bazelbuild / bazelbuild/bazel

Can't use `auth_patterns` with `--experimental_downloader_config`

Open
#21,425 1 comment 0 reactions 0 assignees View on GitHub
help wanted P2 team-ExternalDeps type: bug
Dominant language
Java
Stars
25.8k
Forks
4.6k
Avg merge
2d 18h
Merged PRs (30d)
75

Description

### Description of the bug:

I have a downloader config that looks something like:
```
rewrite https://company.com:8443/(.*) https://company.com/$1
```
and a rule that looks like:
```
http_archive(
name = "archive",
url = "https://company.com:8443/archive.tar.gz",
auth_patterns = { "company.com": "Bearer " },
)
```

Only some networks need the `rewrite`, otherwise I would just change the URL. With this configuration, the `auth_patterns` are never used despite pointing to the same host.

### Which category does this issue belong to?

_No response_

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

You would need a remote archive that needs authentication, but I would think changing the url arbitrarily and using the downloader config would reproduce it.

### Which operating system are you running Bazel on?

macOS

### What is the output of `bazel info release`?

release 7.0.2

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

_No response_

### Is this a regression? If yes, please try to identify the Bazel commit where the bug was introduced.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the interaction between --experimental_downloader_config, the rewrite rule, and http_archive's auth_patterns using the macOS Bazel 7.0.2 setup described in the issue. Confirm that rewriting the URL still applies the Bearer credential for company.com; done means an authenticated remote archive can be downloaded when the rewrite is active.

Written by the indexing model from the issue text.

Assessment

Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.