How we build without the public internet
summary
Goal: make Bazel builds that never touch the public internet. Uses a semi-automated mirroring pipeline: generate a bazel sync snapshot of workspace repos, parse it with custom scripts, download missing files to internal blob storage and emit a workspace include with mirrored URLs loaded first. Verify with a CI job that uses downloader_config blocking to deny all external hosts then allow internal ones; handle edge cases by rewriting problematic URLs. Initial baked-artifact-in-CI approach required frequent image rebuilds and was abandoned; current solution works reliably but requires ongoing catalog maintenance.
AI-written summary · about
related talks
47mSecure software supply chain on a shoestring budget
30mHow Secure Is Your Build/Server?
50mBuilding on Key – Keeping your Actions and Remote Executions in Tune + Q&A
20mLock the Chef in the Kitchen: Enabling Accurate SBOMs Via Hermetic Builds
23mBuilding Secure Package Pipelines
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
10mFetching private data with Repo Rules and MODULE Extensions
21mReproducible Builds and sstate over CDN - Update on AGL's Infra and CIAT