it’s not a proper remote repository rule implementation - I just realized that there’s a way to tell bazel to allow a build action to talk to the internet from within the sandbox.