Bug 1183836

May I please ping this?

There are multiple errors:

Use --sandbox_debug to see verbose messages from the sandbox
external/boringssl/src/third_party/fiat/curve25519.c:511:57: error: argument 2 of type 'const uint8_t[32]' {aka 'const unsigned char[32]'} with mismatched bound [-Werror=array-parameter=]
  511 | int x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t s[32]) {
      |                                           ~~~~~~~~~~~~~~^~~~~
--
  117 | int x25519_ge_frombytes_vartime(ge_p3 *h, const uint8_t *s);
      |                                           ~~~~~~~~~~~~~~~^
external/boringssl/src/third_party/fiat/curve25519.c:831:57: error: argument 2 of type 'const uint8_t *' {aka 'const unsigned char *'} declared as a pointer [-Werror=array-parameter=]
  831 | void x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t *a) {
      |                                          ~~~~~~~~~~~~~~~^
--
Use --sandbox_debug to see verbose messages from the sandbox
external/com_google_absl/absl/synchronization/internal/graphcycles.cc: In member function 'void absl::synchronization_internal::GraphCycles::RemoveNode(void*)':
external/com_google_absl/absl/synchronization/internal/graphcycles.cc:451:26: error: 'numeric_limits' is not a member of 'std'
  451 |   if (x->version == std::numeric_limits<uint32_t>::max()) {
      |                          ^~~~~~~~~~~~~~
external/com_google_absl/absl/synchronization/internal/graphcycles.cc:451:49: error: expected primary-expression before '>' token
  451 |   if (x->version == std::numeric_limits<uint32_t>::max()) {
      |                                                 ^
external/com_google_absl/absl/synchronization/internal/graphcycles.cc:451:52: error: '::max' has not been declared; did you mean 'std::max'?
  451 |   if (x->version == std::numeric_limits<uint32_t>::max()) {
      |                                                    ^~~
--
Use --sandbox_debug to see verbose messages from the sandbox
In file included from external/boringssl/src/crypto/fipsmodule/bcm.c:38:
external/boringssl/src/crypto/fipsmodule/bn/asm/x86_64-gcc.c:427:51: error: argument 2 of type 'const uint64_t[8]' {aka 'const long unsigned int[8]'} with mismatched bound [-Werror=array-parameter=]
  427 | void bn_sqr_comba8(BN_ULONG r[16], const BN_ULONG a[8]) {
      |                                    ~~~~~~~~~~~~~~~^~~~
--
In file included from external/boringssl/src/crypto/fipsmodule/bcm.c:100:
external/boringssl/src/crypto/fipsmodule/sha/sha256.c: In function 'SHA224_Final':
external/boringssl/src/crypto/fipsmodule/sha/sha256.c:122:10: error: 'SHA256_Final' accessing 32 bytes in a region of size 28 [-Werror=stringop-overflow=]
  122 |   return SHA256_Final(out, ctx);
      |          ^~~~~~~~~~~~~~~~~~~~~~
--
In file included from external/boringssl/src/crypto/fipsmodule/bcm.c:101:
external/boringssl/src/crypto/fipsmodule/sha/sha512.c: In function 'SHA384_Final':
external/boringssl/src/crypto/fipsmodule/sha/sha512.c:137:10: error: 'SHA512_Final' accessing 64 bytes in a region of size 48 [-Werror=stringop-overflow=]
  137 |   return SHA512_Final(out, sha);
      |          ^~~~~~~~~~~~~~~~~~~~~~
--
Use --sandbox_debug to see verbose messages from the sandbox
source/extensions/filters/network/dubbo_proxy/hessian_utils.cc: In function 'void Envoy::Extensions::NetworkFilters::DubboProxy::{anonymous}::addSeq(Envoy::Buffer::Instance&, const std::initializer_list<unsigned char>&)':
source/extensions/filters/network/dubbo_proxy/hessian_utils.cc:32:22: error: loop variable 'value' of type 'const int8_t&' {aka 'const signed char&'} binds to a temporary constructed from type 'const unsigned char' [-Werror=range-loop-construct]
   32 |   for (const int8_t& value : values) {
      |                      ^~~~~
--
Use --sandbox_debug to see verbose messages from the sandbox
source/common/config/type_to_endpoint.cc: In function 'Envoy::Config::{anonymous}::TypeUrlToServiceMap* Envoy::Config::{anonymous}::buildTypeUrlToServiceMap()':
source/common/config/type_to_endpoint.cc:30:27: error: loop variable 'service_name' of type 'const string&' {aka 'const std::__cxx11::basic_string<char>&'} binds to a temporary constructed from type 'const char* const' [-Werror=range-loop-construct]
   30 |   for (const std::string& service_name : {
      |                           ^~~~~~~~~~~~
--
Use --sandbox_debug to see verbose messages from the sandbox
source/extensions/filters/http/common/compressor/compressor.cc: In member function 'std::unique_ptr<Envoy::Extensions::HttpFilters::Common::Compressors::CompressorFilter::EncodingDecision> Envoy::Extensions::HttpFilters::Common::Compressors::CompressorFilter::chooseEncoding(const Envoy::Http::ResponseHeaderMap&) const':
source/extensions/filters/http/common/compressor/compressor.cc:245:19: error: loop variable 'pair' creates a copy from type 'const std::pair<absl::string_view, float>' [-Werror=range-loop-construct]
  245 |   for (const auto pair : pairs) {
      |                   ^~~~
--
Use --sandbox_debug to see verbose messages from the sandbox
source/extensions/stat_sinks/hystrix/hystrix.cc: In static member function 'static void Envoy::Extensions::StatSinks::Hystrix::HystrixSink::addHistogramToStream(const QuantileLatencyMap&, absl::string_view, std::stringstream&)':
source/extensions/stat_sinks/hystrix/hystrix.cc:53:41: error: loop variable 'element' of type 'const std::pair<double, double>&' binds to a temporary constructed from type 'const value_type' {aka 'const std::pair<const double, double>'} [-Werror=range-loop-construct]
   53 |   for (const std::pair<double, double>& element : latency_map) {
      |                                         ^~~~~~~

This is an autogenerated message for OBS integration:
This bug (1183836) was mentioned in
https://build.opensuse.org/request/show/893862 Factory / boringssl

(In reply to OBSbugzilla Bot from comment #3)
> This is an autogenerated message for OBS integration:
> This bug (1183836) was mentioned in
> https://build.opensuse.org/request/show/893862 Factory / boringssl

boringssl package update does not fix the compilation errors

Workaround applied (using gcc10 package).

(In reply to Martin Liška from comment #5)
> Workaround applied (using gcc10 package).

That implies 'building against gcc11' is still  unfixed - reopening

I've sent a proposal of removing this package on the Kubic ML:

https://lists.opensuse.org/archives/list/kubic@lists.opensuse.org/thread/QCQ2U4PPYD2K4X5CV6CCI45QUYQ5AK2O/

Making it green with gcc11 would require upgrading (or making some backports, which I would like to avoid). Due to some new "amazing" build features in Envoy and Bazel, I'm unable to build it offline on OBS and my old script/service (https://github.com/kubic-project/obs-service-bazel_repositories) doesn't work anymore.

Let's see what the response on the ML is going to be, but I would rather spend my time on making Cilium working on rke2 with upstream container images rather than fighting with making Bazel OBS-friendly. Those images could be maybe slightly modified, maybe based on (open)SUSE, I'm fine with maintaining some set of Dockerfile patches as long as that doesn't require such craziness as I had to do with packaging Bazel projects.

From my understanding, we are shifting into direction of rke2 being one of supported "k8s deployers" on MicroOS, so I think that offering Cilium through rke2 makes sense.

The package was removed from Factory.