7.0.0
Bazel 7.0 is a major LTS release. It contains new features and backwards incompatible changes.
Blog post: https://blog.bazel.build/2023/12/11/bazel-7-release.html
Highlights
- Bzlmod (Bazel’s new way to manage 3rd party dependencies) is now enabled by default (--enable_bzlmod).
- With Bazel 7 you can still use WORKSPACE, but you should plan migrating your external dependencies from WORKSPACE to MODULE.bazel. With Bazel 8, we plan to disable WORKSPACE by default (can still be enabled) and with Bazel 9 we plan to remove the legacy WORKSPACE based dependency system. See the Bzlmod migration guide for more information.
- Bazel now starts executing actions while it is still analyzing other top-level targets (Project Skymeld).
- This reduces end-to-end wall time for multi-target builds by up to 15%.
- Platform-based toolchain resolution is now enabled for Android and C++.
- Android rules now use platforms and toolchains to control the target devices.. Android projects will need to stop passing the legacy flag
--fat_apk_cpu, and instead use--android_platformsusing platforms defined with the@platforms//os:androidconstraint. The https://github.com/bazelbuild/rules_android repository defines four standard Android platforms for projects that use those rules,@rules_android//:armeabi-v7a,@rules_android//:arm64-v8a,@rules_android//:x86,@rules_android//:x86_64. Full details are available in the Android Platforms announcement.
- Android rules now use platforms and toolchains to control the target devices.. Android projects will need to stop passing the legacy flag
- Build without the Bytes (BwoB) is now enabled by default (
--remote_download_outputsnow defaults totoplevel).- This reduces the number of downloaded artifacts when using remote caching and execution significantly, speeding up builds by up to 40%.
- This mode also enables Bazel to gracefully handle remote cache evictions.
Migration-Ready Incompatible Flags
Prepare for future Bazel changes by using the following incompatible flags for early migration:
- --incompatible_auto_exec_groups
- --incompatible_disable_non_executable_java_binary
- --incompatible_disallow_struct_provider_syntax
- --incompatible_disable_target_provider_fields
- --incompatible_struct_has_no_methods
- --incompatible_stop_exporting_language_modules
- --incompatible_disallow_empty_glob
- --incompatible_disable_starlark_host_transitions
- --incompatible_config_setting_private_default_visibility
Already flipped and will be removed at head:
- --incompatible_no_attr_license
- --incompatible_disable_objc_library_transition
- --incompatible_fail_on_unknown_attributes
- --incompatible_enable_cc_toolchain_resolution
- --incompatible_existing_rules_immutable_view
- --incompatible_always_check_depset_elements
- --incompatible_visibility_private_attributes_at_definition
- --incompatible_disallow_unsound_directory_outputs
General
- [Incompatible] Many flags have been removed as part of the effort to remove and clean up unused flags (see the appendix for a full list; also #19296).
- [Incompatible]
--incompatible_check_sharding_supportis enabled by default. Sharded tests with test runners that do not properly advertise support for test sharding will fail. Refer to #18339 for migration advice.
Bazel’s embedded JVM has been upgraded to JDK 21.
Android
- [Incompatible] The flag --android_include_proguard_location_references is removed and --no_proguard_location_reference is now added unconditionally to the command line of aapt2.
- Updated Android manifest merger to v30.1.3.
- Dropped support for legacy (pre-D8) desugaring.
- Added support for optimizers rewriting baseline profiles.
- Android resources will no longer propagate through neverlinked libraries by default.
- Set Android Databinding to v2 and Databinding AndroidX to true and remove support for Databinding V1.
C++ / Objective-C
- [Incompatible] Added a new flag
--incompatible_use_host_features. When this flag is enabled,--featuresonly applies to targets built in the target configuration, and--host_featuresis used for the host / exec configuration - [Incompatible] C++ rules use platform-based toolchain resolution (
--incompatible_enable_cc_toolchain_resolutionis now on). See #7260. - [Incompatible] Remove 'darwin' as a CPU value, use 'darwin_x86_64' instead
- [Incompatible] cc_binary targets with dynamic_deps attributes no longer link indirect dynamic_deps on Unix. This might be an incompatible change if you are using RUNPATHs (instead of RPATHs) in your cc_shared_librarys. Enable the feature exclude_bazel_rpaths_in_transitive_libs or use_rpath_instead_of_runpath for those cc_shared_librarys.
- [Incompatible] The
cc_host_toolchain_aliasrule is deleted. Please usecc_toolchain_aliasrule instead. - [Incompatible] Removed apple_crosstool_transition. Use transition_support.apple_rule_transition from rules_apple instead.
- [Incompatible] The
BAZEL_CURRENT_REPOSITORYpreprocessor variable, which holds the canonical name of the Bazel repository containing acc_*target, is now only set during compilation if the target depends on the C/C++ runfiles library@bazel_tools//tools/cpp/runfilesviadepsorimplementation_deps. - C++ rules on Windows calling cc_common.create_linking_context_from_compilation_outputs check whether each target of the rule type should produce a dynamic library. This check used to be part of cc_common API, but is now moved to the caller rules instead.
- C++ branch coverage is now enabled if gcov version is 8 or newer.
- cc_shared_library is no longer experimental, see #16709 for details
- cc_test can now be configured by using a native.toolchain()
objc_librarynow produces better error messages while expanding make variables.- Unexpected C/C++ absolute includes now result in more descriptive error messages for unexpected cc absolute includes. They are not reported anymore reported as "undeclared inclusion(s)"
- Compilation actions using the auto-configured MSVC toolchain are forced to emit error messages in English if the English language pack for Visual Studio is installed.
- Fixed includes attribute of
objc_librarywhen sibling repository layout is used.
Configurability
- [Incompatible] The flag
--extra_execution_platformsno longer accumulates values over multiple specifications. To use multiple execution platforms, set--extra_execution_platforms=platform1,platform2instead of--extra_execution_platforms=platform1 --extra_execution-platforms=platform2. The former registers bothplatform1andplatform2while the latter overridesplatform1withplatform2. - [Incompatible]
copy_from_ruleon exec_group is deprecated (#17668).
[Incompatible]platform,constraint_setting, andconstraint_valueno longer take anapplicable_licensesvalue. Use package level defaults instead. - [Incompatible]
default_package_metadatadoesn't apply toplatform,constraint_setting, orconstraint_valueanymore. - [Incompatible] Duplicates in when using
query --output=xml --aspect_deps=preciseare removed. - [Incompatible] Starlark API: removed outdated
ctx.host_fragments,ctx.host_configuration. - [Incompatible]
genrule.exec_toolsis removed. Usegenrule.toolsinstead. - [Incompatible]
@bazel_tools//config:common_settings.bzlhas been removed. Use@bazel_skylib//rules:common_settings.bzlinstead. - [Incompatible]
--incompatible_visibility_private_attributes_at_definitionis flipped to true. This supports prohibiting references to tools andconfig_settingsused by internal rule logic. See #19330. - The new flag
--use_target_platform_for_testsallows one to execute tests with the target platform instead of the execution platform. - The new flag
--skip_incompatible_explicit_targetscan be used to skip incompatible targets even when explicitly requested on the command line. This changes the default behavior of reporting an error in this case. See https://bazel.build/extending/platforms#when-targets-skipped. - Added flag
--proto:include_attribute_source_aspectsthat will include a new fieldsource_aspect_nameto theAttributemessage that indicates the source aspect that the attribute comes from. default_applicable_licensesinpackage()now applies to the entire BUILD file, regardless of where in the BUILD thatpackage()is called.
Core
- [Incompatible] When multiple --deleted_packages options are passed on the command line, they will be concatenated instead of the latest one taking effect.
- [Incompatible] JVM options in environment variables JAVA_TOOL_OPTIONS and JDK_JAVA_OPTIONS now do not get to the server anymore; use --host_jvm_args instead.
- [Incompatible]
--incompatible_disallow_unsound_directory_outputsis enabled by default: actions are now forbidden from creating an output directory where a file was expected. - The location of rules that explicitly specify
generator_nameand/orgenerator_functionattributes (typically because they are incidentally copied fromnative.existing_rule()) is now the top-level call in theBUILDfile, which is consistent with rules that do not explicitly specify these attributes. - Warnings (most notably those associated with the
deprecationrule attribute) are no longer replayed on subsequent invocations unless the target in question is re-analyzed. Warnings are purely informational, so this change has no bearing on the correctness of the build. Downstream tests that break due to this change should update their expectations.
External Dependencies
- [Incompatible] All labels in Bazel error messages, log output, Build Event Protocol, etc. are now prefixed with double-at (
@@) instead of single-at (@) where applicable, to properly denote that they contain canonical repo names. - [Incompatible] The attribute
new_local_repository.build_fileno longer accepts a path; a label must be passed instead. - [Incompatible] The
--experimental_repository_cache_urls_as_default_canonical_idflag is no longer available. Instead, thehttp_archive,http_file,http_jar,jvm_maven_import_external, andjvm_import_externalrepository rules now use the URLs as the canonical ID if none is provided explicitly. If this behavior is not desired, it can be disabled via--repo_env=BAZEL_HTTP_RULES_URLS_AS_DEFAULT_CANONICAL_ID=0. - [Incompatible] Toolchains and execution platforms are now registered in the following order with --enable_bzlmod:
- root module’s module file
- WORKSPACE (or WORKSPACE.bzlmod if present)
- non-root modules’ module files
- default toolchains registered by Bazel (does not apply with WORKSPACE.bzlmod or execution platforms)
- Bzlmod lockfile is enabled by default (--lockfile_mode defaults to update).
- Added a new
max_compatibility_levelattribute to thebazel_depdirective, which allows version selection to upgrade a dependency up to the specified compatibility level. - Bazel now throws an error if the root module specifies overrides on nonexistent modules.
- Added support for a new directive
use_repo_rulein MODULE.bazel files, which allows you to conveniently declare repos that are only visible within your module. - --experimental_repository_disable_download is now promoted to stable and is also available under the name --repository_disable_download.
Java
- [Incompatible] --legacy_bazel_java_test is now a no-op
- [Incompatible] The deprecated fields transitive_deps, transitive_runtime_deps are dropped from JavaInfo
- [Incompatible] The --experimental_java_proto_library_default_has_services command line option and the Starlark symbol java_common.experimental_java_proto_library_default_has_services function are not available anymore.
- [Incompatible] java_test no longer produces deploy jars.
- [Incompatible] JavaInfo.java_outputs.source_jars now returns a Depset. See #18966.
- [Incompatible] Java toolchains rules are moved from
@bazel_tools//tools/jdkto rules_java (#18558), please switch to using the rules from@rules_java. - [Incompatible] Java runtime toolchains created via
local_java_repositoryfrom@bazel_tools//tools/jdk:local_java_repository.bzl, which includeslocal_jdk, now havetarget_compatible_withset to the auto-detected host constraints. This can result in errors about toolchain resolution failures for@bazel_tools//tools/jdk:runtime_toolchain_type, especially when cross-compiling. These failures can be fixed in the following ways (listed in decreasing order of preference):- Replace
java_binarytargets that aren't meant to be run withbazel runor as tools during the build withjava_single_jar(available in@rules_java//java:java_single_jar.bzl). Such targets do not require a Java runtime for the target configuration. - Set
--java_runtime_version=remotejdk_Nfor some Java versionNto let Bazel choose and download an appropriate remote JDK for the current target platform. This setting defaults tolocal_jdk, which means that Bazel can only use the local JDK, which isn't compatible with any other platform. - Manually define and register a
local_java_runtimewith no value set forexec_compatible_with(defaults to[]) and select it by setting--java_runtime_versionto itsname. This fully restores the previous behavior, but can result in incorrect results when cross-compiling (see #18265).
- Replace
- [Incompatible] The moving of some rules and providers from native to Starlark changes the output of the providers function with cquery. (see #20473)
Local Execution
- [Incompatible] Bazel's local CPU resource on Linux is now container aware. Use
--local_cpu_resources,--loading_phase_threadsor--jobsto override. - [Incompatible] The sandboxfs sandboxing strategy has been removed. It hadn't been maintained for a long time, it didn't work for most users and it was not consistently faster while being complex to set up.
- [Incompatible] High priority workers functionality has been removed as we have not seen faster builds in scenarios they have been designed for.
- [Incompatible]
--incompatible_sandbox_hermetic_tmpis enabled by default. - Directories used by sandboxed non-worker execution may be reused to avoid unnecessary setup costs. This behavior can be disabled with --noreuse_sandbox_directories.
- Symlink trees created by sandboxing will be deleted asynchronously. This behavior can be disabled with --experimental_sandbox_async_tree_delete_idle_threads=0.
Performance
- [Incompatible] Fixed spitting out multiple “Build completed” messages, and made them subject to filtering with
--ui_event_filters. This has the side effect of changing the message on unsuccessful builds fromFAILED: Build did NOT complete successfully (0 packages loaded)toERROR: Build did NOT complete successfully. - [Incompatible] JSON profile: Counter series are now doubles instead of strings.
- [Incompatible]
--experimental_execution_graph_logno longer exists. Current users that want local logs need to pass--experimental_enable_execution_graph_log --experimental_execution_graph_log_path=/some/local/path. Current users that want logs uploaded to BEP need to pass--experimental_enable_execution_graph_log --experimental_stream_log_file_uploads. - [Incompatible] --experimental_genquery_use_graphless_query is now a NO-OP.
- [Incompatible] Changes to --execution_log_{json,binary}_file:
- Outputs are now correctly populated when building without the bytes
- Action digest is now correctly populated in cache hits
- The redundant progress_message and walltime fields have been removed
- The remote_cache_hit field is now called cache_hit, as it’s also set for disk cache hits
- Log sorting may now be disabled by setting --noexecution_log_sort
- It’s no longer possible to simultaneously request both execution log formats
- The --experimental_execution_log_spawn_metrics flag has been removed; the spawn metrics are now unconditionally set
- The --experimental_execution_log_file flag has been removed; use --execution_log_binary_file together with --noexecution_log_sort
- Add
aquery --output=streamed_protowhich writes a stream of length delimited ActionGraphContainer containing a single Artifact, Action, Target, DepSetOfFiles, Configuration, AspectDescriptor, RuleClass, PathFragment proto. This breaks up the ActionGraphContainer into multiple ones which will prevent large protos from crashing Bazel. - (BEP) TargetConfigured events will be marked aborted instead of published when there is an analysis error. This is motivated by a low level Blaze change aimed at improving scalability.
- The new
--consistent_labelsoption onquery,cquery, andaquerycan be used to force consistent label formatting across all output modes that is also compatible withstr(Label(...))in Starlark.
Python
- [Incompatible] --experimental_build_transitive_python_runfiles is flipped to false. Setting it to true is no longer supported. See #16303 for details
- [Incompatible] --incompatible_python_disable_py2 is flipped to true. See #17293 and #15684 for details.
- [Incompatible] py_transitions top-level has been removed.
- The Python rules built into Bazel have been reimplemented in Starlark, which introduces a handful of incompatible edge cases. See #15897 for details.
- The
stampattribute can no longer be a configurable (select-based) boolean value. - The
legacy_create_initattribute can no longer be a configurable (select-based) boolean value. - In
cquerycommands, the PyInfo and PyRuntimeInfo provider names, as returned by theproviders()function, have changed. - For
py_testto add therequires-darwinexecution requirement, the Apple OS constraints (@platforms//os:{ios,macos,tvos,watchos}) must match. Setting the--cpuflag (e.g--cpu=darwin_x86_64) isn't sufficient.
- The
- The flags
--incompatible_python_disallow_native_rulesand--python_native_rules_allowlisthave been added to aid migrating code from using the builtin Bazel Python rules to using rules_python. See #17773 for details.
Remote Execution
- [Incompatible] Building without the bytes is now the default (i.e.,
--remote_download_outputsdefaults totoplevel, meaning that only the outputs of top-level targets and those required by local actions will be downloaded). To download additional outputs, use--remote_download_regex. To revert to downloading all outputs, set--remote_download_all. - [Incompatible] When an incremental build fails because one or more blobs were evicted from the disk/remote cache, Bazel will now exit with exit code 39. Set
--experimental_remote_cache_eviction_retriesto automatically retry the build in this case. - Add flags
--experimental_remote_cache_lease_extensionand--experimental_remote_cache_ttl, defaulting to 3 hours, allowing Bazel to automatically extend leases on remote cache blobs while a build is in progress --experimental_remote_build_event_uploadhas been renamed to--remote_build_event_upload.--experimental_action_cache_store_output_metadatahas been renamed to--action_cache_store_output_metadata.- Changed the default value for
--remote_build_event_uploadtominimal. --experimental_remote_cache_compressionhas been renamed to--remote_cache_compression.--experimental_remote_grpc_loghas been renamed to--remote_grpc_log.--incompatible_remote_build_event_upload_respect_no_cacheis now a no-op.- Non-ASCII arguments are now correctly written to parameter files instead of as mojibake.
- --remote_download_minimal no longer implies --nobuild_runfile_links.
- –remote_download_{toplevel,minimal} no longer imply --experimental_inmemory_{jdeps,dotd}_files, which now default to true.
--zip_undeclared_test_outputsnow preserves symlinks when zipping$TEST_UNDECLARED_OUTPUTS_DIR.
Starlark / Build Language
- [Incompatible] The
cmd_helpermodule has been removed. - [Incompatible]
ctx.new_filehas been removed;ctx.actions.declare_fileis to be used instead. - [Incompatible] proto_compiler attribute removed from proto_lang_toolchain (it was recently introduced, and there is no evidence of use)
- [Incompatible] testing.analysis_test is not experimental anymore.
- [Incompatible] Non-existent rule attributes can not be set anymore, not even to None. See #19403.
- [Incompatible] --incompatible_merge_fixed_and_default_shell_env is flipped to true. See #19317 for details.
- [Incompatible] The rule function now takes only the implementation function positionally; other parameters have to be named.
- Double value positive infinity is now correctly encoded as "inf" instead of "+inf" for textprotos.
- json.decode now takes an optional
defaultparameter; if this parameter is specified and decoding fails, json.decode will return thedefaultvalue instead of failing Starlark evaluation. - starlark_doc_extract is enabled. It's a native rule for Starlark documentation extraction. This rule is intended mainly for internal use by Stardoc.
rule()andattr.*can no longer be (pointlessly) called during WORKSPACE evaluation and repository rule evaluation.- attr objects in Starlark now use value equality rather than reference equality.
Appendix: Removed flags
- The following flags are removed as part of the effort to remove and clean up unused flags:
- --android_include_proguard_location_references
- --apple_compiler
- --apple_enable_auto_dsym_dbg
- --call_count_output_path
- --debug_print_action_contexts
- --distinct_host_configuration
- --dynamic_worker_strategy
- --experimental_allow_top_level_aspects_parameters
- --experimental_android_local_test_binary_resources
- --experimental_async_execution
- --experimental_availability_info_exempt
- --experimental_cc_shared_library_debug
- --experimental_cpp_compile_argv_ignore_param_file
- --experimental_dynamic_execution_cpu_limited
- --experimental_dynamic_skip_first_build
- --experimental_execution_graph_log_cached
- --experimental_execution_graph_log_missed
- --experimental_includes_attribute_subpackage_traversal
- --experimental_keep_config_nodes_on_analysis_discard
- --experimental_lazy_template_expansion
- --experimental_local_memory_estimate
- --experimental_multi_cpu
- --experimental_multi_threaded_digest
- --experimental_prioritize_local_actions
- --experimental_replay_action_out_err
- --experimental_repository_hash_file
- --experimental_shortened_obj_file_path
- --experimental_show_artifacts
- --experimental_skyframe_include_scanning
- --experimental_supports_info_crosstool_configuration
- --experimental_use_sh_binary_stub_script
- --experimental_verify_repository_rules
- --incompatible_avoid_conflict_dlls
- --incompatible_disable_cc_configuration_make_variables
- --incompatible_disable_cc_toolchain_label_from_crosstool_proto
- --incompatible_disable_crosstool_file
- --incompatible_disable_depset_in_cc_user_flags
- --incompatible_disable_expand_if_all_available_in_flag_set
- --incompatible_disable_legacy_cpp_toolchain_skylark_api
- --incompatible_disable_legacy_flags_cc_toolchain_api
- --incompatible_disable_managed_directories
- --incompatible_disable_runtimes_filegroups
- --incompatible_disable_sysroot_from_configuration
- --incompatible_disable_tools_defaults_package
- --incompatible_disallow_legacy_javainfo
- --incompatible_display_source_file_location
- --incompatible_dont_emit_static_libgcc
- --incompatible_enable_legacy_cpp_toolchain_skylark_api
- --incompatible_force_strict_header_check_from_starlark
- --incompatible_genquery_use_graphless_query
- --incompatible_linkopts_in_user_link_flags
- --incompatible_load_cc_rules_from_bzl
- --incompatible_provide_cc_toolchain_info_from_cc_toolchain_suite
- --incompatible_remove_cpu_and_compiler_attributes_from_cc_toolchain
- --incompatible_require_feature_configuration_for_pic
- --incompatible_use_platforms_repo_for_constraints
- --legacy_spawn_scheduler
- --print_workspace_in_output_paths_if_needed
- --remove_all_convenience_symlinks
- --show_warnings
- --tvos_simulator_version
- --tvos_simulator_device
- --use_single_jar_apk_builder
- --use_workers_with_dexbuilder
- --watchos_simulator_version
- --watchos_simulator_device
Acknowledgements:
This release contains contributions from many people at Google, as well as Adam Lavin, Adrian Imboden, Alan Falloon, Alessandro Patti, Alex Eagle, Alexander Grund, AlexTereshenkov, Amanda L Martin, Amet Umerov, Andreas Herrmann, Andy Hamon, andyrinne12, Ankit Agarwal, Ankush Goyal, Anshuman Mishra, Anthony Ter-Saakov, Antoine Musso, Artem Zinnatullin, arun.sampathkumar, aryeh, Austin Schuh, Benjamin Lee, Benjamin Peterson, Benjamin Sigonneau, Boleyn Su, Brentley Jones, Cameron Martin, Chirag Ramani, Chris Sauer, Christopher Peterson Sauer, Christopher Rydell, Christopher Sauer, Conall O’Brien, Daniel Grunwald, Daniel KT, Daniel Wagner-Hall, David Ostrovsky, dhmemi, Dimi Shahbaz, eareilg, Ed Schouten, Emil Kattainen, Ezekiel Warren, Fabian Meumertzheim, Fahrzin Hemmati, Gaspare Vitta, George Gensure, Greg Magolan, Grzegorz Lukasik, Guillaume Maudoux, Gunnar Wagenknecht, Halil Sener, Hao Yuan, Ilan Keshet, Ivan Golub, Jack Dai, James Ma, Jason Mobarak, Jasper, Jay Conrod, Jeff Hodges, Jeremy Volkman, Jimm chja20, Joel Jeske, John Hinnegan, Jon Landis, Jon Parise, jonrose-dev, Joseph Lisee, Joseph Tilahun, Julio Merino, Kai Zhang, Keith Smiley, Konstantin Erman, Krzysztof Naglik, Kun-Lu, Laurenz Altenmller, Lee Mracek, Letu Ren, lripoche, Maksim, Malte Poll, Marc Redemske, Marc Zych, Matt Mackay, Matt Vollmer, Mauricio G, Mauricio Galindo, Maxim Matyunin, Maxwell Elliott, mohamadk, Nathan (Blaise) Bruer, nathyong, NelsonLi0701, nglevin, Nicholas Junge, Nick Biryulin, Nick Korostelev, Oliver Lee, Orion Hodson, Oscar Garzon, Patrice Duroux, Patrick Balestra, Peter Lobsinger, Philipp Schrader, Rasrack, Red Daly, redwrasse, Robin Tweedie, robincaloudis, Roger Hu, Romain Chossart, Roman Salvador, Sagar Pathare, Saleem Abdulrasool, Sam Shadwell, Sara Adams, Sascha Moecker, Scott Minor, Severin Strobl, Shaygan Hooshyari, Siddhesh Bhupendra Kuakde, Simon Mavi Stewart, something_vague, Son Luong Ngoc, Steve Barrau, Stiopa Koltsov, stoozy, Sushain Cherivirala, Takeo Sawada, Taylor Barrella, tbaing, Ted Kaplan, Ted Logan, Thi Doan, Thulio Ferraz Assis, Timothy Gu, Tom Cnops, Tyler Williams, Ulf Adams, Ulrik Falklof, Uri Baghin, Vertexwahn, Xavier Bonaventura, Xiangquan Xiao, Yannic, Yannic Bonenberger, Yi Cheng, Yuval Kaplan, yuzhy8701.
Notice: Bazel installers contain binaries licensed under the GPLv2 with Classpath exception. Those installers should always be redistributed along with the source code.
Some versions of Bazel contain a bundled version of OpenJDK. The license of the bundled OpenJDK and other open-source components can be displayed by running the command bazel license. The vendor and version information of the bundled OpenJDK can be displayed by running the command bazel info java-runtime. The binaries and source-code of the bundled OpenJDK can be downloaded from our mirror server.
Security: All our binaries are signed with our public key 3D5919B448457EE0.