[songqing-sq]

Problem

Gazelle's normal Go fetch helper downloads module ZIPs outside Bazel's repository downloader. A SONiC build that consumes Lemming cannot restore those ZIPs from its Bazel repository cache or remote downloader, even with reviewed Go content checksums.

Solution

Select the ZIP-cache patch release of the current Gazelle 0.54.0 version and add a reviewed 215-module archive SHA-256 lock. Gazelle still resolves module versions and checks h1: content digests; Bazel can now address the original archive bytes by digest. The exported plan lets the shared updater use this workspace's configured Go 1.26.6 SDK.

Dependencies: SONiC Gazelle registry PR #159, which is required before this patch can use the maintained registry. Draft validation selects exact candidate 45a1ebca790a038c73353cd2417cd2df06fb1f1e; replace that temporary registry endpoint with https://raw.githubusercontent.com/securely1g/sonic-bazel-registry/main and refresh the Bazel lock after the dependency merges.

To update the lock from a checkout of the shared updater:

python3 /path/to/sonic-build-infra/go/lock.py --workspace "$PWD" \
  --bazel /path/to/bazel-9.3.0 --plan '@go_zip_lock_plan//:zip-lock.json'

Verification

Based on current main 3fb4b7e293c13bb61a5ee85d3716c8a11e937074, native AMD64, Bazel 9.3.0 and the declared Go 1.26.6 SDK:

• The updater resolved and locked 215 modules with normal Go content verification.
• The read-only lock check passed against the published remote registry candidate, without source overrides.
• bazel test //internal/config:config_test passed.
• The generated Bazel lock contains no local workspace paths; git diff --check passed.

The current source build/test workflows remain selected. Native ARM64 and a complete Lemming image build were outside local validation.

Pinned SONiC consumer

Alpine PR #1 uses the minimal SONiC backport cba6977f, based on Alpine's current 1975dcc4 gitlink. Its SAI/proto source trees are unchanged. The backport is included in this PR's ancestry so the existing canonical Git remote can serve that pinned commit. The current-main source tree and the validation inputs above remain unchanged.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.