http_archive splits strip_prefix values containing spaces into tar operands

Open Beginner friendly
#1,480 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
shell
Domain
build-system

Research direction

Start in prelude/http_archive/unarchive.bzl and inspect how the Unix archive command is serialized into archive_unpack.sh. Locate the existing http_archive archive or unarchive tests, add coverage for a strip_prefix containing a space, and verify the generated command preserves it as one argument while keeping Windows handling separate.

Written by the indexing model from the issue text.

Description

Reproducer

On macOS with the bundled Prelude, a hash-pinned npm tarball whose sole top-level directory is node v22.20 fails when used through http_archive:

http_archive(
    name = "archive",
    urls = ["https://registry.npmjs.org/@types%2Fnode/-/node-22.20.1.tgz"],
    sha256 = "6f99aae8d4a2bdecdce5a41a922b10943316edd4e6e6d4350f442d6c1688485f",
    strip_prefix = "node v22.20",
)

The generated archive_unpack.sh is:

tar -z -x -f ../archive.tar.gz --strip-components=1 node v22.20

This makes tar receive node and v22.20 as two archive-member operands and fail with:

tar: node: Not found in archive
tar: v22.20: Not found in archive

Root cause

prelude/http_archive/unarchive.bzl constructs a structured cmd_args, but serializes it into a Unix shell script using delimiter = " " without quote = "shell". The valid strip_prefix loses its single-argument boundary.

Expected behavior

strip_prefix = "node v22.20" should be passed as one argument, equivalently:

tar -z -x -f ../archive.tar.gz --strip-components=1 'node v22.20'\n```\n\n## Suggested fix\n\nUse Buck shell quoting when serializing the Unix archive command, and add a regression test covering a `strip_prefix` containing a space. Windows script handling should be tested separately rather than reusing Unix shell quoting.
Dominant language
Rust
Stars
4.4k
Forks
398
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from facebook/buck2

All issues in facebook/buck2

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.