Adding a new dependency on an external repo

Our preference is to keep Bazel small, but we know that it is important to stand on the shoulders of giants and reuse their work. Sometimes, that means making Bazel depend on an external repository.

Whenever possible, we prefer to depend on it by reference, rather than by vendoring in the code. If this were your own project, you could just add an http_archive rule to your WORKSPACE. For Bazel, we have a few additional constraints:

• We provide a "dist archive" (the *-dist.zip files that we provide for releases) that can be used to build Bazel completely offline.
• We build & test the integrity of that archive in our CI.
• For availability and speed during CI, we mirror external repos to a well connected cloud store.

This means that you must also add a reference to the new repository to the rules which build the distribution archive. The steps are

1. Mirror the new repo to mirror.bazel.build

   wget https://github.com/bazelbuild/rules_pkg/releases/download/0.2.0/rules_pkg-0.2.0.tar.gz
   gsutil cp rules_pkg-0.2.0.tar.gz gs://mirror//github.com/bazelbuild/rules_pkg/rules_pkg-0.2.0.tar.gz
   

2. Add the new http_archive rule. Example
3. Add it to the archives list of "additional_distfiles". Example
4. Add a mapping from file name to the sha256 sum. Example
5. Add a mapping from a file name to the list of urls it can come from. Example

Background information:

• https://github.com/bazelbuild/bazel/issues/5202#issuecomment-389216667
• https://github.com/bazelbuild/bazel/commit/f250784293167ee01dab778731573a36e7820499
• https://github.com/bazelbuild/bazel/commit/3c9cd82b847f3ece8ec04b2029bd5e8ad0eb7502