Please provide a `source` query param when downloading Zig

[silversquirl]

As mentioned in Zig's community mirrors usage guide, it is strongly recommended to provide a source query parameter when downloading from Zig mirrors. This allows those running the mirrors to identify where traffic is coming from, which is helpful when there is an unexpected traffic spike due to something like a misconfigured CI job.

I'm not hugely familiar with Bazel so I might've missed something, but I believe you aren't currently providing this parameter.
You also don't appear to be validating any signatures for the downloaded tarballs, though this isn't a huge deal since you're hardcoding checksums anyway :)

Thanks!

[aherrmann]

Thanks for raising this!

Indeed, rules_zig does not currently set the source parameter. I'll try to look into this in the coming days.

You also don't appear to be validating any signatures for the downloaded tarballs, though this isn't a huge deal since you're hardcoding checksums anyway :)

Yes, I've been meaning to open a ticket about this, but never got around to it. The way Bazel works, it's actually quite hard to implement a minisig check. The download and artifact validation takes place within Bazel itself, so, implementing this requires adding support to Bazel core. But, as you say, Bazel verifies downloads via checksums, and as far as I understand that's sufficient to ensure that the artifacts are correct and have not been tampered with. But, the documentation states

you must make sure to validate the minisign signature for every tarball you download against the ZSF’s public key

So, the "must" here looks like a bug to me, as a checksum check of the artifact is also sufficient.