Suggest integrity instead of sha256 attribute in http_* rules

This attribute is also present on `archive_override`.

Work towards #17803

Closes #20156.

PiperOrigin-RevId: 581950628
Change-Id: Ied31b9bcf44d850e506f51d73d32059248457aad

src/test/shell/bazel/bazel_repository_cache_test.sh

@@ -124,6 +124,7 @@ EOF
     zip -0 -ry "$repo2_zip" WORKSPACE fox >& $TEST_log
     repo2_name=$(basename "$repo2_zip")
     sha256=$(sha256sum "$repo2_zip" | cut -f 1 -d ' ')
+    integrity="sha256-$(cat "$repo2_zip" | openssl dgst -sha256 -binary | openssl base64 -A)"
   fi
   serve_file "$repo2_zip"
 
@@ -278,7 +279,7 @@ EOF
         //zoo:breeding-program >& $TEST_log \
     || fail "expected fetch to succeed"
 
-  expect_log "${sha256}"
+  expect_log "${integrity}"
 
   # Shutdown the server; so fetching again won't work
   shutdown_server

src/test/shell/bazel/workspace_resolved_test.sh

@@ -335,10 +335,10 @@ test_http_return_value() {
   touch a/f.txt
 
   zip a.zip a/*
-  expected_sha256="$(sha256sum "${EXTREPODIR}/a.zip" | head -c 64)"
+  expected_integrity="sha256-$(cat "${EXTREPODIR}/a.zip" | openssl dgst -sha256 -binary | openssl base64 -A)"
   rm -rf a
 
-  # http_archive rule doesn't specify the sha256 attribute
+  # http_archive rule doesn't specify the integrity attribute
   mkdir -p main
   cat > main/WORKSPACE <<EOF
 workspace(name = "main")
@@ -355,7 +355,7 @@ EOF
   bazel sync \
       --experimental_repository_resolved_file=../repo.bzl
 
-  grep ${expected_sha256} ../repo.bzl || fail "didn't return commit"
+  grep ${expected_integrity} ../repo.bzl || fail "didn't return integrity"
 }
 
 test_sync_calls_all() {

tools/build_defs/repo/http.bzl

@@ -129,10 +129,10 @@ def _get_auth(ctx, urls):
         netrc = read_user_netrc(ctx)
     return use_netrc(netrc, urls, ctx.attr.auth_patterns)
 
-def _update_sha256_attr(ctx, attrs, download_info):
-    # We don't need to override the sha256 attribute if integrity is already specified.
-    sha256_override = {} if ctx.attr.integrity else {"sha256": download_info.sha256}
-    return update_attrs(ctx.attr, attrs.keys(), sha256_override)
+def _update_integrity_attr(ctx, attrs, download_info):
+    # We don't need to override the integrity attribute if sha256 is already specified.
+    integrity_override = {} if ctx.attr.sha256 else {"integrity": download_info.integrity}
+    return update_attrs(ctx.attr, attrs.keys(), integrity_override)
 
 def _http_archive_impl(ctx):
     """Implementation of the http_archive rule."""
@@ -155,7 +155,7 @@ def _http_archive_impl(ctx):
     workspace_and_buildfile(ctx)
     patch(ctx, auth = auth)
 
-    return _update_sha256_attr(ctx, _http_archive_attrs, download_info)
+    return _update_integrity_attr(ctx, _http_archive_attrs, download_info)
 
 _HTTP_FILE_BUILD = """\
 package(default_visibility = ["//visibility:public"])
@@ -195,7 +195,7 @@ def _http_file_impl(ctx):
     ctx.file("WORKSPACE", "workspace(name = \"{name}\")".format(name = ctx.name))
     ctx.file("file/BUILD", _HTTP_FILE_BUILD.format(downloaded_file_path))
 
-    return _update_sha256_attr(ctx, _http_file_attrs, download_info)
+    return _update_integrity_attr(ctx, _http_file_attrs, download_info)
 
 _HTTP_JAR_BUILD = """\
 load("{rules_java_defs}", "java_import")
@@ -235,7 +235,7 @@ def _http_jar_impl(ctx):
         rules_java_defs = str(Label("@rules_java//java:defs.bzl")),
     ))
 
-    return _update_sha256_attr(ctx, _http_jar_attrs, download_info)
+    return _update_integrity_attr(ctx, _http_jar_attrs, download_info)
 
 _http_archive_attrs = {
     "url": attr.string(doc = _URL_DOC),