Skip to content

Commit f54fe07

Browse files
coeuvrephilwo
coeuvre
authored and
philwo
committed
Add --experimental_repository_disable_download to allow users disable download for external repos
This PR adds a flag `--experimental_repository_disable_download` which when set will prevent Bazel from downloading external repositories. However, `local_repository`, `new_local_repository` and external repositories already downloaded in the repository cache would still work. Closes #12940. PiperOrigin-RevId: 355332927
1 parent 9d0c732 commit f54fe07

4 files changed

Lines changed: 109 additions & 0 deletions

File tree

‎src/main/java/com/google/devtools/build/lib/bazel/BazelRepositoryModule.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,8 @@ public void beforeCommand(CommandEnvironment env) {
237237

238238
RepositoryOptions repoOptions = env.getOptions().getOptions(RepositoryOptions.class);
239239
if (repoOptions != null) {
240+
downloadManager.setDisableDownload(repoOptions.disableDownload);
241+
240242
repositoryCache.setHardlink(repoOptions.useHardlinks);
241243
if (repoOptions.experimentalScaleTimeouts > 0.0) {
242244
starlarkRepositoryFunction.setTimeoutScaling(repoOptions.experimentalScaleTimeouts);

‎src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,15 @@ public class RepositoryOptions extends OptionsBase {
5656
+ " cache hit, rather than copying. This is inteded to save disk space.")
5757
public boolean useHardlinks;
5858

59+
@Option(
60+
name = "experimental_repository_disable_download",
61+
defaultValue = "false",
62+
documentationCategory = OptionDocumentationCategory.BAZEL_CLIENT_OPTIONS,
63+
effectTags = {OptionEffectTag.UNKNOWN},
64+
metadataTags = {OptionMetadataTag.EXPERIMENTAL},
65+
help = "If set, downloading external repositories is not allowed.")
66+
public boolean disableDownload;
67+
5968
@Option(
6069
name = "distdir",
6170
oldName = "experimental_distdir",

‎src/main/java/com/google/devtools/build/lib/bazel/repository/downloader/DownloadManager.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ public class DownloadManager {
4646
private List<Path> distdir = ImmutableList.of();
4747
private UrlRewriter rewriter;
4848
private final Downloader downloader;
49+
private boolean disableDownload = false;
4950

5051
public DownloadManager(RepositoryCache repositoryCache, Downloader downloader) {
5152
this.repositoryCache = repositoryCache;
@@ -60,6 +61,10 @@ public void setUrlRewriter(UrlRewriter rewriter) {
6061
this.rewriter = rewriter;
6162
}
6263

64+
public void setDisableDownload(boolean disableDownload) {
65+
this.disableDownload = disableDownload;
66+
}
67+
6368
/**
6469
* Downloads file to disk and returns path.
6570
*
@@ -194,6 +199,11 @@ public Path download(
194199
}
195200
}
196201

202+
if (disableDownload) {
203+
throw new IOException(
204+
String.format("Failed to download repo %s: download is disabled.", repo));
205+
}
206+
197207
try {
198208
downloader.download(
199209
urls, authHeaders, checksum, canonicalId, destination, eventHandler, clientEnv, type);

‎src/test/shell/bazel/starlark_repository_test.sh‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2117,4 +2117,92 @@ EOF
21172117
|| fail "Expected success despite needing a file behind basic auth"
21182118
}
21192119

2120+
function test_disable_download_should_prevent_downloading() {
2121+
mkdir x
2122+
echo 'exports_files(["file.txt"])' > x/BUILD
2123+
echo 'Hello World' > x/file.txt
2124+
tar cvf x.tar x
2125+
sha256=$(sha256sum x.tar | head -c 64)
2126+
serve_file x.tar
2127+
2128+
mkdir main
2129+
cd main
2130+
cat > WORKSPACE <<EOF
2131+
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
2132+
http_archive(
2133+
name="ext",
2134+
url = "http://127.0.0.1:$nc_port/x.tar",
2135+
sha256="$sha256",
2136+
)
2137+
EOF
2138+
cat > BUILD <<'EOF'
2139+
genrule(
2140+
name = "it",
2141+
srcs = ["@ext//x:file.txt"],
2142+
outs = ["it.txt"],
2143+
cmd = "cp $< $@",
2144+
)
2145+
EOF
2146+
2147+
bazel build --experimental_repository_disable_download //:it > "${TEST_log}" 2>&1 \
2148+
&& fail "Expected failure" || :
2149+
expect_log "Failed to download repo ext: download is disabled"
2150+
}
2151+
2152+
function test_disable_download_should_allow_distdir() {
2153+
mkdir x
2154+
echo 'exports_files(["file.txt"])' > x/BUILD
2155+
echo 'Hello World' > x/file.txt
2156+
tar cvf x.tar x
2157+
sha256=$(sha256sum x.tar | head -c 64)
2158+
2159+
mkdir main
2160+
cp x.tar main
2161+
cd main
2162+
cat > WORKSPACE <<EOF
2163+
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
2164+
http_archive(
2165+
name="ext",
2166+
url = "http://127.0.0.1/x.tar",
2167+
sha256="$sha256",
2168+
)
2169+
EOF
2170+
cat > BUILD <<'EOF'
2171+
genrule(
2172+
name = "it",
2173+
srcs = ["@ext//x:file.txt"],
2174+
outs = ["it.txt"],
2175+
cmd = "cp $< $@",
2176+
)
2177+
EOF
2178+
2179+
bazel build --distdir="." --experimental_repository_disable_download //:it || fail "Failed to build"
2180+
}
2181+
2182+
function test_disable_download_should_allow_local_repository() {
2183+
mkdir x
2184+
echo 'exports_files(["file.txt"])' > x/BUILD
2185+
echo 'Hello World' > x/file.txt
2186+
touch x/WORKSPACE
2187+
2188+
mkdir main
2189+
cd main
2190+
cat > WORKSPACE <<EOF
2191+
local_repository(
2192+
name="ext",
2193+
path="../x",
2194+
)
2195+
EOF
2196+
cat > BUILD <<'EOF'
2197+
genrule(
2198+
name = "it",
2199+
srcs = ["@ext//:file.txt"],
2200+
outs = ["it.txt"],
2201+
cmd = "cp $< $@",
2202+
)
2203+
EOF
2204+
2205+
bazel build --experimental_repository_disable_download //:it || fail "Failed to build"
2206+
}
2207+
21202208
run_suite "local repository tests"

0 commit comments

Comments
 (0)