From 45884ba6393c05db1f3b16b96a65728b98b9229c Mon Sep 17 00:00:00 2001
From: Kevin Krakauer <krakauer@google.com>
Date: Wed, 5 May 2021 11:12:55 -0700
Subject: Internal change

PiperOrigin-RevId: 372166050
---
 tools/deps.bzl         | 9 +++++++--
 tools/go_marshal/BUILD | 5 ++---
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/tools/deps.bzl b/tools/deps.bzl
index ed1135a9e..91442617c 100644
--- a/tools/deps.bzl
+++ b/tools/deps.bzl
@@ -94,8 +94,13 @@ def _deps_test_impl(ctx):
     )
     return []
 
-# Checks that library and its deps only depends on gVisor and an allowlist of
-# other dependencies.
+# Checks that targets only depend on an allowlist of other targets. Targets can
+# be specified directly, or prefixes can be used to allow entire packages or
+# directory trees.
+#
+# This recursively checks the "deps" attribute of each target, dependencies
+# expressed other ways are not checked. For example, protobuf targets pull in
+# protobuf code, but aren't analyzed by deps_test.
 deps_test = rule(
     implementation = _deps_test_impl,
     attrs = {
diff --git a/tools/go_marshal/BUILD b/tools/go_marshal/BUILD
index f79defea7..85a1adf66 100644
--- a/tools/go_marshal/BUILD
+++ b/tools/go_marshal/BUILD
@@ -5,9 +5,7 @@ licenses(["notice"])
 go_binary(
     name = "go_marshal",
     srcs = ["main.go"],
-    visibility = [
-        "//:sandbox",
-    ],
+    visibility = ["//:sandbox"],
     deps = [
         "//tools/go_marshal/gomarshal",
     ],
@@ -16,6 +14,7 @@ go_binary(
 config_setting(
     name = "marshal_config_verbose",
     values = {"define": "gomarshal=verbose"},
+    visibility = ["//:sandbox"],
 )
 
 bzl_library(
-- 
cgit v1.2.3