cannot have two files with the same basename in DISTDIR_FILE

Error message

cannot have two files with the same basename in DISTDIR_FILES

What it means

generate-distdir builds the DISTDIR_FILES mapping used by bazel's distdir mechanism; dumpOutput panics when two entries have the same path.Base() because distdir fetches and stores artifacts by basename — a collision would silently overwrite one file with another. This is a deliberate fail-fast at generation time.

Source

Thrown at pkg/cmd/generate-distdir/main.go:342

	if err := getShasFromDepsBzl(src.depsBzl, ret); err != nil {
		return nil, err
	}
	if err := getShasFromWorkspace(src.workspace, ret); err != nil {
		return nil, err
	}
	if err := getShasFromArchivedCdeps(src.cdepsArchivedBzl, src.cdepsRepositoriesBzl, ret); err != nil {
		return nil, err
	}
	return ret, nil
}

func dumpOutput(shas map[string]string) {
	bases := make(map[string]interface{})
	for url := range shas {
		base := path.Base(url)
		_, ok := bases[base]
		if ok {
			panic("cannot have two files with the same basename in DISTDIR_FILES")
		}
		bases[base] = nil
	}

	fmt.Println(`# Code generated by generate-distdir. DO NOT EDIT.

DISTDIR_FILES = {`)
	urls := make([]string, 0, len(shas))
	for url := range shas {
		urls = append(urls, url)
	}
	sort.Strings(urls)
	for _, url := range urls {
		fmt.Printf(`    "%s": "%s",
`, url, shas[url])
	}
	fmt.Println("}")
}

View on GitHub (pinned to 8812064a01)

Solutions

Identify the colliding pair: list the URLs feeding DISTDIR_FILES and group by path.Base()
Point one dependency at a uniquely named artifact (upstream asset with a prefixed name, or a renamed mirror copy)
Regenerate the file with `bazel run //pkg/cmd/generate-distdir` and commit the result

Example fix

# before: two entries both named v1.0.0.tar.gz
https://mirror.example.com/somelib/v1.0.0.tar.gz
https://other.example.com/otherlib/v1.0.0.tar.gz

# after: mirror one artifact under a unique basename
https://mirror.example.com/somelib/v1.0.0.tar.gz
https://other.example.com/otherlib/otherlib-v1.0.0.tar.gz

Defensive patterns

Strategy: validation

Prevention

When adding a dependency, choose artifact URLs with unique basenames
Run generate-distdir immediately after dependency bumps so collisions surface in CI
Prefer upstream release assets that embed the project name in the filename

When it happens

Trigger: Adding a cdep/repository whose artifact URL ends in the same filename as an existing entry — e.g. two dependencies both publishing 'v1.2.3.tar.gz' from different hosts, or a mirror URL that only differs in directory.

Common situations: Bumping or adding third-party Go/C++ dependencies in cockroach; upstream repackaging artifacts under generic names; switching a dependency to a mirror that strips the prefixed filename.

Related errors

AI-assisted analysis of cockroachdb/cockroach@8812064a01 (2026-08-15). Data as JSON: /api/errors/78f79b83f3927e61. Report an issue: GitHub.