[build] add Launchpad fallback for the rules_rs zlib .deb fetch

.bazelrc

@@ -73,6 +73,11 @@ build --incompatible_strict_action_env
 # Creates a harmless empty repo instead of failing on missing API platforms.
 common --repo_env=ANDROID_HOME=
 
+# Add a Launchpad fallback for the pinned zlib .deb that rules_rs fetches from
+# snapshot.ubuntu.com, so an intermittent snapshot.ubuntu.com outage no longer
+# aborts every Rust-touching build. See third_party/bazel/downloader.cfg.
+common --downloader_config=third_party/bazel/downloader.cfg
+
 # Required for prebuilt protoc to be used
 common --@protobuf//bazel/toolchains:prefer_prebuilt_protoc=true
 

third_party/bazel/downloader.cfg

@@ -0,0 +1,19 @@
+# Mirror fallback for Ubuntu "snapshot.ubuntu.com" .deb downloads.
+#
+# While setting up the Linux Rust toolchain, rules_rs fetches a version-pinned
+# zlib1g .deb from snapshot.ubuntu.com. That host intermittently returns
+# 502/503/timeouts, and because the fetch happens during repository setup a
+# failure aborts Bazel analysis outright -- red-lining every Rust-touching job
+# (Rust, Format, Ruby, Python Selenium Manager, ...). Launchpad serves the
+# identical, sha256-matching .deb by filename, so we add it as a fallback.
+#
+# Bazel drops the original URL as soon as any rewrite matches, so the first
+# rule re-emits the snapshot.ubuntu.com URL unchanged (keeping it the primary
+# attempt) and the second appends the Launchpad URL. Bazel tries the resulting
+# candidates in order; the download's sha256 still guards integrity, so a
+# mirror can only ever serve the exact expected bytes.
+#
+# Replacements intentionally omit the scheme: Bazel reuses the original URL's
+# (https) protocol.
+rewrite (snapshot\.ubuntu\.com/.*) $1
+rewrite snapshot\.ubuntu\.com/.*/([^/]+\.deb) launchpad.net/ubuntu/+archive/primary/+files/$1