How to authenticate with repository_ctx.download? How does auth work?

[grepwood]

Crossposting from #7469

For the last 3 years people have been wanting to know how to achieve this. The only person who did is sitting duck and not telling anybody.

We owe this state of affair to the lackluster documentation: https://bazel.build/rules/lib/builtins/repository_ctx

auth 	[dict](https://bazel.build/rules/lib/core/dict.html); default is {}
An optional dict specifying authentication information for some of the URLs.

As such I would like to ask on behalf of everyone who asked so far, to please update the documentation in that regard.

[peakschris]

@grepwood I believe you can use a credential helper #18429

[peakschris]

Here is the credential helpers spec, including the api for between bazel and the helper: https://github.com/bazelbuild/proposals/blob/main/designs/2022-06-07-bazel-credential-helpers.md