bazelbuild / bazelbuild/bazel

Consider shas of archive contents as opposed to archive itself for downloads

Open
#19,033 9 comments 2 reactions 0 assignees View on GitHub
P2 team-ExternalDeps type: feature request
Dominant language
Java
Stars
25.8k
Forks
4.6k
Avg merge
2d 20h
Merged PRs (30d)
72

Description

One still mostly unsolved problem in the community is that github tars are mostly not guaranteed to be stable (even though they change very rarely). bzlmod is trying to enforce this but not all repos create a stable archive for their releases today, so I don't see this problem going away. One thing I noticed testing out nix is that they use the combined sha of the contents of the archive instead of the sha of the archive itself, which I imagine would be stable against this issue.

Related slack discussion: https://bazelbuild.slack.com/archives/CA31HN1T3/p1690214404391649

Contributor guide

Open the contributing guide

Research direction

The issue names no files or tests. Start by reviewing Bazel download handling and bzlmod's archive hash behavior, then clarify the required content-based hashing semantics and how stability should be verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
build-system
Domain
build-system
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.