April 2025 Summaries

Protocol Buffers require a code generation step to turn .proto files into language-specific "stub" code for handling proto messages and, if using services, for implementing gRPC clients or servers. The typical compiler for this task is Google's protoc, often accessed via binary releases or plugins. However, within the Bazel build system, users traditionally compile protoc themselves, a process that can be cumbersome and inefficient due to imperfect caching and frequent build failures. To address these issues, Aspect engineer Sahin collaborated with the Bazel team to introduce a toolchain registration flag, enabling users to register precompiled binaries instead of compiling from source. This development aims to streamline workflows, although a comprehensive ecosystem change is necessary for full adoption. Efforts are underway to integrate these improvements into the official protobuf repository, enhancing the Bazel experience by reducing build times and improving efficiency, yet some workarounds and adaptations are still required to manage existing dependencies and improve release processes.

Containerizing JavaScript applications can be challenging due to their diverse structures, but Bazel simplifies this process with its Runfiles directory structure. Initially, the JsImageLayer rule in rules_js created two primary layers for JavaScript containers: one for infrequently changing elements like npm dependencies and Node.js interpreter, and another for application code. However, this approach proved inefficient as it required unnecessary rebuilds and redeployments when dependencies changed. To address this, version 2.0 introduced more layers to improve build and deploy times, though it wasn't a universal solution. To further optimize, the new Layer Groups feature in version 2.3.5 allows users to define additional layers based on specific criteria like file size and change frequency, enhancing performance by enabling better parallelization and reducing build times by up to 52%. This update also included utilizing libarchive for creating layers, which significantly boosted efficiency compared to previous methods.

The blog post discusses the challenges and vulnerabilities in supply-chain security within the open-source software ecosystem, specifically addressing a recent incident involving a vulnerability in tj-actions that exposed CI pipeline tokens, potentially allowing project hijacking. It highlights the precarious situation where a small number of individuals, often hobbyists, maintain critical security for enterprise users, drawing parallels to Bazel rulesets which face similar staffing issues. Google is transferring repositories to the Linux Foundation without providing additional maintenance resources, raising concerns about the security of Bazel rulesets, which could be compromised by malicious release artifacts. The post emphasizes the importance of verifying the provenance of release artifacts through attestations, as demonstrated by a framework like SLSA, which provides cryptographic proof that build artifacts are constructed securely. GitHub Actions are used to generate attestations that verify the integrity of release artifacts, and these are built into the BCR presubmit process to ensure trustworthiness. The blog also notes that the improvements made to the Publish to BCR helper will allow for broader adoption of secure practices across various Bazel ruleset releases, with the Bazel client expected to support transparent verification of modules in the future.