6.2: transitive dependency without sources generates invalid http_file

[jeffalder]

I have a build using rules-jvm-external 6.2:

RULES_JVM_EXTERNAL_TAG = "6.2"
RULES_JVM_EXTERNAL_SHA = "808cb5c30b5f70d12a2a745a29edc46728fd35fa195c1762a596b63ae9cebe05"

# later

    http_archive(
        name = "rules_jvm_external",
        strip_prefix = "rules_jvm_external-%s" % RULES_JVM_EXTERNAL_TAG,
        sha256 = RULES_JVM_EXTERNAL_SHA,
        url = "https://github.com/bazelbuild/rules_jvm_external/releases/download/%s/rules_jvm_external-%s.tar.gz" % (RULES_JVM_EXTERNAL_TAG, RULES_JVM_EXTERNAL_TAG),
    )

I upgraded from 5.3 because I ran into #1114 . However, I'm still getting invalid http_file declarations in contrib-rules-jvm-deps/defs.bzl:

    http_file(
        name = "org_apache_tomcat_annotations_api_jar_sources_6_0_53",
        sha256 = "None",
        urls = [],
        downloaded_file_path = "None",
    )
# ...
    http_file(
        name = "com_google_guava_listenablefuture_jar_sources_9999_0_empty_to_avoid_conflict_with_guava",
        sha256 = "None",
        urls = [],
        downloaded_file_path = "None",
    )
# ...
    http_file(
        name = "io_netty_netty_tcnative_boringssl_static_jar_sources_2_0_61_Final",
        sha256 = "None",
        urls = [],
        downloaded_file_path = "None",
    )

Despite the pin json marking these as skipped:

  "skipped": [
    "com.google.guava:listenablefuture:jar:sources",
    "io.netty:netty-tcnative-boringssl-static:jar:sources",
    "io.netty:netty-tcnative:jar:sources",
    "org.apache.tomcat:annotations-api:jar:sources",
    "ua.net.nlp:morfologik-ukrainian-search:jar:sources"
  ],

I will note that the fix for #1114 did improve the situation - there are now only 3 invalid declarations where there were 5, previously. We are using fetch_sources = True.

This is an issue because migrate_to_bzlmod.py will fail on these errors, making it hard to understand how to migrate.

I don't yet have a repro but I can probably put one together if necessary.

[jeffalder]

It's a version 2 lock file. I did re-pin after upgrading rules-jvm-external.