Comment by ASinclair
6 days ago
It’s largely used for syncing external open source projects with the monorepo. Policy is to require source code imports over built artifacts. Though you can get exceptions.
Some projects are also developed in the monorepo and exported via Copybara.
My team also uses it to version Starlark rule sets internally.
Source code imports versus artifacts really neither here nor there. Go is source code imports too.
The key part for Copybara is that Google will make changes to the OSS projects from within the internal repo and everyone else will make changes to the OSS projects.
I suppose it mitigates the potential risk of libraries being poisoned?
Well kind of, or you just end up copying the poisoned version directly into your repo rather than having it as a dependency. Same outcome.
I suppose if you're running some security analysis on code in your own repo, the fact that you've copied the code in means that it'll run on your third party dependencies too, since they no longer appear to be third party.
It's mostly to track licensing, at least initially. The supply chain angle is a happy coincidence.