Build failure due to SHA256 mismatch in KleidiAI
- Dominant language
- C
- Stars
- 2.5k
- Forks
- 560
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 163
Description
When building an older version of XNNPACK via TfLite 2.18.1 I encounted this build error:
> 04:16:26 – verifying file...
04:16:26 file='/home/workspace/LinuxDriverStackPublic/linux_driver_stack/build/kleidiai-download/kleidiai-prefix/src/kleidiai-cddf991af5de49fd34949fa39690e4e906e04074.zip'
04:16:26 – SHA256 hash of
04:16:26 /home/workspace/LinuxDriverStackPublic/linux_driver_stack/build/kleidiai-download/kleidiai-prefix/src/kleidiai-cddf991af5de49fd34949fa39690e4e906e04074.zip
04:16:26 does not match expected value
04:16:26 expected: '88233e427be6579560073267575f00f3b5fc370a31a43bbdd87a1810bd4bf1b6'
04:16:26 actual: '5d4fe6b12ab999b40b26fc2760b3f1e2d134029acd9546541e118494fe11fb03'
04:16:26 – **Hash mismatch, removing...**
### Overview of the problem.
The current mechanism to add KleidiAI to the XNNPACK project is to use Cmake's ExternalProject_Add. If URL_HASH is specified as a parameter the SHA256 of the archive is verified before being used. GitHub does not guarantee byte-for-byte stability of Git archives as documented [here.](https://github.blog/open-source/git/update-on-the-future-stability-of-source-code-archives-and-hashes/)
### Steps to recreate
**Requires**: aarch64 target environment, cmake and Ninja.
- git clone --recursive https://github.com/google/XNNPACK.git
- cd XNNPACK
- git checkout 6a834a09c53765bea56b8aea9a644a90564fe3a5 (this is the SHA of XNNPACK used in TfLite 2.18.1)
- cmake -S . -B build-aarch64 -GNinja -DCMAKE_BUILD_TYPE=Release -DCMAKE_TOOLCHAIN_FILE=cmake/aarch64.toolchain -DXNNPACK_BUILD_TESTS=OFF -DXNNPACK_BUILD_BENCHMARKS=OFF
### What's going on?
As outlined in the [GitHub blog](https://github.blog/open-source/git/update-on-the-future-stability-of-source-code-archives-and-hashes/) they do not permanently store archives. They are cached and, when considered stale, removed. They are recreated on demand afterwards. This will likely only effect combinations of older archives.
### Workaround
Modify ./cmake/DownloadKleidiAI.cmake to remove "HASH_URL" from ExternalProject_Add. This will avoid the SHA256 verification.
### Longer term solution.
The KleidiAI team are investigating longer term solutions but currently don't intend to fix older releases.
Contributor guide
Assessment
This issue has not been assessed yet.