Bazel sandboxes the build rules. If you need to discover dependencies, you can flip a switch and have all the missing dependencies be hard errors. Once you flip

Bazel sandboxes the build rules. If you need to discover dependencies, you can flip a switch and have all the missing dependencies be hard errors. Once you flip the switch and fix the errors, you leave it flipped on and you have confidence that you are not missing any dependencies. The entire C toolchain is normally an input to a Bazel build. You make a package (.tar.gz) containing the toolchain, put it somewhere accessible (http), and check a SHA-256 hash of the toolchain into your WORKSPACE file. When it changes, everything built with it is rebuilt. Getting complicated cross-platform toolchains working on Bazel is going to be hard, sure. But knowing whether you have hidden dependencies is not hard, because of the sandboxing.