Error Downloading numeric.min.js During Bazel Build

[samjabrahams]

Getting a validation failure when attempting to build TensorFlow wheel from source using most recent from-sources guide.

ERROR: /home/pi/tf/tensorflow/tensorflow/tensorboard/bower/BUILD:5:1: no such package '@numericjs_numeric_min_js//file': Error downloading [https://cdnjs.cloudflare.com/ajax/libs/numeric/1.2.6/numeric.min.js] to /home/pi/.cache/bazel/_bazel_pi/4770c5ca1786316d370c900c0b614a6d/external/numericjs_numeric_min_js/numeric.min.js: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed and referenced by '//tensorflow/tensorboard/bower:bower'.
ERROR: Analysis of target '//tensorflow/tools/pip_package:build_pip_package' failed; build aborted.

An issue on the official TensorFlow repo experienced this problem due to Docker getting out of sync with the root machine, but this doesn't help much here.

[lciruelo]

same problem :/

[lciruelo]

im trying to update java's certificates with

$sudo apt-get install ca-certificates-java
$sudo update-ca-certificates -f

I'll check it tomorrow

[njubee]

Got the same problem. Anyone found a solution?

[samjabrahams]

I'm currently getting around it for the pre-compiled binaries by using a Pi that had the Numeric-JS library downloaded from a previous build of TensorFlow. Still unable to get it working on new machines, though :/

The most likely hotfix will be to just download it manually and place it where it needs to go. I'll try this out when I find some time and post it here once I managed to get it working on an RPi. This is a pretty annoying spot to get stuck on.

[njubee]

I've tried that but bazel will complain when the PKIX validator throws an signature exception. Do you by any chance have the numeric-js library that validates correctly available for me to try instead?

[samjabrahams]

The file is simply the url mentioned in the error:

https://cdnjs.cloudflare.com/ajax/libs/numeric/1.2.6/numeric.min.js

The frustrating thing is that you can access the file in a browser (on the Raspberry Pi), but the PKIX validator complains when accessing it through Bazel. This problem appears to be RPi only, so we need to figure out what security certificate settings are throwing things off.

[ZenDevelopmentSystems]

try editing the makefile where it downloads the numeric java and adding the following flag
--no-check-certificate
I havent got a pi set up currently to try it but i know previously building it for a jetson TK1 i needed that flag for a couple of the downloads where the tk1 didnt have correctly installed certificates.....

[njubee]

It could be bazel can't validate the certificate of cloudflare. Put the js file on a plain http mirror, change the WORKSPACE file and it worked without a hitch.

[samjabrahams]

@njubee brilliant! I just tried this out- you can actually change https://cdnjs... to http://cdnjs... and it gets past the hitch. Not sure what's going on with Cloudflare's certificates, or why Bazel handles it differently across different systems.

I'll update the GUIDE.

[samjabrahams]

Before closing, I want to double check the build steps to make sure this fixes things. Here's the new bits copy-pasted from the GUIDE:

---

Finally, we have to adjust the protocol to access the Numeric JS library- for some reason the Cloudflare security certificates don't work properly over https. We'll need to fix this in the Bazel WORKSPACE file:

sudo nano WORKSPACE

Around line 283, change https to http:

http_file(
  name = "numericjs_numeric_min_js",
  url = "http://cdnjs.cloudflare.com/ajax/libs/numeric/1.2.6/numeric.min.js",
)

[njubee]

Yeah, that should do it.

I think maybe the create python wheel step needs sudo. Atleast I needed it to read a protobuf package in the python tree, but I installed protobuf somewhat different from your steps. Error message was:

IOError: [Errno 13] Permission denied: '/usr/local/lib/python2.7/dist-packages/protobuf-3.2.0-py2.7.egg/EGG-INFO/namespace_packages.txt'

edit: Nevermind, missing read permissions on the EGG-INFO. Fixed that and everything works as expected. Thank you for this guide! :)