Expose sha1 (and possibly other digests) on repository_ctx.download()

[kamalmarhubi]

Description of the feature request:

Expose a sha1 argument on repository_ctx.download() and repository_ctx.download_and_extract(). Consider more hashes, and perhaps a generic digest argument.

Possible examples:

def _my_repo_rule_impl(rctx):
    # blah blah
    rctx.download(
        url = some_url,
        output = my_path
        sha1 = my_sha1
    )

or

def _my_repo_rule_impl(rctx):
    # blah blah
    rctx.download(
        url = some_url,
        output = my_path
        digest = "sha1:" + my_sha1
    )

Feature requests: what underlying problem are you trying to solve with this feature?

At the moment, only a sha256 can be passed to download() and download_and_extract(), which means that using already-existing sha1 hashes is not possible. For example, Maven repositories typically have sha1 and md5 hashes of their contents, but not sha256.

The native maven_jar rule accepts a sha1, and passes it through the cache machinery so that files end up under ${repository_cache}/content_addressable/sha1/. This is not available to Skylark, which prevents creating a Skylark equivalent of that rule. For example, this prevents java_import_external from being a true replacement for maven_jar, where you can generate repository rules directly from a Maven repo without downloading all artifacts.

This came up as I was evaluating @jin's rules_maven which relies on coursier to download and cache artifacts. I'd prefer to resolve artifacts using coursier or another program, but to have Bazel responsible for downloading and caching, generating repository rules that will be snapshotted in resolved.bzl.

Have you found anything relevant by searching the web?

I found #6016, which seems related but not the same. A solution would probably attempt to keep both in mind though.

[dslomov]

@dkelmer wdyt? Is this a useful feature for cousrier integration?

[devversion]

SHA1 seems now supported in ctx.download in subresource integrity format: c9e2be5

[github-actions]

Thank you for contributing to the Bazel repository! This issue has been marked as stale since it has not had any activity in the last 1+ years. It will be closed in the next 14 days unless any other activity occurs or one of the following labels is added: "not stale", "awaiting-bazeler". Please reach out to the triage team (@bazelbuild/triage) if you think this issue is still relevant or you are interested in getting the issue resolved.

[github-actions]

This issue has been automatically closed due to inactivity. If you're still interested in pursuing this, please reach out to the triage team (@bazelbuild/triage). Thanks!