Yes. The http_archive rule can run without a checksum, but Bazel's own reference calls that a security risk and says either sha256 or integrity should be set before shipping. A checksum turns a download from "whatever the server returns today" into "exactly the bytes we reviewed".
What the rule says
Both http_archive and http_file accept two optional checksum attributes. The sha256 attribute is the expected SHA-256 of the downloaded file. The integrity attribute is a checksum in Subresource Integrity format. The download must match, or the fetch fails. The reference notes that leaving them out makes development easier but is a risk, and that one of them should be set before shipping.
Why it matters for supply chain risk
Without a checksum, three things can change under you:
- The upstream owner replaces a release asset, legitimately or not.
- A mirror or proxy serves different content.
- An expired domain or hijacked account serves a new file at the old URL.
With a checksum, each of those becomes a failed build that someone has to look at. That is the behavior you want.
How to get the value safely
- Download the archive once, from the official release location, over HTTPS.
- Compare it with any checksum the project publishes, ideally signed or listed on a separate channel.
- Compute the hash locally and put it in the rule.
- Add the exact release URL, not a branch or a moving tag.
http_archive(
name = "example",
urls = ["https://example.com/releases/example-1.2.3.tar.gz"],
sha256 = "<64 hex characters you computed and verified>",
)
If you only ran the build with no checksum and copied the value Bazel reported, you have recorded what the server sent that day, which is fine for repeatability but is not review. Say so in the commit message.
Patches and extra files
The rule also supports patches and remote patches, each with its own integrity map for the files fetched. Treat patches as source you maintain: review them, keep them in the repository where you can, and give remote ones checksums too.
Where this fits in the module world
Registry modules carry their own source metadata, and Bazel records hashes of registry files in the lockfile. Direct http_archive calls remain for things not in a registry, and those are exactly the ones that need your checksum discipline.
A quick audit
Search the repository for every http_archive and http_file, and list any without sha256 or integrity. That list is your backlog. Also check for URLs that point at a branch name or "latest".
Where Safeguard fits
Safeguard can inventory the dependencies your repository declares through SBOM and dependency scanning, and reachability analysis helps you decide which findings matter first. You can try a free scan on a repository to see what it finds. Check coverage for your specific build files before relying on it.
Try it yourself
Open the demo and count how many dependencies in the inventory arrive from archives or registries you never chose directly. Those are the ones that need pinned checksums.
Click through it at your own pace, or open it full screen.
Quick check
Is sha256 or integrity required for http_archive to work?
No, both are optional, which is why it is easy to ship without one. The reference says one should be set before shipping.
Does a checksum prove the archive is safe?
No. It proves the bytes match what you recorded. You still need to review where the value came from.
Sources
Last reviewed: 19 October 2026.
