Add --experimental_repository_disable_download to allow users disable download for external repos

src/main/java/com/google/devtools/build/lib/bazel/BazelRepositoryModule.java

@@ -237,6 +237,8 @@ public void beforeCommand(CommandEnvironment env) {
 
  RepositoryOptions repoOptions = env.getOptions().getOptions(RepositoryOptions.class);
  if (repoOptions != null) {
+ downloadManager.setDisableDownload(repoOptions.disableDownload);
+
  repositoryCache.setHardlink(repoOptions.useHardlinks);
  if (repoOptions.experimentalScaleTimeouts > 0.0) {
  starlarkRepositoryFunction.setTimeoutScaling(repoOptions.experimentalScaleTimeouts);

src/main/java/com/google/devtools/build/lib/bazel/repository/RepositoryOptions.java

@@ -56,6 +56,15 @@ public class RepositoryOptions extends OptionsBase {
  + " cache hit, rather than copying. This is intended to save disk space.")
  public boolean useHardlinks;
 
+ @Option(
+ name = "experimental_repository_disable_download",
+ defaultValue = "false",
+ documentationCategory = OptionDocumentationCategory.BAZEL_CLIENT_OPTIONS,
+ effectTags = {OptionEffectTag.UNKNOWN},
+ metadataTags = {OptionMetadataTag.EXPERIMENTAL},
+ help = "If set, downloading external repositories is not allowed.")
+ public boolean disableDownload;
+
  @Option(
  name = "distdir",
  oldName = "experimental_distdir",

src/main/java/com/google/devtools/build/lib/bazel/repository/downloader/DownloadManager.java

@@ -46,6 +46,7 @@ public class DownloadManager {
  private List<Path> distdir = ImmutableList.of();
  private UrlRewriter rewriter;
  private final Downloader downloader;
+ private boolean disableDownload = false;
 
  public DownloadManager(RepositoryCache repositoryCache, Downloader downloader) {
  this.repositoryCache = repositoryCache;
@@ -60,6 +61,10 @@ public void setUrlRewriter(UrlRewriter rewriter) {
  this.rewriter = rewriter;
  }
 
+ public void setDisableDownload(boolean disableDownload) {
+ this.disableDownload = disableDownload;
+ }
+
  /**
  * Downloads file to disk and returns path.
  *
@@ -194,6 +199,10 @@ public Path download(
  }
  }
 
+ if (disableDownload) {
+ throw new IOException(String.format("Failed to download repo %s: download is disabled.", repo));
+ }
+
  try {
  downloader.download(
  urls, authHeaders, checksum, canonicalId, destination, eventHandler, clientEnv, type);

src/test/shell/bazel/starlark_repository_test.sh

@@ -2061,4 +2061,92 @@ EOF
  || fail "Expected success despite needing a file behind basic auth"
 }
 
+function test_disable_download_should_prevent_downloading() {
+ mkdir x
+ echo 'exports_files(["file.txt"])' > x/BUILD
+ echo 'Hello World' > x/file.txt
+ tar cvf x.tar x
+ sha256=$(sha256sum x.tar | head -c 64)
+ serve_file x.tar
+
+ mkdir main
+ cd main
+ cat > WORKSPACE <<EOF
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_archive(
+ name="ext",
+ url = "http://127.0.0.1:$nc_port/x.tar",
+ sha256="$sha256",
+)
+EOF
+ cat > BUILD <<'EOF'
+genrule(
+ name = "it",
+ srcs = ["@ext//x:file.txt"],
+ outs = ["it.txt"],
+ cmd = "cp $< $@",
+)
+EOF
+
+ bazel build --experimental_repository_disable_download //:it > "${TEST_log}" 2>&1 \
+ && fail "Expected failure" || :
+ expect_log "Failed to download repo ext: download is disabled"
+}
+
+function test_disable_download_should_allow_distdir() {
+ mkdir x
+ echo 'exports_files(["file.txt"])' > x/BUILD
+ echo 'Hello World' > x/file.txt
+ tar cvf x.tar x
+ sha256=$(sha256sum x.tar | head -c 64)
+
+ mkdir main
+ cp x.tar main
+ cd main
+ cat > WORKSPACE <<EOF
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_archive(
+ name="ext",
+ url = "http://127.0.0.1/x.tar",
+ sha256="$sha256",
+)
+EOF
+ cat > BUILD <<'EOF'
+genrule(
+ name = "it",
+ srcs = ["@ext//x:file.txt"],
+ outs = ["it.txt"],
+ cmd = "cp $< $@",
+)
+EOF
+
+ bazel build --distdir="." --experimental_repository_disable_download //:it || fail "Failed to build"
+}
+
+function test_disable_download_should_allow_local_repository() {
+ mkdir x
+ echo 'exports_files(["file.txt"])' > x/BUILD
+ echo 'Hello World' > x/file.txt
+ touch x/WORKSPACE
+
+ mkdir main
+ cd main
+ cat > WORKSPACE <<EOF
+local_repository(
+ name="ext",
+ path="../x",
+)
+EOF
+ cat > BUILD <<'EOF'
+genrule(
+ name = "it",
+ srcs = ["@ext//:file.txt"],
+ outs = ["it.txt"],
+ cmd = "cp $< $@",
+)
+EOF
+
+ bazel build --experimental_repository_disable_download //:it || fail "Failed to build"
+}
+
 run_suite "local repository tests"