Release a repository archive for consistent checksum

google / bazel-common

Common functionality for Google's open-source libraries that are built with bazel.

Apache License 2.0

84 stars 40 forks source link

Release a repository archive for consistent checksum #167

Open l46kok opened 1 year ago

l46kok commented 1 year ago

Per https://github.com/bazel-contrib/SIG-rules-authors/issues/11, the checksum of repository code download archives (https://github.com/google/bazel-common/archive/_COMMIT_.zip) are not stable.

In fact, the checksum was changed earlier today as seen in the above issue, though that change was rolled back. Please consider releasing an archive under /archive/refs/tags/$tag, which its SHA256 value is promised to be stable.

chaoren commented 1 year ago

Maybe we should just use git_repository instead of http_archive in the README? We don't currently do fixed releases here, so I'm not sure we want to start promising them.

l46kok commented 1 year ago

git_repository is unideal in many circumstances, since it doesn't support repository caching and it requires downstream users to have git installed (especially problematic for CI / docker container builds). The Bazel team also recommends using http_archive instead.