rules_distroless@0.6.1 #6293
rules_distroless@0.6.1 #6293
Conversation
|
Hello @loosebazooka, @thesayyn, modules you maintain (rules_distroless) have been updated in this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds version 0.6.1 of rules_distroless to the Bazel Central Registry. The new version definition is mostly correct and follows the BCR guidelines. However, there is a significant issue in the MODULE.bazel file where several http_archive repositories for examples are defined as regular dependencies. This will cause all downstream users of this module to download unnecessary files. I have provided a high-severity comment with a recommendation to move this logic into a development-only dependency.
| http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") | ||
|
|
||
| http_archive( | ||
| name = "example-bullseye-ca-certificates", | ||
| build_file_content = 'exports_files(["data.tar.xz", "control.tar.xz"])', | ||
| sha256 = "b2d488ad4d8d8adb3ba319fc9cb2cf9909fc42cb82ad239a26c570a2e749c389", | ||
| urls = ["https://snapshot.debian.org/archive/debian/20231106T210201Z/pool/main/c/ca-certificates/ca-certificates_20210119_all.deb"], | ||
| ) | ||
|
|
||
| http_archive( | ||
| name = "example-bullseye-libc-bin", | ||
| build_file_content = 'exports_files(["data.tar.xz"])', | ||
| sha256 = "8b048ab5c7e9f5b7444655541230e689631fd9855c384e8c4a802586d9bbc65a", | ||
| urls = ["https://snapshot.debian.org/archive/debian-security/20231106T230332Z/pool/updates/main/g/glibc/libc-bin_2.31-13+deb11u7_amd64.deb"], | ||
| ) | ||
|
|
||
| http_archive( | ||
| name = "example-bookworm-libc-bin", | ||
| build_file_content = 'exports_files(["data.tar.xz"])', | ||
| sha256 = "38c44247c5b3e864d6db2877edd9c9a0555fc4e23ae271b73d7f527802616df5", | ||
| urls = ["https://snapshot.debian.org/archive/debian-security/20231106T230332Z/pool/updates/main/g/glibc/libc-bin_2.36-9+deb12u3_armhf.deb"], | ||
| ) |
There was a problem hiding this comment.
The http_archive repositories defined here are for examples, but they are not declared as development dependencies. This means that any downstream project that depends on rules_distroless will unconditionally download these .deb files and create these external repositories (example-bullseye-ca-certificates, example-bullseye-libc-bin, example-bookworm-libc-bin), even if they are not used. This adds unnecessary download overhead and pollutes the user's external repository space.
These repository definitions should only be evaluated when rules_distroless is the main module being built (i.e., for development and testing). To fix this, these http_archive calls should be moved into a module extension that is loaded with dev_dependency = True.
bazel-io
added
the
auto-merged
5 participants
Release: https://github.com/bazel-contrib/rules_distroless/releases/tag/v0.6.1
Automated by Publish to BCR