bazelbuild / bazelbuild/bazel

Bazel Build on JAVA still ignores system cacert

Open
#16,223 3 comments 0 reactions 0 assignees View on GitHub
help wanted P3 team-OSS type: bug
Dominant language
Java
Stars
25.8k
Forks
4.6k
Avg merge
2d 20h
Merged PRs (30d)
72

Description

### Description of the bug:

I tried installing bazel build from source and it fails with:
`
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to the requested target.`

We are using a self-signed certficate from our firewall and it is already installed on Ubuntu trusted store as well as it can be seen in java cacerts.
![Screen Shot 2022-08-30 at 3 58 12 PM](https://user-images.githubusercontent.com/91107048/188527981-e5b053c6-4cc7-4bfe-a8e8-3110bf7ae046.png)
![Screen Shot 2022-08-30 at 2 42 36 PM](https://user-images.githubusercontent.com/91107048/188528123-c1f86cc5-a6e3-4f54-aa53-5ffba2386cc8.png)

However, after applying this workaround: https://github.com/bazelbuild/bazel/issues/5741 the issue is resolved. Is there already a proper solution to this one or is self-signed certificate not advisable?

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

1. A machine with ubuntu
2. Have a self-signed certificate from firewall
3. Build bazel from source using bazel version 4.2.1 or 5.1.1

### Which operating system are you running Bazel on?

Ubuntu 20.04

### What is the output of `bazel info release`?

_No response_

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

I used this one as guide to build bazel:
https://github.com/grpc/grpc/blob/master/BUILDING.md

### What's the output of `git remote get-url origin; git rev-parse master; git rev-parse HEAD` ?

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the source build on Ubuntu 20.04 using the steps from the linked grpc BUILDING.md guide and a firewall self-signed certificate. Compare the failure with the workaround in Bazel issue #5741; the issue is resolved when the system certificate works without that workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, ubuntu
Domain
build-system, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.