Use of --credential_helper flag causes Bazelisk to exit with code 37

[mmellin]

Overview

Including the flag --credential_helper= with nearly any value seems to cause Bazelisk to crash and exit with code 37.

$ bazel info; echo $?
37

This stems from me trying out the new rules_apko ruleset and found that their requirement of using --credential_helper= statements in the .bazelrc files seems to break Bazelisk.

Their generated .apko/.bazelrc:

# Generated by apko_bazelrc. DO NOT EDIT
# Required for making http range requests when fetching the apk packages.
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requests

common --credential_helper="dl-cdn.alpinelinux.org=%workspace%/.apko/range.sh"
common --credential_helper="packages.wolfi.dev=%workspace%/.apko/range.sh"

I tried simply using only the common --credential_helpers=<value> in my main .bazelrc and I get the same behavior. Removing them solved the problem.

I found this line from https://github.com/bazelbuild/proposals/blob/main/designs/2022-06-07-bazel-credential-helpers.md which might help explain:

In case there are multiple credential helpers specified, Bazel will use the most specific match to fetch credentials. If there is no credential helper matching the remote service, Bazel will not invoke any helpers and send no credentials (i.e., there's no implicit default credential helper).

Questions

• Is there a workaround or --credentials_helper= value that can be used to fix this problem?

Environment

$ bazel info
Starting local Bazel server and connecting to it...
(14:21:18) INFO: Invocation ID: ded293e4-2a35-4232-a3bf-1f2bff4fffa7
bazel-bin: /private/var/tmp/_bazel_myuser/3a5735af52280ca61809fbf75ebc1ea4/execroot/_main/bazel-out/darwin-fastbuild/bin
bazel-genfiles: /private/var/tmp/_bazel_myuser/3a5735af52280ca61809fbf75ebc1ea4/execroot/_main/bazel-out/darwin-fastbuild/bin
bazel-testlogs: /private/var/tmp/_bazel_myuser/3a5735af52280ca61809fbf75ebc1ea4/execroot/_main/bazel-out/darwin-fastbuild/testlogs
character-encoding: file.encoding = ISO-8859-1, defaultCharset = ISO-8859-1
command_log: /private/var/tmp/_bazel_myuser/3a5735af52280ca61809fbf75ebc1ea4/command.log
committed-heap-size: 268MB
execution_root: /private/var/tmp/_bazel_myuser/3a5735af52280ca61809fbf75ebc1ea4/execroot/_main
gc-count: 4
gc-time: 22ms
install_base: /var/tmp/_bazel_myuser/install/3b6d3b89ac6edd12cb24971ba5ddc98f
java-home: /private/var/tmp/_bazel_myuser/install/3b6d3b89ac6edd12cb24971ba5ddc98f/embedded_tools/jdk
java-runtime: OpenJDK Runtime Environment (build 11.0.6+10-LTS) by Azul Systems, Inc.
java-vm: OpenJDK 64-Bit Server VM (build 11.0.6+10-LTS, mixed mode) by Azul Systems, Inc.
max-heap-size: 4294MB
output_base: /private/var/tmp/_bazel_myuser/3a5735af52280ca61809fbf75ebc1ea4
output_path: /private/var/tmp/_bazel_myuser/3a5735af52280ca61809fbf75ebc1ea4/execroot/_main/bazel-out
package_path: %workspace%
release: release 6.3.2
repository_cache: /Users/myuser/.cache/bazel/project1_repo_cache
server_log: /private/var/tmp/_bazel_myuser/3a5735af52280ca61809fbf75ebc1ea4/java.log.myuser-mbp.myuser.log.java.20231020-142116.19685
server_pid: 19685
used-heap-size: 39MB
workspace: /Users/myuser/git/project1

$ bazel version
Bazelisk version: v1.18.0
Build label: 6.3.2
Build target: bazel-out/darwin-opt/bin/src/main/java/com/google/devtools/build/lib/bazel/BazelServer_deploy.jar
Build time: Tue Aug 8 15:58:06 2023 (1691510286)
Build timestamp: 1691510286
Build timestamp as int: 1691510286

WORKSPACE + MODULE.bazel with common --enable_bzlmod.

Bazelisk installed as Bazel.

Rules_apko v0.2.3.

I see the same behavior on Mac and Ubuntu 20.04 with same bazelisk. Also tried with Bazel 6.4.0 with same outcome.

[mmellin]

Ok, after all that it turns out to be if the value is non-existent or not executable, then you have this issue. I guess that's a bit of a "duh" moment.

The fix was to add execution permissions to .apko/range.sh created by rules_apko.

$ stat -f '%A %a %N' ./.apko/range.sh 
644 1697832095 ./.apko/range.sh

$ chmod u+x .apko/range.sh 
$ stat -f '%A %a %N' ./.apko/range.sh 
744 1697832095 ./.apko/range.sh

$ bazel info; echo $?
...truncated...
0

[coeuvre]

cc @tjgq

[tjgq]

A non-executable credential helper should display a proper error message starting from Bazel 7 (8cd6c43). I'll see if the fix can be backported to 6.x.