Consider shas of archive contents as opposed to archive itself for downloads
- Dominant language
- Java
- Stars
- 25.8k
- Forks
- 4.6k
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 72
Description
One still mostly unsolved problem in the community is that github tars are mostly not guaranteed to be stable (even though they change very rarely). bzlmod is trying to enforce this but not all repos create a stable archive for their releases today, so I don't see this problem going away. One thing I noticed testing out nix is that they use the combined sha of the contents of the archive instead of the sha of the archive itself, which I imagine would be stable against this issue.
Related slack discussion: https://bazelbuild.slack.com/archives/CA31HN1T3/p1690214404391649
Contributor guide
Research direction
The issue names no files or tests. Start by reviewing Bazel download handling and bzlmod's archive hash behavior, then clarify the required content-based hashing semantics and how stability should be verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- build-system
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100