Warn user when using unstable GitHub archive URL
Open
not stale
P3
team-ExternalDeps
type: feature request
- Dominant language
- Java
- Stars
- 25.8k
- Forks
- 4.6k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 75
Description
In https://github.com/bazel-contrib/SIG-rules-authors/issues/11 we did a bunch of research, including reaching out to GH support.
TL;DR: `http_archive` should never use `archive/v1.2.3.tar.gz` urls as the hash cannot be guaranteed to be stable. However `refs/tags/v1.2.3.tar.gz` URLs are guaranteed.
Bazel should warn users when they give an unstable URL since it's a nasty surprise when the sha256 stops matching upstream suddenly.
Contributor guide
Assessment
This issue has not been assessed yet.