Configuring Bazel's Downloader
Blog post from Aspect Build
Bazel's built-in downloader plays a crucial role in managing network fetches but operates separately from the repository cache, ensuring that even if some repository rules are re-run, fetching from the internet is unnecessary. While configurable, this downloader's documentation is limited, and some repository rules that run external programs like yarn install are not aware of it, conducting their own network fetches. This can introduce non-hermeticity and security vulnerabilities when dealing with untrusted third-party code. To mitigate these risks, using a local read-through cache, such as Artifactory, is recommended for enhanced resilience against network outages and improved security with a scanner to identify vulnerabilities. Redirecting all downloads through this cache on continuous integration (CI) systems is advisable, using a configuration file that defines URL rewrites to ensure security and efficiency by prioritizing matches and directing fetches to a trusted source.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.