Skip to content

Commit 5986420

Browse files
meteorcloudycopybara-github
meteorcloudy
authored and
copybara-github
committed
Fix getting authentication for URLs in http repo rules
- Fixed the leak of `remote_patches` URLs for downloaded the source archive. - Compute auth for required URLs only Fixes #22201 Closes #22517. PiperOrigin-RevId: 638300996 Change-Id: Ib76e3284f209d2314844cfd662ac8eadba785fae
1 parent ac9d710 commit 5986420

File tree

4 files changed

+28
-37
lines changed

4 files changed

+28
-37
lines changed

‎MODULE.bazel.lock‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/test/tools/bzlmod/MODULE.bazel.lock‎

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎tools/build_defs/repo/http.bzl‎

Lines changed: 20 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -76,22 +76,19 @@ Authentication is not supported.
7676
URLs are tried in order until one succeeds, so you should list local mirrors first.
7777
If all downloads fail, the rule will fail."""
7878

79-
def _get_all_urls(ctx):
80-
"""Returns all urls provided via the url, urls and remote_patches attributes.
79+
def _get_source_urls(ctx):
80+
"""Returns source urls provided via the url, urls attributes.
8181
8282
Also checks that at least one url is provided."""
8383
if not ctx.attr.url and not ctx.attr.urls:
8484
fail("At least one of url and urls must be provided")
8585

86-
all_urls = []
86+
source_urls = []
8787
if ctx.attr.urls:
88-
all_urls = ctx.attr.urls
88+
source_urls = ctx.attr.urls
8989
if ctx.attr.url:
90-
all_urls = [ctx.attr.url] + all_urls
91-
if hasattr(ctx.attr, "remote_patches") and ctx.attr.remote_patches:
92-
all_urls = all_urls + ctx.attr.remote_patches.keys()
93-
94-
return all_urls
90+
source_urls = [ctx.attr.url] + source_urls
91+
return source_urls
9592

9693
_AUTH_PATTERN_DOC = """An optional dict mapping host names to custom authorization patterns.
9794
@@ -136,25 +133,21 @@ def _http_archive_impl(ctx):
136133
if ctx.attr.build_file and ctx.attr.build_file_content:
137134
fail("Only one of build_file and build_file_content can be provided.")
138135

139-
all_urls = _get_all_urls(ctx)
140-
auth = get_auth(ctx, all_urls)
141-
136+
source_urls = _get_source_urls(ctx)
142137
download_info = ctx.download_and_extract(
143-
# TODO(fzakaria): all_urls here has the remote_patch URL which is incorrect
144-
# I believe this to be a file
145-
all_urls,
138+
source_urls,
146139
ctx.attr.add_prefix,
147140
ctx.attr.sha256,
148141
ctx.attr.type,
149142
ctx.attr.strip_prefix,
150-
canonical_id = ctx.attr.canonical_id or get_default_canonical_id(ctx, all_urls),
151-
auth = auth,
143+
canonical_id = ctx.attr.canonical_id or get_default_canonical_id(ctx, source_urls),
144+
auth = get_auth(ctx, source_urls),
152145
integrity = ctx.attr.integrity,
153146
)
154147
workspace_and_buildfile(ctx)
155148

156-
download_remote_files(ctx, auth = auth)
157-
patch(ctx, auth = auth)
149+
download_remote_files(ctx)
150+
patch(ctx)
158151

159152
return _update_integrity_attr(ctx, _http_archive_attrs, download_info)
160153

@@ -182,15 +175,14 @@ def _http_file_impl(ctx):
182175
download_path = ctx.path("file/" + downloaded_file_path)
183176
if download_path in forbidden_files or not str(download_path).startswith(str(repo_root)):
184177
fail("'%s' cannot be used as downloaded_file_path in http_file" % ctx.attr.downloaded_file_path)
185-
all_urls = _get_all_urls(ctx)
186-
auth = get_auth(ctx, all_urls)
178+
source_urls = _get_source_urls(ctx)
187179
download_info = ctx.download(
188-
all_urls,
180+
source_urls,
189181
"file/" + downloaded_file_path,
190182
ctx.attr.sha256,
191183
ctx.attr.executable,
192-
canonical_id = ctx.attr.canonical_id or get_default_canonical_id(ctx, all_urls),
193-
auth = auth,
184+
canonical_id = ctx.attr.canonical_id or get_default_canonical_id(ctx, source_urls),
185+
auth = get_auth(ctx, source_urls),
194186
integrity = ctx.attr.integrity,
195187
)
196188
ctx.file("WORKSPACE", "workspace(name = \"{name}\")".format(name = ctx.name))
@@ -217,15 +209,14 @@ filegroup(
217209

218210
def _http_jar_impl(ctx):
219211
"""Implementation of the http_jar rule."""
220-
all_urls = _get_all_urls(ctx)
221-
auth = get_auth(ctx, all_urls)
212+
source_urls = _get_source_urls(ctx)
222213
downloaded_file_name = ctx.attr.downloaded_file_name
223214
download_info = ctx.download(
224-
all_urls,
215+
source_urls,
225216
"jar/" + downloaded_file_name,
226217
ctx.attr.sha256,
227-
canonical_id = ctx.attr.canonical_id or get_default_canonical_id(ctx, all_urls),
228-
auth = auth,
218+
canonical_id = ctx.attr.canonical_id or get_default_canonical_id(ctx, source_urls),
219+
auth = get_auth(ctx, source_urls),
229220
integrity = ctx.attr.integrity,
230221
)
231222
ctx.file("WORKSPACE", "workspace(name = \"{name}\")".format(name = ctx.name))

‎tools/build_defs/repo/utils.bzl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,14 +79,14 @@ def _use_native_patch(patch_args):
7979
return False
8080
return True
8181

82-
def _download_patch(ctx, patch_url, integrity, auth):
82+
def _download_patch(ctx, patch_url, integrity, auth = None):
8383
name = patch_url.split("/")[-1]
8484
patch_path = ctx.path(_REMOTE_PATCH_DIR).get_child(name)
8585
ctx.download(
8686
patch_url,
8787
patch_path,
8888
canonical_id = ctx.attr.canonical_id,
89-
auth = auth,
89+
auth = get_auth(ctx, [patch_url]) if auth == None else auth,
9090
integrity = integrity,
9191
)
9292
return patch_path
@@ -108,7 +108,7 @@ def download_remote_files(ctx, auth = None):
108108
remote_file_urls,
109109
path,
110110
canonical_id = ctx.attr.canonical_id,
111-
auth = auth,
111+
auth = get_auth(ctx, remote_file_urls) if auth == None else auth,
112112
integrity = ctx.attr.remote_file_integrity.get(path, ""),
113113
block = False,
114114
)

0 commit comments

Comments
 (0)