[pull] master from google:master

infra/base-images/base-builder/Dockerfile

@@ -227,6 +227,12 @@ RUN cd /tmp && git clone https://github.com/NixOS/patchelf && \
 
 COPY indexer /opt/indexer
 COPY --from=gcr.io/oss-fuzz-base/indexer /indexer/build/indexer /opt/indexer/indexer
-RUN chmod a+x /opt/indexer/indexer /opt/indexer/index_build.py
+# The indexer build is best-effort (see infra/indexer/Dockerfile). If it
+# failed, the binary is empty - replace it with a stub that fails loudly,
+# so a broken indexer does not break every base image.
+# https://github.com/google/oss-fuzz/issues/16141
+RUN if [ ! -s /opt/indexer/indexer ]; then \
+      printf '#!/bin/bash\necho "ERROR: the indexer failed to build, see https://github.com/google/oss-fuzz/issues/16141" >&2\nexit 1\n' > /opt/indexer/indexer; \
+    fi && chmod a+x /opt/indexer/indexer /opt/indexer/index_build.py
 
 CMD ["compile"]

infra/base-images/base-builder/ubuntu-20-04.Dockerfile

@@ -227,6 +227,12 @@ RUN cd /tmp && git clone https://github.com/NixOS/patchelf && \
 
 COPY indexer /opt/indexer
 COPY --from=gcr.io/oss-fuzz-base/indexer /indexer/build/indexer /opt/indexer/indexer
-RUN chmod a+x /opt/indexer/indexer /opt/indexer/index_build.py
+# The indexer build is best-effort (see infra/indexer/Dockerfile). If it
+# failed, the binary is empty - replace it with a stub that fails loudly,
+# so a broken indexer does not break every base image.
+# https://github.com/google/oss-fuzz/issues/16141
+RUN if [ ! -s /opt/indexer/indexer ]; then \
+      printf '#!/bin/bash\necho "ERROR: the indexer failed to build, see https://github.com/google/oss-fuzz/issues/16141" >&2\nexit 1\n' > /opt/indexer/indexer; \
+    fi && chmod a+x /opt/indexer/indexer /opt/indexer/index_build.py
 
 CMD ["compile"]

infra/base-images/base-builder/ubuntu-24-04.Dockerfile

@@ -198,7 +198,13 @@ RUN chmod +x /usr/local/bin/clang-jcc /usr/local/bin/clang++-jcc /usr/local/bin/
 
 COPY indexer /opt/indexer
 COPY --from=gcr.io/oss-fuzz-base/indexer:ubuntu-24-04 /indexer/build/indexer /opt/indexer/indexer
-RUN chmod a+x /opt/indexer/indexer /opt/indexer/index_build.py
+# The indexer build is best-effort (see infra/indexer/Dockerfile). If it
+# failed, the binary is empty - replace it with a stub that fails loudly,
+# so a broken indexer does not break every base image.
+# https://github.com/google/oss-fuzz/issues/16141
+RUN if [ ! -s /opt/indexer/indexer ]; then \
+      printf '#!/bin/bash\necho "ERROR: the indexer failed to build, see https://github.com/google/oss-fuzz/issues/16141" >&2\nexit 1\n' > /opt/indexer/indexer; \
+    fi && chmod a+x /opt/indexer/indexer /opt/indexer/index_build.py
 
 COPY llvmsymbol.diff $SRC
 COPY detect_repo.py /opt/cifuzz/

infra/indexer/Dockerfile

@@ -1,8 +1,29 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
 FROM gcr.io/oss-fuzz-base/base-clang-full
 
 RUN mkdir /indexer
 WORKDIR /indexer
 COPY . /indexer
 
-RUN apt-get update && apt-get install -y libsqlite3-dev make zlib1g-dev
-RUN mkdir build && cd build && cmake .. && cmake --build . -j -v
+# Best-effort: the indexer tracks LLVM head while base-clang pins an older LLVM,
+# so it regularly fails to compile. Do not let that block the base image builds.
+# base-builder checks whether a real binary came out. Keep the '|| true'.
+# https://github.com/google/oss-fuzz/issues/16141
+RUN apt-get update && apt-get install -y libsqlite3-dev make zlib1g-dev || true
+RUN (mkdir build && cd build && cmake .. && cmake --build . -j -v) || true
+RUN mkdir -p /indexer/build && touch /indexer/build/indexer

infra/indexer/ubuntu-20-04.Dockerfile

@@ -1,8 +1,29 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
 FROM gcr.io/oss-fuzz-base/base-clang-full:ubuntu-20-04
 
 RUN mkdir /indexer
 WORKDIR /indexer
 COPY . /indexer
 
-RUN apt-get update && apt-get install -y libsqlite3-dev make zlib1g-dev
-RUN mkdir build && cd build && cmake .. && cmake --build . -j -v
+# Best-effort: the indexer tracks LLVM head while base-clang pins an older LLVM,
+# so it regularly fails to compile. Do not let that block the base image builds.
+# base-builder checks whether a real binary came out. Keep the '|| true'.
+# https://github.com/google/oss-fuzz/issues/16141
+RUN apt-get update && apt-get install -y libsqlite3-dev make zlib1g-dev || true
+RUN (mkdir build && cd build && cmake .. && cmake --build . -j -v) || true
+RUN mkdir -p /indexer/build && touch /indexer/build/indexer

infra/indexer/ubuntu-24-04.Dockerfile

@@ -1,8 +1,29 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
 FROM gcr.io/oss-fuzz-base/base-clang-full:ubuntu-24-04
 
 RUN mkdir /indexer
 WORKDIR /indexer
 COPY . /indexer
 
-RUN apt-get update && apt-get install -y libsqlite3-dev make zlib1g-dev
-RUN mkdir build && cd build && cmake .. && cmake --build . -j -v
+# Best-effort: the indexer tracks LLVM head while base-clang pins an older LLVM,
+# so it regularly fails to compile. Do not let that block the base image builds.
+# base-builder checks whether a real binary came out. Keep the '|| true'.
+# https://github.com/google/oss-fuzz/issues/16141
+RUN apt-get update && apt-get install -y libsqlite3-dev make zlib1g-dev || true
+RUN (mkdir build && cd build && cmake .. && cmake --build . -j -v) || true
+RUN mkdir -p /indexer/build && touch /indexer/build/indexer