From df1827bcce0d21674f8178fbe9562564420b5723 Mon Sep 17 00:00:00 2001 From: Anthony Chen Date: Tue, 25 Aug 2026 14:17:34 +0800 Subject: [PATCH] earlgrey: Update opentitan_devbundle to devbundle-2026-08-21-1 Update the `opentitan_devbundle` dependency in `MODULE.bazel` to point to the official upstream release `devbundle-2026-08-21-1` from GitHub. Additionally, set `HOME=/tmp` in the `OtpImageAssemble` action in `target/earlgrey/env/environments.bzl`. In hermetic Bazel sandbox environments where `HOME` is unset, `opentitantool` falls back to glibc's `getpwuid_r()`, which dynamically `dlopen()`s host NSS libraries and crashes (SIGSEGV) due to a glibc ABI mismatch between the static binary and the host libc. Providing `HOME` prevents the NSS lookup. Signed-off-by: Anthony Chen --- MODULE.bazel | 6 ++---- target/earlgrey/env/environments.bzl | 6 ++++++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index c369b5438..8e29f8c3d 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -133,10 +133,8 @@ override_repo( bazel_dep(name = "opentitan_devbundle") archive_override( module_name = "opentitan_devbundle", - integrity = "sha256-67i+jjvFg9Pd1CXudHpWZ6Gw5lRJvRg4EQm6rDfmang=", - # TODO(cfrantz): We should get this from github.com/lowRISC/opentitan/releases/... - # Update after creating the next official build upstream. - url = "https://storage.googleapis.com/artifacts.opentitan.org/dev_bundle/devbundle-20260714.tar.xz", + integrity = "sha256-7QQkw0JW8R0aYfkjg2IcVT6/mpLYSC0Ab2jEvPEGiq8=", + url = "https://github.com/lowRISC/opentitan/releases/download/devbundle-2026-08-21-1/devbundle.tar.xz", ) bazel_dep(name = "lowrisc_opentitan") diff --git a/target/earlgrey/env/environments.bzl b/target/earlgrey/env/environments.bzl index 6df1c21fb..7b95d4b8f 100644 --- a/target/earlgrey/env/environments.bzl +++ b/target/earlgrey/env/environments.bzl @@ -48,6 +48,12 @@ def _fpga_prepare(ctx, env, firmware_bin, tools): outputs = [boot_image_file], inputs = [env.rom_ext, firmware_bin], executable = tools.opentitantool, + # Workaround: When HOME is unset, opentitantool invokes getpwuid_r() to locate its + # default config directory, which dynamically dlopens host NSS libraries. In static glibc + # binaries, this causes a SIGSEGV if the static glibc version differs from the host glibc. + # Setting HOME prevents the NSS lookup. + # TODO(antchen): remove this workaround once upstream opentitantool handles missing HOME or fixes static NSS lookup. + env = {"HOME": "/tmp"}, arguments = [ "image", "assemble",