```py
download = use_extension("@download_utils//download/template:defs.bzl", "download_template")
download.archive(
    name = "coreutils-{version}-{triplet}",
    srcs = ["entrypoint"],
    links = {
        "coreutils{executable.extension}": "entrypoint",
    },
    lock = "//coreutils:lock.json",
    strip_prefix = "coreutils-{version}-{rust.triplet}",
    substitutions = {
        "version": [
            "0.0.28",
            "0.1.0",
        ],
        "triplet": [
            "arm64-linux-gnu",
            "amd64-linux-gnu",
            "arm64-linux-musl",
            "amd64-linux-musl",
            "amd64-windows-msvc",
            "arm64-macos-darwin",
            "amd64-macos-darwin",
        ],
    },
    uploads = [
        "https://gitlab.arm.com/api/v4/projects/bazel%2Fdownload_utils/packages/generic/coreutils/{version}/{rust.archive.basename}",
    ],
    urls = [
        "https://gitlab.arm.com/api/v4/projects/bazel%2Fdownload_utils/packages/generic/coreutils/{version}/{rust.archive.basename}",
        "https://github.com/uutils/coreutils/releases/download/{version}/coreutils-{version}-{rust.archive.basename}",
    ],
)
```

Run `bazel mod tidy --lockfile_mode=update` to generate the lock file.

Run `bazel run @download_utils//download/triplet/lock:upload coreutils/lock.json` to mirror the downloads and lock the integrities.

Allows easier wrapping of the repository rule as `""` is the default value.

When a link is created within a downloaded repository, it needs to be added to the exported files.

This behaviour can be overridden by settings `srcs` (if available) or overriding the `BUILD.bazel` template with `build`.

```
ERROR: The repo contents cache [/builds/bazel/download_utils/.cache/bazel/repo/contents] is inside the workspace [/builds/bazel/download_utils]. This can cause spurious failures. Disable the repo contents cache with `--repo_contents_cache=`, or specify `--repo_contents_cache=<path outside the workspace>`.
```

When a user is using `metadata` attribute, we do not write anything to `WORKSPACE`.

Eventually, the writing of data to `WORKSPACE` will be removed in a breaking change release.

Previously, the canonical arguments were blatted over any previously existing `WORKSPACE`.

This was stupid. It now appends to the file if it exists.

Eventually, in a breaking change we will remove this functionality as it is superseded by `metadata` attribute.

Jonathan Watson authored Feb 26, 2025 and Matthew Clarkson committed Feb 28, 2025

```py
download_file(
    name = "example",
    metadata = {
        "//:integrity.tmpl.bzl", ".integrity.bzl",
    },
)
```

Where `integrity.tmpl.bzl` is:

```py
visibility("public")

INTEGRITY = "{{integrity}}"
```

Then `@example//:.integrity.bzl"` can be used in `load` statement to read the download integrity.

Removes a circular dependency. `rules_diff` indirectly depends on `download_utils`.

Removes `reuse` support.

Will be disabled by default in Bazel 9.

We exclusively use `MODULE.bazel`.

Remove legacy workspace.

Bazel resolves transitive versions based on the `compatibility_level` and
can chose a newer version that what is specified in `MODULE.bazel`.

The warnings are often noise as we are happy to use newer versions, we
just specify the minimum version we are compatible with in `MODULE.bazel`.

Includes breaking change to `toolchain_local_select` which
does not affect this module but is a needed updated for Bazel 8