Incredibuild described how an early internal version of its Software Factory produced six patches that were accepted upstream into Bazel, and how the same work turned up a path-containment flaw in Bazel’s –experimental_repo_contents_cache feature that could let poisoned remote-cache data overwrite files outside the intended repository directory. The six patches covered reproducible distribution archives, preventing SSL-monitor issue updates during pull-request validation, preserving review decisions when comments arrive, locale-independent certificate-date parsing, correcting documentation token scope, and fail-closed retrieval of pull-request reviews, while the cache fix shipped in Bazel 9.3.0rc2 with 9.2.0 still affected. Incredibuild framed the run as evidence that generating code is now fast and cheap but building, testing, validating and deciding what reaches main is where agents and people still stand waiting, and that human review retained control over merges.
Incredibuild's AI software factory lands six Bazel patches and a remote-cache security fix
Incredibuild described how an early internal version of its Software Factory produced six patches that were accepted upstream into Bazel, and how the same work turned up a path-containment flaw in Bazel's --experimental_repo_contents_cache feature that could let poisoned remote-cache data overwrite files outside the intended repository directory. The six patches covered reproducible distribution archives, preventing SSL-monitor issue updates during pull-request validation, preserving review decisions when comments arrive, locale-independent certificate-date parsing, correcting documentation token scope, and fail-closed retrieval of pull-request reviews, while the cache fix shipped in Bazel 9.3.0rc2 with 9.2.0 still affected. Incredibuild framed the run as evidence that generating code is now fast and cheap but building, testing, validating and deciding what reaches main is where agents and people still stand waiting, and that human review retained control over merges.
Source: Incredibuild