Disallowing Internet access, even if cached

[lberki]

Sometimes, it's useful to tell Bazel that it's not supposed to access the Internet. Of course, if you want a real security boundary, it's best to put up a firewall, but asking Bazel to error out when it tries to access the Internet results in better diagnostics.

To this end, we have two tools:

1. --experimental_repository_disable_download, which makes Bazel raise an error if it tries to access the Internet
2. --nofetch, which makes Bazel to error out if a repository (even a local one) isn't fetched but needs to be

It looks like there is room for another alternative in between: erroring out if ctx.download() is called at all, regardless of whether the download is cached or not. This would be useful if one wants to test whether their build is independent of the Internet without going through the trouble of wiping the local download cache and because this way, success of builds with a "do not download" flag set would not be dependent of the state of local caches.

@meteorcloudy , WDYT?

(This came up because we ran into an issue not a long time ago where this exact thing happened)

[lberki]

cc @jin

[meteorcloudy]

erroring out if ctx.download() is called at all, regardless of whether the download is cached or not.

Isn't this just a combination of --experimental_repository_disable_download and --repository_cache= ? I guess we can implement a flag that implies both of them?

Another problem is that repository rules are able to call whatever tool with repository_ctx.execute() which may reach out to internet, do you think there is a way to cut off the internet access in such cases?

[meteorcloudy]

Oh, I missed --distdir, but yes, I think --distdir= and --repository_cache= should disable all cache for ctx.download.

[lberki]

So is --experimental_repository_disable_download --repository_cache= --distdir= your official suggestion?

I'm totally fine with that. In that case, I'll probably send out a change to promote the first flag to non-experimental because it does cover an important use case and it seems to be principled enough to support. WDYT?

[meteorcloudy]

SGTM! /cc @Wyverald in case he has different opinion?

[lberki]

I'll send out a change.

[Wyverald]

SGTM

[lberki]

Closing this discussion since the official resolution is "use --repository_disable_download --repository_cache= --distdir=" after promoting the first flag to stable.