob(
277280
@Test
278281
public void testPropagateChecksum() throws Exception {
279282
final byte[] content = "example content".getBytes(UTF_8);
280-
final Digest contentDigest = DIGEST_UTIL.compute(content);
283+
final DigestUtil digestUtil = new DigestUtil(SyscallCache.NO_CACHE, DigestHashFunction.SHA256);
284+
final Digest contentDigest = digestUtil.compute(content);
281285

282286
serviceRegistry.addService(
283287
new FetchImplBase() {
@@ -287,7 +291,7 @@ public void fetchBlob(
287291
assertThat(request)
288292
.isEqualTo(
289293
FetchBlobRequest.newBuilder()
290-
.setDigestFunction(DIGEST_UTIL.getDigestFunction())
294+
.setDigestFunction(digestUtil.getDigestFunction())
291295
.addUris("http://example.com/content.txt")
292296
.addQualifiers(
293297
Qualifier.newBuilder()
@@ -316,7 +320,8 @@ public void fetchBlob(
316320
@Test
317321
public void testRejectChecksumMismatch() throws Exception {
318322
final byte[] content = "example content".getBytes(UTF_8);
319-
final Digest contentDigest = DIGEST_UTIL.compute(content);
323+
final DigestUtil digestUtil = new DigestUtil(SyscallCache.NO_CACHE, DigestHashFunction.SHA256);
324+
final Digest contentDigest = digestUtil.compute(content);
320325

321326
serviceRegistry.addService(
322327
new FetchImplBase() {
@@ -326,7 +331,7 @@ public void fetchBlob(
326331
assertThat(request)
327332
.isEqualTo(
328333
FetchBlobRequest.newBuilder()
329-
.setDigestFunction(DIGEST_UTIL.getDigestFunction())
334+
.setDigestFunction(digestUtil.getDigestFunction())
330335
.addUris("http://example.com/content.txt")
331336
.addQualifiers(
332337
Qualifier.newBuilder()
@@ -355,7 +360,7 @@ public void fetchBlob(
355360
Optional.of(Checksum.fromString(KeyType.SHA256, contentDigest.getHash()))));
356361

357362
assertThat(e).hasMessageThat().contains(contentDigest.getHash());
358-
assertThat(e).hasMessageThat().contains(DIGEST_UTIL.computeAsUtf8("wrong content").getHash());
363+
assertThat(e).hasMessageThat().contains(digestUtil.computeAsUtf8("wrong content").getHash());
359364
}
360365

361366
@Test
@@ -382,7 +387,7 @@ public void testFetchBlobRequest() throws Exception {
382387
.isEqualTo(
383388
FetchBlobRequest.newBuilder()
384389
.setInstanceName("instance name")
385-
.setDigestFunction(DIGEST_UTIL.getDigestFunction())
390+
.setDigestFunction(DigestFunction.Value.SHA256)
386391
.addUris("http://example.com/a")
387392
.addUris("http://example.com/b")
388393
.addUris("file:/not/limited/to/http")
@@ -431,7 +436,7 @@ public void testFetchBlobRequest_withCredentialsPropagation() throws Exception {
431436
.isEqualTo(
432437
FetchBlobRequest.newBuilder()
433438
.setInstanceName("instance name")
434-
.setDigestFunction(DIGEST_UTIL.getDigestFunction())
439+
.setDigestFunction(DigestFunction.Value.SHA256)
435440
.addUris("http://example.com/a")
436441
.addQualifiers(
437442
Qualifier.newBuilder()
@@ -474,7 +479,7 @@ public void testFetchBlobRequest_withoutCredentialsPropagation() throws Exceptio
474479
.isEqualTo(
475480
FetchBlobRequest.newBuilder()
476481
.setInstanceName("instance name")
477-
.setDigestFunction(DIGEST_UTIL.getDigestFunction())
482+
.setDigestFunction(DigestFunction.Value.SHA256)
478483
.addUris("http://example.com/a")
479484
.addQualifiers(
480485
Qualifier.newBuilder()

0 commit comments

Comments
 (0)