google / google/XNNPACK

Build failure due to SHA256 mismatch in KleidiAI

Open
#9,411 3 comments 2 reactions 0 assignees View on GitHub
Dominant language
C
Stars
2.5k
Forks
560
Avg merge
1d 6h
Merged PRs (30d)
163

Description

When building an older version of XNNPACK via TfLite 2.18.1 I encounted this build error:

> 04:16:26 – verifying file...
04:16:26 file='/home/workspace/LinuxDriverStackPublic/linux_driver_stack/build/kleidiai-download/kleidiai-prefix/src/kleidiai-cddf991af5de49fd34949fa39690e4e906e04074.zip'
04:16:26 – SHA256 hash of
04:16:26 /home/workspace/LinuxDriverStackPublic/linux_driver_stack/build/kleidiai-download/kleidiai-prefix/src/kleidiai-cddf991af5de49fd34949fa39690e4e906e04074.zip
04:16:26 does not match expected value
04:16:26 expected: '88233e427be6579560073267575f00f3b5fc370a31a43bbdd87a1810bd4bf1b6'
04:16:26 actual: '5d4fe6b12ab999b40b26fc2760b3f1e2d134029acd9546541e118494fe11fb03'
04:16:26 – **Hash mismatch, removing...**

### Overview of the problem.
The current mechanism to add KleidiAI to the XNNPACK project is to use Cmake's ExternalProject_Add. If URL_HASH is specified as a parameter the SHA256 of the archive is verified before being used. GitHub does not guarantee byte-for-byte stability of Git archives as documented [here.](https://github.blog/open-source/git/update-on-the-future-stability-of-source-code-archives-and-hashes/)

### Steps to recreate
**Requires**: aarch64 target environment, cmake and Ninja.

- git clone --recursive https://github.com/google/XNNPACK.git
- cd XNNPACK
- git checkout 6a834a09c53765bea56b8aea9a644a90564fe3a5 (this is the SHA of XNNPACK used in TfLite 2.18.1)
- cmake -S . -B build-aarch64 -GNinja -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE=cmake/aarch64.toolchain -DXNNPACK_BUILD_TESTS=OFF -DXNNPACK_BUILD_BENCHMARKS=OFF

### What's going on?
As outlined in the [GitHub blog](https://github.blog/open-source/git/update-on-the-future-stability-of-source-code-archives-and-hashes/) they do not permanently store archives. They are cached and, when considered stale, removed. They are recreated on demand afterwards. This will likely only effect combinations of older archives.

### Workaround
Modify ./cmake/DownloadKleidiAI.cmake to remove "HASH_URL" from ExternalProject_Add. This will avoid the SHA256 verification.

### Longer term solution.
The KleidiAI team are investigating longer term solutions but currently don't intend to fix older releases.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.