# bazel Published articles for bazel. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Updates on HEIR, the homomorphic encryption compiler project DevFeed: [Updates on HEIR, the homomorphic encryption compiler project]() Original publisher: [Read original article]() Published: 2026-09-04T18:53:40Z Content type: article Language: en Sources: [Jeremy Kun]() Topics: [homomorphic encryption](), [Compiler](), [Encryption](), [Cryptography](), [Machine learning](), [Inference](), [GitHub](), [bazel](), [Kaggle]() Tags: [bazel](), [ckks](), [compiler](), [cryptography](), [encryption](), [github](), [homomorphic-encryption](), [inference](), [kaggle](), [mathematics](), [ml](), [programming]() ### AI overview This companion article explains HEIR, a homomorphic encryption compiler that converts programs to operate directly on encrypted data. It discusses compiling pre-trained machine-learning models for private inference, describes the repository and setup, and reports an example involving encrypted credit-card fraud detection. ### Source excerpt On 2026-08-14 I published an article on the Google Security blog with an update on HEIR, our homomorphic encryption (HE) compiler. This is a companion article, in which I have no limits on word count or jargon, and I can feel free to be honest. So strap in. Assuming you won't read the linked corporate blog post, HEIR is a compiler that converts an input program to a program that operates directly on encrypted data. ## Dynamic Derivations + Dynamic build graphs: next steps DevFeed: [Dynamic Derivations + Dynamic build graphs: next steps]() Original publisher: [Read original article]() Author: tomberek Published: 2026-08-07T18:58:35Z Content type: opinion Language: en Sources: [Announcements - NixOS Discourse]() Topics: [Nix](), [build performance](), [systems](), [build times](), [bazel]() Tags: [announcements](), [bazel](), [build](), [ci](), [incremental](), [performant](), [ux]() ### AI overview A proposal for a Dynamic Derivations working group in the Nix ecosystem outlines collaboration goals, user-experience refinement, infrastructure needs, and adoption efforts. The post also summarizes the feature's development history and discusses potential benefits such as faster rebuilds and fine-grained incremental builds. ### Source excerpt After the long-history (see below) of Dynamic Derivations we are at a point where there are many groups exploring the feature and I am proposing a working group to: share the experiences of the implementors refine the user experience based on usage of the various PoCs determine infrastructure needs deduplicate work raise awareness build momentum for adoption ... anything else relevant I believe this feature has the potential to be a game-changer. Faster rebuilds, easier development, reduced pressure on CI systems, cacheable and alternative forms of instantiation, less need for "lang2nix", close the gap with Bazel, and fine-grained incremental builds. Along with the existing work on better schedulers, RBE-style remote builders, bytecode evaluation, parallel eval, memory optimizations (thanks @xokdvium !), and so much more - this is an exciting time for Nix and I can see DynDrvs as a way to fix some of the outstanding UX issues Nix has in day-to-day usage. There is even work to make IFD more performant, there is lots of design space to explore here. This should be a part of what Nix has to offer the world. @Ericson2314 has devoted years to this, and it deserves the payoff of becoming a mature feature. This is a call to action. Let's consider collaboration and a semimonthly meeting to at least say hello + consider next steps: Dynamic Derivations Working Group - Crab Fit History Dynamic Derivations have been in-progress for a long time. This has much of the history that I can put together. Let me know if this can be more complete. (and if anyone can help move/migrate into the wiki?) Build Systems à la Carte : 2018 RFC started Apr 2021 by @Ericson2314 and @L-as with [RFC 0092] Computed derivations by Ericson2314 - Pull Request #92 - NixOS/rfcs - GitHub (after reworking RFC 0040). Based on Initial example PoC by @L-as GitHub - L-as/nix-build.nix: nix-build.nix with RFC 92 - GitHub Content-addressed Nix Dec 2021: Implementing a content-addressed Nix by @thufschmitt. RFC Shep ## C++-техрадар: что разработчики действительно готовы брать в работу DevFeed: [C++-техрадар: что разработчики действительно готовы брать в работу]() Original publisher: [Read original article]() Author: Kaspersky\_Lab ("Лаборатория Касперского") Published: 2026-08-07T13:17:24Z Content type: article Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [C++](), [CMake](), [PostgreSQL]() Tags: [bash](), [bazel](), [c-plus-plus](), [clang](), [cmake](), [gdb](), [git](), [plus-plus-3a0baa67a2fc](), [postgresql](), [tech-radar](), [vs-code]() ### AI overview The article analyzes the C++ portion of a technical radar based on survey responses from developers at C++ Russia and HolyJS. It explains how technologies are assessed across Adopt, Trial, Assess, and Hold categories, emphasizing that the overall distribution of votes matters more than a single dominant response. The supplied evidence specifically notes CMake as a strong performer and PostgreSQL as dividing respondents. ### Source excerpt В мае на конференциях C++ Russia и HolyJS мы предложили участникам оценить технологии, инструменты и инженерные практики, с которыми они работают или за которыми следят. Так появились данные для двух технических радаров: по экосистеме C++ и по JavaScript. Сырые цифры сами по себе рассказывают немного, поэтому мы отдали результаты на разбор эксперту. Виктор Новиков, руководитель группы разработки в "Лаборатории Касперского", посмотрел на распределения голосов и поделился своим мнением, почему CMake уверенно побеждает, а PostgreSQL раскалывает аудиторию пополам. В этой статье -- его анализ C++-части исследования. Про техрадар JavaScript мы расскажем в другой статье. Посмотреть радар и принять участие в голосовании можно на странице проекта. Читать далее ## Introducing Chainguard OS Packages: Secure ingredients for custom container builds DevFeed: [Introducing Chainguard OS Packages: Secure ingredients for custom container builds]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [chainguard os](), [container images](), [Docker Hardened Images](), [Vulnerabilities](), [Linux](), [Automation](), [Dockerfile](), [Open Source](), [bazel](), [chainguard sboms](), [APK]() Tags: [apk](), [apko](), [automation](), [base-images](), [bazel](), [chainguard](), [chainguard-containers](), [chainguard-libraries](), [chainguard-os](), [chainguard-os-packages](), [chainguard-packages](), [chainguard-sboms](), [container](), [container-images](), [cve](), [dockerfiles](), [open-source](), [sboms](), [secure-software-packages](), [software-packages](), [vulnerabilities](), [zero-cve-packages]() ### AI overview Chainguard introduces Chainguard OS Packages, a service providing continuously maintained, enterprise-grade packages and base images for teams that build custom container images. Customers retain control over image composition and build tooling while Chainguard handles package sourcing, rebuilding, vulnerability remediation, and SBOM generation. ### Source excerpt Chainguard OS Packages are enterprise-grade, zero-CVE packages and base images built and continuously maintained in the Chainguard Factory. ## Everything we announced at Chainguard Assemble 2026 DevFeed: [Everything we announced at Chainguard Assemble 2026]() Original publisher: [Read original article]() Published: 2026-03-17T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Security](), [Cloud Native Ecosystem](), [Containers](), [CI/CD](), [Development](), [Open Source](), [ai-coding](), [bazel](), [Docker](), [Dockerfile]() Tags: [2026](), [ai](), [ai-agent-skills](), [ai-coding](), [bazel](), [built-from-source](), [chainguard](), [chainguard-actions](), [chainguard-agent-skills](), [chainguard-assemble](), [chainguard-catalog](), [chainguard-catalog-starter](), [chainguard-commercial-builds](), [chainguard-containers](), [chainguard-os-packages](), [chainguard-repository](), [chainguard-the-guardener](), [ci-cd](), [cve](), [tooling]() ### AI overview Chainguard Assemble 2026 presented Chainguard's response to faster AI-assisted software development and the resulting growth in open source software and security risks. Announcements included Chainguard OS Packages, Chainguard Catalog Starter, and expanded support for secure software development, CI/CD workflows, container images, and AI agent skills. ### Source excerpt Catch up on all the announcements Chainguard made at Assemble 2026, featuring AI agent skills, CI/CD workflows, and more. ## Bazel rule extensions DevFeed: [Bazel rule extensions]() Original publisher: [Read original article]() Author: Keith Smiley Published: 2025-10-31T17:00:00Z Content type: tutorial Language: en Sources: [Keith Smiley]() Topics: [Programming](), [Code](), [Polymorphism]() Tags: [bazel](), [extensions](), [inheritance]() ### AI overview This article explains Bazel 8.0 rule extensions, which let developers inherit and modify the behavior of existing rules without reimplementing them or maintaining a fork. It presents examples of post-processing rule outputs and manipulating providers, including a use case for consistent debug information across macOS and Linux. ### Source excerpt One of Bazel's best features is being able to easily write custom rules specific to your project. This is great for many use cases, but when what you really want is to enhance the behavior of existing rules, historically your options have been limited. What you would often do is wrap the existing rule in a macro, and add some number of custom rules to try and achieve the desired effect. When really what you want is to edit the existing rule, without having to re-implement all of its functionality (or maintain a fork). With Bazel 8.0, Googlers added a few new ways to extend existing rules that can help with this use case. In this post we will look at the aptly named rule extensions feature and some practical use cases I have found for it. Basic rule extensions Rule extensions allow you to inherit the behavior of an existing rule, similar to class inheritance in object-oriented programming. Importantly you can make a few modifications to augment the behavior of the rule to your liking. Let's say you have a rule that concatenates the given srcs: def _foo_impl(ctx): output = ctx.actions.declare_file("output.txt") ctx.actions.run_shell( inputs = ctx.files.srcs, outputs = [output], command = "cat {} > {}".format(" ".join([src.path for src in ctx.files.srcs]), output.path), ) return [DefaultInfo(files = depset([output]))] foo = rule( implementation = _foo_impl, attrs = { "srcs": attr.label_list(allow_files = True), }, ) Now let's assume in your project, you want the output file to be sorted. If you own the original rule you could of course change _foo_impl to handle that for you, but if you are relying on a more complex upstream rule, you may not have that luxury. Here's how we can extend this to post-process the file it produces: def _bar_impl(ctx): providers = ctx.super() # Invoke 'foo' and get the providers # NOTE: This assumes there's always only the provider we want. original_output = providers[0].files.to_list()[0] new_output = ctx.actions.declare_file("new_output.tx ## Automating code deletion with Gemini (and a little Python) DevFeed: [Automating code deletion with Gemini (and a little Python)]() Original publisher: [Read original article]() Published: 2025-04-29T00:00:00Z Content type: tutorial Language: en Sources: [technicalwriting.dev]() Topics: [Google AI](), [Python](), [API](), [Automation](), [Code](), [bazel]() Tags: [api](), [automation](), [bazel](), [build](), [code](), [gemini](), [genai](), [gn](), [python](), [script]() ### AI overview The article describes a hybrid automation workflow that uses Python for repository-wide file discovery and filtering, then uses the Gemini API to remove documentation-generation features from 235 GN build files after a migration to Bazel. ### Source excerpt Removing code from over 200 GN build files with Python and the Gemini API. ## Sphinx + Bazel: the good, the bad, and the ugly DevFeed: [Sphinx + Bazel: the good, the bad, and the ugly]() Original publisher: [Read original article]() Published: 2025-03-25T00:00:00Z Content type: opinion Language: en Sources: [technicalwriting.dev]() Topics: [bazel](), [Documentation](), [Software Engineering](), [Development]() Tags: [bazel](), [build-system](), [documentation](), [shell-script](), [software-engineering](), [sphinx]() ### AI overview An experienced technical writer discusses the strengths and weaknesses of managing Sphinx documentation projects with Bazel. The article explains how Bazel can orchestrate Sphinx workflows and describes reported maintenance and development-environment benefits, while helping readers decide whether it fits their project. ### Source excerpt Strengths and weaknesses of orchestrating Sphinx projects with Bazel. ## Orchestrate Sphinx projects with Bazel DevFeed: [Orchestrate Sphinx projects with Bazel]() Original publisher: [Read original article]() Published: 2025-03-25T00:00:00Z Content type: tutorial Language: en Sources: [technicalwriting.dev]() Topics: [bazel](), [Tutorial](), [Documentation](), [GitHub](), [GitHub Pages](), [Bash](), [Linux](), [Extension](), [Template]() Tags: [bash](), [bazel](), [build-system](), [docs](), [extension](), [github](), [github-pages](), [linux](), [repository](), [sphinx](), [tutorial]() ### AI overview An end-to-end tutorial on managing a Sphinx project with Bazel, including setup, documentation builds, local preview, extensions, and deployment to GitHub Pages. ### Source excerpt An end-to-end tutorial on managing a Sphinx project with Bazel. ## Finding unused targets with bazel DevFeed: [Finding unused targets with bazel]() Original publisher: [Read original article]() Author: Keith Smiley Published: 2025-03-24T18:00:00Z Content type: tutorial Language: en Sources: [Keith Smiley]() Topics: [Graphs](), [coding](), [Code](), [toolchains]() Tags: [bazel](), [build](), [code](), [coding](), [dependencies](), [graph](), [toolchains](), [use-cases]() ### AI overview This article explains how to use bazel query to inspect a build graph and identify unused targets. It presents a query that subtracts dependencies of top-level targets from all first-party targets, then discusses handling edge cases with kind filters and special tags such as allow-unused. It also describes tagging toolchains and other targets whose dependencies should be treated as used. ### Source excerpt Once you've fully migrated a codebase to bazel, one of the many advantages is that you can easily inspect your build graph using bazel query. One of the many things you can do with queries is write scripts to enforce coding standards, or in today's example, find unused targets that can lead to discovering unused code. The simplest version of this query starts like this: let all_targets = //... in let top_level_targets = tests($all_targets) union kind("(.*_binary) rule", $all_targets) in $all_targets - deps($top_level_targets) This initial version discovers all your first party targets, and then subtracts the dependencies of all "top level" targets, so that any remaining targets are considered unused. The idea of "top level" targets is better defined as: anything that you consider to be important enough that its dependencies are used. Depending on your codebase you might want to exclude test targets from this so that targets only in the dependencies of test targets are diagnosed as unused (this won't work if you have intentional testonly dependencies, although you could special case those as shown below). Once you have this initial query, you can start iterating in order to handle in edge cases. For example it's likely that you have some targets that aren't binaries or tests, but are considered used. There are 2 approaches I would recommend to handle this. First you can continue to build out the kind filter: kind("(.*_binary|platform|test_suite) rule", $all_targets) The downside with this approach is it can get unwieldy quickly. I like adding rules here that have many uses, but for other one off cases another approach you can use is to expand the query to look for special tags: let all_targets = //... in let top_level_targets = tests($all_targets) union kind("(.*_binary|platform|test_suite) rule", $all_targets) in let allowed_unused = attr(tags, allow-unused, $all_targets) in $all_targets - deps($top_level_targets) - $allowed_unused Then you can add tags = ["allow-un ## Bazel caching and compressed debug info DevFeed: [Bazel caching and compressed debug info]() Original publisher: [Read original article]() Author: Keith Smiley Published: 2025-02-14T18:00:00Z Content type: tutorial Language: en Sources: [Keith Smiley]() Topics: [C++](), [Caching](), [LLVM](), [gcc](), [C]() Tags: [bazel](), [build](), [c-plus-plus](), [caching](), [clang](), [cmake](), [config](), [configuration]() ### AI overview This article explains how compressing debug information can reduce C and C++ binary sizes and improve Bazel remote-cache efficiency. Using llvm-objcopy, the example reduces a roughly 536 MB binary to about 290 MB, and the authors report nearly 60% fewer cache reads after deployment. ### Source excerpt One of bazel's most attractive features is the ability for it to remotely cache artifacts to reduce unnecessary work for large builds. Unfortunately users quickly discover this comes with non-trivial financial and bandwidth implications. There are many ways, of varying difficulty, to try and improve your cache usage. From breaking unnecessary dependencies, to adding larger local storage for CI workers, builds without the bytes, build avoidance, etc. For codebases with lots of C or C++ one of the potentially easiest wins is to enable compressed debug information1. Let's look at an example from our codebase. Looking at the size of a non-trivial C++ binary built with -g -O2 (similar to cmake's RelWithDebInfo configuration), or binary clocks in at ~530mbs: % du -sh bin 536M bin To get a sense of what percentage of this binary is debug info, we can use llvm-objcopy to strip the debug info entirely: % llvm-objcopy --strip-debug bin strippedbin % du -sh strippedbin 159M strippedbin This shows us that almost 70%(!!) of the binary size is taken up with debug info. In release configurations we can eliminate this entirely with bazel's --strip argument, but for developer builds, or other use cases where you need debug info, we can still improve this. If we use llvm-objcopy again, this time to compress the debug info, we can immediately see our potential gains: % llvm-objcopy --compress-debug-sections bin compressedbin % du -sh compressedbin 290M compressedbin This shows us we can get an almost 50%(!!) improvement in binary size in this example. To enable this in bazel, assuming you're using a relatively recent version of gcc or clang, you can add something like this to your .bazelrc2: build --enable_platform_specific_config build:linux --copt=-gz --host_copt=-gz build:linux --linkopt=-gz --host_linkopt=-gz In practice we saw cache reads drop by nearly 60% when we rolled out this change. Reducing binary size with this approach has a lot of benefits, but it's even more pronounced ## Bumble chooses Tuist for iOS project scaling after comparing SPM and Bazel DevFeed: [Bumble chooses Tuist for iOS project scaling after comparing SPM and Bazel]() Original publisher: [Read original article]() Author: Jonathan Crooke Published: 2024-03-12T15:23:14Z Content type: comparison Language: en Sources: [Bumble Tech]() Topics: [Tuist](), [iOS development](), [bazel](), [swift-package-manager](), [Xcode]() Tags: [bazel](), [ios-development](), [swift-package-manager](), [tuist]() ### AI overview In the final part of Bumble's build and project-management overhaul, the team explains why it chose Tuist over Swift Package Manager and Bazel for its iOS project-scaling needs. It found SPM's Xcode integration too slow at its scale and considered Bazel powerful but costly to adopt and maintain. ### Source excerpt Scaling iOS at Bumble: Part 3/3 -- Results and Developer Quality of LifeRecap This is the third and final post in a series on our 2022 & 23 build and project management overhaul. We investigated whether one (or none!) of Swift Package Manager (SPM), Tuist or Bazel would be the tool to overcome our project scaling challenges. In the first post we explained the state-of-play coming into this project. In the second we discussed the results of our proofs of concept. In this post we will explain our conclusions, and talk about the migration project itself. The decisionWe chose Tuist It shouldn't be much surprise that we didn't choose SPM. In fact, we found it to be entirely unsuitable for our use case. This isn't to say that SPM is a poor tool in general -- far from it. Initially we would have preferred to adopt it, however we couldn't ignore the fact that, at least regarding its Xcode-integration, SPM exhibits unacceptably poor performance for our use case, and at our current scale; and this is before we consider our expected future scaling! For those starting new, or smaller projects, SPM seems to provide a nice user experience. However, it also deserves to be regarded as a "first-party CocoaPods". It serves a very similar use-case, and may lead to similar performance drawbacks. Bazel was a different matter. It is undoubtedly a powerful tool, but is a high-investment choice; compared to both SPM and Tuist it diverges much from the traditional iOS development experience, increasing disruption for developers. Also, since Bazel experience is still quite uncommon, this adds extra onboarding load for new team members. We also need to support and maintain infrastructure internally; we have small infrastructure teams and Bazel presents concerns about poor bus factor for a tool that is a single point of failure. During our proof of concept it became clear that in spite of its power, Bazel would be costly for us in the short term. In comparison, Tuist hit a sweet spot between the ## Scaling iOS at Bumble: Part 2/3 -- The Assessment DevFeed: [Scaling iOS at Bumble: Part 2/3 -- The Assessment]() Original publisher: [Read original article]() Author: Jonathan Crooke Published: 2024-02-15T13:49:17Z Content type: article Language: en Sources: [Bumble Tech]() Topics: [iOS](), [Tuist](), [swift-package-manager](), [bazel](), [toolchain](), [Xcode](), [Requirements](), [Testing]() Tags: [bazel](), [ios](), [ios-app-development](), [performance](), [requirements](), [swift](), [swift-package-manager](), [testing](), [toolchain](), [tuist](), [xcode]() ### AI overview This article recaps Bumble's assessment process for replacing parts of its iOS project and build toolchain. It describes onboarding, proof-of-concept work, full-app conversion, and assessment criteria for Swift Package Manager, Tuist, and Bazel, including blockers, user experience, and performance. ### Source excerpt Scaling iOS at Bumble: Part 2/3 -- The AssessmentRecap In our previous post we discussed how we came to be investigating project and build toolchain replacement solutions for our iOS codebase at Bumble Inc. We began executing proofs of concept for Swift Package Manager (SPM), Tuist and Bazel. The Process Our investigative process for each tool was performed in roughly the same manner: 1. Onboarding With the exception of some light use of SPM as a third-party dependency manager, no-one on the team was fully fluent with any of the tools. This meant that at first, we needed to learn the basics, which could be achieved by creating a minimum-viable manifest for one of our node modules. This would involve learning the manifest format and core commands for building, testing etc. 2. Medium-sized proof of concept Following on from the initial onboarding, we would then progress to converting parent modules, traversing the tree post-order. At each level we'd cover more of our core requirements and encounter edge-cases. Throughout, we noted learnings, limitations and fixes. 3. Full-app conversion At this stage, since our module tree exhibits a strong level of uniformity, we'd now have gathered enough experience to fully convert the app's child modules, and do so using automated tooling. How we achieved this will be discussed below. Unsurprisingly, the top-level app target was its own challenge, and required considerably handcrafting. We only aimed to achieve a minimum-viable conversion at this stage, and didn't expect tests to pass. That said, we'd usually have a fairly conformant conversion anyway, that would launch successfully to its home screen and usually plenty more. 4. Assessment With a converted app target in hand, we would now have a candidate for assessment. But what did we want to know? Our analysis looked at these areas: Blockers: simple enough, any limitations or issues in the tool's functionality whereby it was unable to serve our basic requirements Subjective user ## Images as Code: The pursuit of declarative image builds DevFeed: [Images as Code: The pursuit of declarative image builds]() Original publisher: [Read original article]() Published: 2024-01-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Code](), [chainguard images](), [Dockerfile](), [bazel](), [distroless](), [Docker](), [Containers](), [Kubernetes](), [Terraform](), [Infrastructure as code](), [Open Source]() Tags: [apk](), [apko](), [bazel](), [chainguard](), [chainguard-images](), [code](), [container-image](), [containers](), [declarative](), [distroless](), [docker](), [infrastructure-as-code](), [kubernetes](), [open-source](), [reproducibility](), [terraform]() ### AI overview The article traces the pursuit of declarative container image builds. It critiques imperative Dockerfile-based builds for making multi-tenant, multi-architecture, and reproducible builds difficult, then discusses Bazel and distroless images as steps toward expressing intended build state. Kubernetes and Terraform are presented as examples of declarative systems, inspiring the idea of "Images as Code." ### Source excerpt Chainguard's CTO Matt Moore describes the process of creating a declarative container image build for Chainguard Images. ## Announcing Bazel rules for extending Chainguard Images DevFeed: [Announcing Bazel rules for extending Chainguard Images]() Original publisher: [Read original article]() Published: 2023-10-24T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [supply-chain-security](), [container images](), [distroless](), [Package manager](), [Open Source]() Tags: [apk](), [apko](), [bazel](), [chainguard](), [chainguard-images](), [distroless](), [sbom](), [secure-software](), [secure-software-supply-chain](), [wolfi]() ### AI overview Chainguard and Aspect.Dev announce the general availability of rules_apko, an open source Bazel plugin for building secure, minimal Wolfi-based OCI container images. The article explains how rules_apko integrates APK packages and Wolfi-base images into existing Bazel workflows, supports reproducible builds, and provides dependency locking, integrity verification, and SBOM generation. ### Source excerpt Explore Bazel rules for Chainguard Images, your pathway to secure, effortless image extension. ## The haunting of CVE-2022-3474: A ghostly tale of package detection failure DevFeed: [The haunting of CVE-2022-3474: A ghostly tale of package detection failure]() Original publisher: [Read original article]() Published: 2023-10-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [vulnerability](), [container images](), [chainguard images](), [vulnerability management](), [bazel](), [trivy]() Tags: [bazel](), [chainguard-images](), [container-images](), [cve-2022-3474](), [false-negative](), [trivy](), [vulnerability-management]() ### AI overview The article explains how scanners can produce false negatives when they fail to identify a package in a container image. Using CVE-2022-3474 in Bazel 5.3.1 as an example, it describes how missing Bazel package metadata prevented Trivy from detecting the vulnerability and presents Chainguard Images' package metadata and SBOMs as a way to improve detection. ### Source excerpt Explore the risks of scanner false negatives, the pitfalls of missing the Bazel package, and how Chainguard Images ensure accurate vulnerability detection. ## MLIR -- Running and Testing a Lowering DevFeed: [MLIR -- Running and Testing a Lowering]() Original publisher: [Read original article]() Published: 2023-08-10T14:36:13Z Content type: tutorial Language: en Sources: [Jeremy Kun]() Topics: [Compiler](), [Testing](), [Optimization](), [bazel](), [LLVM]() Tags: [bazel](), [c-plus-plus](), [compiler](), [compilers](), [fhe](), [llvm](), [mathematics](), [mlir](), [optimization](), [programming](), [testing](), [tiling]() ### AI overview This tutorial introduces MLIR dialects and lowerings, explains how MLIR incrementally transforms programs through intermediate representations, and demonstrates end-to-end testing for a simple lowering. ### Source excerpt Table of Contents Last time, we covered a Bazel build system setup for an MLIR project. This time we'll give an overview of a simple lowering and show how end-to-end tests work in MLIR. All of the code for this article is contained in this pull request on GitHub, and the commits are nicely organized and quite readable. Two of the central concepts in MLIR are dialects and lowerings. These are the scaffolding within which we can do the truly interesting parts of a compiler--that is, the optimizations and analyses. ## Supercharging Continuous Integration with Gradle DevFeed: [Supercharging Continuous Integration with Gradle]() Original publisher: [Read original article]() Author: Paul Hundal Published: 2023-07-27T14:00:00Z Content type: article Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Gradle](), [ci](), [build times](), [CI/CD](), [Caching](), [bazel](), [Regular expression](), [benchmarking]() Tags: [android](), [automated](), [bazel](), [build](), [build-times](), [caching](), [ci](), [code](), [continuous-integration](), [development](), [distributed](), [engineering](), [gradle](), [parallel](), [performance](), [test]() ### AI overview This article describes Square's efforts to improve continuous integration for a large Gradle-based Android project. It discusses Kochiku, an open-source CI tool used for automated sharding, scheduling, and distributed caching, and explains shard avoidance based on build-graph changes. ### Source excerpt Unveiling the journey of shard avoidance and Bazel-like queryability ## It all started with a commit: Celebrating 6 years of Distroless DevFeed: [It all started with a commit: Celebrating 6 years of Distroless]() Original publisher: [Read original article]() Published: 2023-04-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [distroless](), [Containers](), [supply-chain-security](), [container images](), [sigstore](), [chainguard images](), [Kubernetes](), [vulnerability](), [bazel](), [Debian](), [vulnerability management](), [Go]() Tags: [bazel](), [c-plus-plus](), [chainguard](), [chainguard-images](), [containers](), [debian](), [digital-signatures](), [distroless](), [distroless-containers](), [go](), [java](), [kubernetes](), [python](), [release-engineering](), [sigstore](), [software-supply-chain-security](), [verify](), [vulnerability](), [vulnerability-management]() ### AI overview The article commemorates six years of Distroless, describing its goal of creating more secure and efficient container images by removing non-essential components. It covers the Bazel-based build tooling, language runtimes, Kubernetes adoption, vulnerability-management benefits, and later integration with Sigstore for container signing and authenticity verification. It also introduces the subsequent development of Chainguard Images. ### Source excerpt The goal of Distroless is to provide a more secure and efficient way to package and run software in containers by using only essential components. ## Hopping into spring with Chainguard's RabbitMQ Image DevFeed: [Hopping into spring with Chainguard's RabbitMQ Image]() Original publisher: [Read original article]() Published: 2023-02-24T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [Messaging](), [Security](), [Cloud Native Ecosystem](), [Containers](), [vulnerability scanning](), [Erlang](), [Open Source](), [GitHub]() Tags: [base-images](), [bazel](), [chainguard](), [chainguard-images](), [container-images](), [containers](), [cosign](), [cves](), [documentation](), [image](), [messaging](), [minimal-image](), [provenance](), [rabbitmq](), [rabbitmq-image](), [sboms](), [secure-images](), [security](), [slsa](), [software-supply-chain]() ### AI overview Chainguard announces a Chainguard Image for RabbitMQ, an open-source message broker used in cloud-native applications. The image is built from source on Wolfi, with custom Erlang and OTP components, continuous patching, minimal CVEs, SBOMs, signatures, and SLSA Build Level 2 provenance. ### Source excerpt Unlock advanced messaging capabilities with Chainguard's RabbitMQ image, designed for robustness and security. ## How We Handle Flaky Tests in Gradle DevFeed: [How We Handle Flaky Tests in Gradle]() Original publisher: [Read original article]() Author: Bo Zhang Published: 2022-11-03T02:00:00Z Content type: article Language: en Sources: [The Gradle Blog]() Topics: [Gradle](), [Testing](), [ci](), [code productivity](), [superProductivity]() Tags: [automated](), [bazel](), [best-practices](), [build](), [ci](), [flaky](), [gradle](), [gradle-plugin](), [junit](), [retry](), [teamcity](), [techniques](), [testing](), [tests](), [tools]() ### AI overview This article explains how the Gradle team manages flaky automated tests. It covers retrying failed tests, automatically identifying flaky failures in CI, using dashboards and analytics to troubleshoot trends, and quarantining tests that are too unreliable. It also mentions Gradle's Test Retry Gradle plugin and alternatives such as Maven Surefire Plugin, JUnit Pioneer, and Bazel test rules. ### Source excerpt Test flakiness is one of the main challenges of automated testing. Even though Gradle's focus is increasing developer productivity, the development of Gradle itself suffers from flaky automated tests. This blog explains some best practices when developing Gradle, which have proved effective over the years we fight with flaky tests. The Story Like in many other projects, every commit of Gradle must pass tens of thousands of automated tests. Any tiny flakiness may cause developer productivity loss. When I joined Gradle 5 years ago, the CI was full of flaky test failures - people would rerun a build, again and again, hoping to be lucky enough to get a green build. Later, we started a dedicated developer productivity team to deal with all the flakiness on CI, especially test flakiness. Here's how we do it step by step. Retry Failed Tests When a test fails, how do we determine if it's flaky or not? The easiest way is obviously retrying the failed test immediately: if the second run succeeds, the failed test is flaky. As a rule of thumb, by simply rerunning the failed test one more time, the test failures due to flakiness can be reduced by 90%. Many CI systems can recognize such flaky tests and mark the build as green automatically: In this example, the first run fails because of a network error, but the rerun succeeds. TeamCity recognizes this situation and "mutes" the test failure. If the build is connected to a Gradle Enterprise instance and that build has a published Build Scan, you can see the flaky tests in the test dashboard: In Gradle, we automatically retry the failed test classes with the Test Retry Gradle plugin. Please consult the documentation for how to adopt it in your build. Other Techniques to Retry Failed Tests If you are not using Gradle, that's okay. There are many alternatives that provide similar functionalities: Maven Surefire Plugin - Rerun failing tests JUnit Pioneer - Retrying Failing Tests Bazel flaky attribute in test rules All the tools above ## First Annual Bazel-iOS Con 2022 DevFeed: [First Annual Bazel-iOS Con 2022]() Original publisher: [Read original article]() Author: Jerry Marino Published: 2022-09-12T07:00:00Z Content type: news Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [bazel](), [iOS](), [Development](), [Open Source]() Tags: [bazel](), [conference](), [development](), [engineering](), [event](), [github](), [ios](), [open-source]() ### AI overview Square announces the first annual Bazel-iOS Con, an open developer conference scheduled for September 29, 2022. The event will feature talks, panels, discussion groups, and breakout sessions about using Bazel for iOS development. ### Source excerpt Join us at Bazel-IOS Con September 29, 2022 ## Debugging bazel actions DevFeed: [Debugging bazel actions]() Original publisher: [Read original article]() Author: Keith Smiley Published: 2022-03-03T02:00:00Z Content type: tutorial Language: en Sources: [Keith Smiley]() Topics: [debugging](), [Command-line interface](), [configuration](), [Tooling]() Tags: [bazel](), [build](), [command-line](), [configuration](), [debugging](), [sandbox]() ### AI overview This tutorial explains how to reproduce Bazel actions outside Bazel's infrastructure for debugging and benchmarking. It covers preparing the build environment, disabling or preserving sandboxing, obtaining an action's command line, and forcing actions to rerun by invalidating inputs or changing flags. ### Source excerpt When working on bazel build infrastructure, something I often need to do is reproduce an action outside of bazel's infrastructure in order to debug it further. This debugging often involves changing flags or swapping out the tool itself for a custom built version. In many cases updating your bazel configuration as normal should work well enough. But sometimes when you're iterating on things that invalidate a significant portion of your build it can be faster to work on things outside of bazel first, and then update your bazel configuration based on your discoveries. Another case where this is useful is if you want to benchmark a specific action by running it many times individually without the contention caused by bazel parallelizing other actions. Since bazel has a lot of infrastructure for keeping builds hermetic, there are a few steps you need to take to roughly reproduce what bazel is doing so your debugging is as close to what it runs as possible. 1. Build and disable sandboxing In order for bazel to setup your build environment (including your downloaded dependencies), and leave it intact for you to muck around with, you must run a normal build and also either disable sandboxing by passing --spawn_strategy=standalone, or make it leave the sandbox base around by passing --sandbox_debug. 2. Grab your action's command line Once bazel has run and left its environment intact, you need to grab the command line being run for the action you want to debug. I find that passing bazel's -s flag (also known as --subcommands) is the easiest way to do this. You just have to make sure that the action you're interested in actually runs. There are a few different ways you can force bazel to run an action: Invalidate the inputs for the action. Unlike other build systems touching input files isn't enough, I often add newlines or comments to files to force actions to re-run. Change the flags for a command line. For some actions such as C++ compiles, or native binary linking, there ## Getting Square's iOS build ready for Apple Silicon with Bazel DevFeed: [Getting Square's iOS build ready for Apple Silicon with Bazel]() Original publisher: [Read original article]() Author: Jerry Marino Published: 2022-01-27T20:00:00Z Content type: tutorial Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [bazel](), [iOS](), [build times](), [cpu](), [Objective-C](), [Swift](), [Open Source]() Tags: [apple](), [arm](), [bazel](), [build](), [build-times](), [caching](), [engineering](), [ios](), [objective-c](), [open-source](), [simulator](), [swift](), [x86]() ### AI overview Square describes adapting its Bazel-based iOS build system for Apple Silicon by building and running iOS applications on the M1 simulator. The article explains the available development paths and why device builds and x86_64 builds under Rosetta 2 were not selected. ### Source excerpt Building and running iOS builds using the M1 simulator [Next page]()