Every module, one resolve away.
registry.tbzl.dev is a Bzlmod (BCR-layout) registry for the whole tomato-bazel distribution. Put it before the BCR so its entries win; resolve 50+ modules — the rules_* family, fvkit, cred-helper — with an integrity hash on every one.
Add one line to your .bazelrc.
The rules_* family and fvkit resolve from here, hermetically.
Add the registry
common --registry=https://registry.tbzl.dev/ then common --registry=https://bcr.bazel.build/ so the BCR still covers everything else.
Depend on a module
bazel_dep(name = "rules_lean", version = "0.5.3") — Bazel fetches the source tarball and verifies its integrity hash.
Build
bazel build //... resolves the whole graph from the registry; a stale lock surfaces as a checksum mismatch, never a silent drift.
One graph, from source to build.
bazel-registry is one of 6 services in the tbzl.dev source & build layer — open at the edges, yours at the core.