Renovate does not recognize Bazel http_archive dependencies using the 'integrity' attribute instead of 'sha256' attribute

[mattnworb]

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitHub Enterpise, renovate-ce 8.0.0

Please tell us more about your question or problem

Bazel's http_archive repository rule for specifying dependenices from outside the Bazel workspace supports two different attributes for specifying the checksum of the archive:

attribute	description
sha256	String; optional - The expected SHA-256 of the file downloaded. This must match the SHA-256 of the file downloaded. It is a security risk to omit the SHA-256 as remote files can change. At best omitting this field will make your build non-hermetic. It is optional to make development easier but either this attribute or integrity should be set before shipping.
integrity	String; optional - Expected checksum in Subresource Integrity format of the file downloaded. This must match the checksum of the file downloaded. It is a security risk to omit the checksum as remote files can change. At best omitting this field will make your build non-hermetic. It is optional to make development easier but either this attribute or sha256 should be set before shipping.

Renovate seems to only recognize http_archives with a sha256 attribute as dependencies that can be updated, and not any with a configured integrity attribute. The Dependency Dashboard does not list any of the http_archive dependencies using this attribute under the list of detected Bazel dependencies.

Since Bazel 7 (released end of 2023) the Bazel CLI recommends users to add an integrity attribute for any http_archives without a checksum, rather than sha256, so the use of this attribute will become more and more common.

Logs (if relevant)

No response

[mattnworb]

I may be misunderstanding the source code in question (I'm not familiar with the zod package for schemas) but

renovate/lib/modules/manager/bazel/rules/http.ts

Lines 129 to 136 in 1f65d31

	export const HttpTarget = z
	.object({
	rule: z.enum(httpRules),
	name: z.string(),
	url: z.string().optional(),
	urls: z.array(z.string()).optional(),
	sha256: z.string(),
	})

seems to confirm that the parsing code for http_archive treats sha256 as required

[viceice]

not a bug. even if we make the sha256 optional, integrity isn't supported.

please open a new feature request discussion to support integrity property

[mattnworb]

ah sorry, I thought this was the feature request form.

[mattnworb]

#31029

[github-actions[bot]]

Hi there,

A maintainer reviewed the information, and decided that this is not a bug. To avoid confusing others, we will close this Discussion. Please keep reading as there is good news too!

The good news is that the maintainer likes your idea, in general. Please create a new Suggest an Idea Discussion. Feel free to copy/paste what you need from this Discussion. Please focus on the feature request: explain what Renovate should do, and how Renovate can know when/what to do. We may convert that Discussion to an Issue when it is ready. Note that you will still have to wait for a maintainer, or someone else, to do the work needed for your feature.

Why are we closing your Discussion? For us, bug reports are about things that are not working as intended, or things that are not working as described in the docs. What you found may be bad behavior, but we do not think it is a bug.

For more details, please read our development docs about bug handling.

Thanks, the Renovate team