Description of the problem / feature request:

It would be nice to have a flag, e.g. --experimental_use_urls_as_default_canonical_id, which includes the URLs in the repository cache key if canonical_id isn't set manually in the call to download/download_and_extract. This can be used in a CI system to verify that invalid repository updates don't get checked in.

Feature requests: what underlying problem are you trying to solve with this feature?

It seems that users frequently run into issues with repository rules using cached downloads based on SHA256 despite some other detail (especially URLs) being changed and making it invalid. This isn't noticed until building without that cache entry. See #10630, #10612, #10353, #5144.

The way to prevent this is to use canonical_id to force redownloading, for example by setting it to the URL. The problem is that requiring developers to set canonical_id is prone to error. You could make custom wrappers for e.g. http_file to automatically use the URL as canonical_id, but in a large codebase it's possible this will be accidentally circumvented with the upstream rule definition.

What operating system are you running Bazel on?

macOS 11.6

What's the output of bazel info release?

release 4.2.1