Incredibuild Reports Six Bazel Contributions and a Remote-Cache Security Fix

Summary

Incredibuild says its early Software Factory helped land six contributions in Bazel master through Google’s Copybara workflow. The changes improve reproducible archive generation, authority boundaries in pull-request automation, locale-independent certificate parsing, configuration accuracy, and fail-closed handling when paginated review evidence is incomplete. The company presents these changes as requirements for trustworthy automated software engineering: deterministic outputs, complete evidence, explicit authority limits, and safe failure modes. During work on Bazel’s experimental repository contents cache, Incredibuild found that cache-supplied tree node names were not sufficiently constrained to remain inside the intended external repository directory. Under the required conditions, a poisoned remote Action Cache or Content Addressable Storage entry could cause a shipping Bazel 9.0.2 binary to overwrite an existing file outside the repository while the build still completed successfully. Exposure requires the cache feature to be enabled, an untrusted party to have write access to the relevant remote cache, and a Bazel build without the fix. Google addressed the issue in commit c37a6a1bf7f4 by validating file, directory, and symlink paths and adding a regression test. The article says Bazel 9.2.0 still contains the old logic, while 9.3.0rc2 includes the fix; users should upgrade to a fixed build or disable the flag and treat cache write access as a security boundary. Incredibuild argues that caching, distribution, isolation, observability, determinism, testing, and human review are the controls needed to extend automation from code generation to a reviewable software-development lifecycle.