Description of the problem / feature request:

It would be very useful if, in addition to the existing .netrc support, the http_archive and http_file repository rules could be configured to use a credential helper executable.

Feature requests: what underlying problem are you trying to solve with this feature?

The most important use case for this, at least for our team, but I suspect for others as well, would be downloading release artifacts from private git repositories.

Assuming one has git credentials set up properly, one can run e.g.

$ printf 'protocol=https\nhost=github.com\n' | git credential fill | sed -n 's/^password=//p'

to get the required authorization token (which may be a PAT, or an oauth token, depending on configuration; either will work).

Alternatively, if one is using the gh cli tool,

$ gh auth status  -t |& sed -n 's/.*Token: //p'

Other examples of tools which might be useful for this sort of thing:

• cloudflared access token -app=foo.net
• aws ecr get-authorization-token
• oauth2l
• keyring

In most of these cases it's possible to take the provided token and put it in one's .netrc, but that's neither convenient nor particularly secure.

What operating system are you running Bazel on?

linux

What's the output of bazel info release?

release 5.0.0

Have you found anything relevant by searching the web?

This is maybe tangentially related to #14372