diff --git a/BUILD b/BUILD
index 2dde1330a56..6fcf4c48f88 100644
--- a/BUILD
+++ b/BUILD
@@ -28,3 +28,49 @@ config_setting(
 load("@io_bazel_rules_go//go:def.bzl", "go_prefix")
 
 go_prefix("istio.io/proxy")
+
+load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar", "pkg_deb")
+
+pkg_tar(
+    name = "istio-bin",
+    files = [
+        "//src/envoy/mixer:envoy",
+        "@com_github_istio_pilot//cmd/pilot-agent:pilot-agent",
+        "@com_github_istio_pilot//docker:prepare_proxy",
+    ],
+    mode = "0755",
+    package_dir = "/usr/local/bin",
+)
+
+pkg_tar(
+    name = "istio-systemd",
+    files = ["tools/deb/istio.service"],
+    mode = "644",
+    package_dir = "/lib/systemd/system",
+)
+
+pkg_tar(
+    name = "debian-data",
+    extension = "tar.gz",
+    deps = [
+        ":istio-bin",
+        ":istio-systemd",
+    ],
+)
+
+pkg_deb(
+    name = "istio-proxy.deb",
+    architecture = "amd64",
+    built_using = "bazel",
+    data = ":debian-data",
+    depends = [
+        "uuid-runtime",  # Envoy/proxy dep
+    ],
+    description_file = "tools/deb/description",
+    homepage = "http://istio.io",
+    maintainer = "The Istio Authors <istio-dev@googlegroups.com>",
+    package = "istio",
+    postinst = "tools/deb/postinst.sh",
+    version = "0.2.1",
+    visibility = ["//visibility:public"],
+)
diff --git a/WORKSPACE b/WORKSPACE
index 8b6fb8dbec5..44a8ad1a346 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -15,25 +15,110 @@
 ################################################################################
 #
 
-load(
-    "//:repositories.bzl",
-    "boringssl_repositories",
-    "protobuf_repositories",
-    "googletest_repositories",
+git_repository(
+        name = "boringssl",
+        commit = "16efcb2dba4690b9940d9b95ef703f1bbd07494d",  # 2017-03-20
+        remote = "https://boringssl.googlesource.com/boringssl",
 )
 
-boringssl_repositories()
+git_repository(
+        name = "protobuf_git",
+        commit = "580b222e225076d0d7a6c65d472398a5f089fb51",  # istio branch
+        remote = "https://github.com/istio/protobuf.git",
+)
 
-protobuf_repositories()
+new_git_repository(
+        name = "googletest_git",
+        build_file = "tools/bazelbuild/BUILD.googletest",
+        commit = "d225acc90bc3a8c420a9bcd1f033033c1ccd7fe0",
+        remote = "https://github.com/google/googletest.git",
+)
 
-googletest_repositories()
+bind(
+        name = "boringssl_crypto",
+        actual = "@boringssl//:crypto",
+)
 
-load(
-    "//src/envoy/mixer:repositories.bzl",
-    "mixer_client_repositories",
+bind(
+        name = "libssl",
+        actual = "@boringssl//:ssl",
+)
+
+bind(
+            name = "protoc",
+            actual = "@protobuf_git//:protoc",
+)
+
+bind(
+            name = "protobuf",
+            actual = "@protobuf_git//:protobuf",
 )
 
-mixer_client_repositories()
+bind(
+            name = "cc_wkt_protos",
+            actual = "@protobuf_git//:cc_wkt_protos",
+)
+
+bind(
+            name = "cc_wkt_protos_genproto",
+            actual = "@protobuf_git//:cc_wkt_protos_genproto",
+)
+
+bind(
+            name = "protobuf_compiler",
+            actual = "@protobuf_git//:protoc_lib",
+)
+
+bind(
+            name = "protobuf_clib",
+            actual = "@protobuf_git//:protoc_lib",
+)
+
+bind(
+            name = "googletest",
+            actual = "@googletest_git//:googletest",
+)
+
+bind(
+            name = "googletest_main",
+            actual = "@googletest_git//:googletest_main",
+)
+
+bind(
+            name = "googletest_prod",
+            actual = "@googletest_git//:googletest_prod",
+)
+
+
+new_git_repository(
+        name = "lightstep_common_git",
+        remote = "https://github.com/lightstep/lightstep-tracer-common.git",
+        commit = "cbbecd671c1ae1f20ae873c5da688c8c14d04ec3",
+        build_file = "tools/bazelbuild/BUILD.lightstep_common",
+)
+
+new_git_repository(
+        name = "lightstep_git",
+        remote = "https://github.com/lightstep/lightstep-tracer-cpp.git",
+        commit = "f1dc8f3dfd529350e053fd21273e627f409ae428", # 0.36
+        build_file = "tools/bazelbuild/BUILD.lightstep",
+)
+
+bind(
+            name = "lightstep",
+            actual = "@lightstep_git//:lightstep_core",
+)
+
+git_repository(
+        name = "mixerclient_git",
+        commit = "6746a3b4e564e0a8a582f84ad1e72ba55dc1aa6d",
+        remote = "https://github.com/istio/mixerclient.git",
+)
+
+bind(
+            name = "mixer_client_lib",
+            actual = "@mixerclient_git//:mixer_client_lib",
+)
 
 load(
     "@mixerclient_git//:repositories.bzl",
@@ -41,12 +126,12 @@ load(
     "mixerapi_repositories",
 )
 
+# googleapis_git preo, with custom build file. Envoy has its own variant.
 googleapis_repositories()
-mixerapi_repositories()
 
-load("//src/envoy:repositories.bzl", "lightstep_repositories")
+## Defines mixerapi_git and the cc_proto, as well as gogoproto_git
+mixerapi_repositories()
 
-lightstep_repositories()
 
 # Bind BoringSSL for Envoy
 bind(
@@ -54,6 +139,7 @@ bind(
     actual = "@boringssl//:ssl",
 )
 
+# Envoy requirements and deps, partially overriden by the rules above (see skip_targets).
 git_repository(
     name = "envoy",
     remote = "https://github.com/lyft/envoy.git",
@@ -69,7 +155,7 @@ api_dependencies()
 # Following go repositories are for building go integration test for mixer filter.
 git_repository(
     name = "io_bazel_rules_go",
-    commit = "87cdda3fc0fd65c63ef0316533be03ea4956f809",  # April 7 2017 (0.4.2)
+    commit = "ec640f0c017a04594695f76bb4531d8769b2c27b",  # Jul 21, 2017
     remote = "https://github.com/bazelbuild/rules_go.git",
 )
 
@@ -85,7 +171,9 @@ git_repository(
 # //src/envoy/mixer/integration_test
 # They are directly copied from its WORKSPACE
 
-load("@io_bazel_rules_go//go:def.bzl", "go_repositories", "new_go_repository")
+# TODO: move integration tests and mixer dep to istio repository.
+
+load("@io_bazel_rules_go//go:def.bzl", "go_repositories", "go_repository")
 go_repositories()
 
 load("@org_pubref_rules_protobuf//protobuf:rules.bzl", "proto_repositories")
@@ -97,326 +185,326 @@ cpp_proto_repositories()
 load("@org_pubref_rules_protobuf//gogo:rules.bzl", "gogo_proto_repositories")
 gogo_proto_repositories()
 
-new_go_repository(
+go_repository(
     name = "com_github_golang_glog",
     commit = "23def4e6c14b4da8ac2ed8007337bc5eb5007998",  # Jan 26, 2016 (no releases)
     importpath = "github.com/golang/glog",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_ghodss_yaml",
     commit = "04f313413ffd65ce25f2541bfd2b2ceec5c0908c",  # Dec 6, 2016 (no releases)
     importpath = "github.com/ghodss/yaml",
 )
 
-new_go_repository(
+go_repository(
     name = "in_gopkg_yaml_v2",
     commit = "14227de293ca979cf205cd88769fe71ed96a97e2",  # Jan 24, 2017 (no releases)
     importpath = "gopkg.in/yaml.v2",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_golang_protobuf",
     commit = "8ee79997227bf9b34611aee7946ae64735e6fd93",  # Nov 16, 2016 (no releases)
     importpath = "github.com/golang/protobuf",
 )
 
-new_go_repository(
+go_repository(
     name = "org_golang_google_grpc",
     commit = "cdee119ee21e61eef7093a41ba148fa83585e143",  # Mar 14, 2017 (v1.2.0)
     importpath = "google.golang.org/grpc",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_spf13_cobra",
     commit = "35136c09d8da66b901337c6e86fd8e88a1a255bd",  # Jan 30, 2017 (no releases)
     importpath = "github.com/spf13/cobra",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_spf13_pflag",
     commit = "9ff6c6923cfffbcd502984b8e0c80539a94968b7",  # Jan 30, 2017 (no releases)
     importpath = "github.com/spf13/pflag",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_cpuguy83_go_md2man",
     commit = "648eed146d3f3beacb64063cd0daae908015eebd",  # Mar 19, 2017 (no releases)
     importpath = "github.com/cpuguy83/go-md2man",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_russross_blackfriday",
     commit = "35eb537633d9950afc8ae7bdf0edb6134584e9fc",  # Mar 19, 2017 (no releases)
     importpath = "github.com/russross/blackfriday",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_shurcooL_sanitized_anchor_name",
     commit = "10ef21a441db47d8b13ebcc5fd2310f636973c77",  # Mar 19, 2017 (no releases)
     importpath = "github.com/shurcooL/sanitized_anchor_name",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_hashicorp_go_multierror",
     commit = "ed905158d87462226a13fe39ddf685ea65f1c11f",  # Dec 16, 2016 (no releases)
     importpath = "github.com/hashicorp/go-multierror",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_hashicorp_errwrap",
     commit = "7554cd9344cec97297fa6649b055a8c98c2a1e55",  # Oct 27, 2014 (no releases)
     importpath = "github.com/hashicorp/errwrap",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_opentracing_opentracing_go",
     commit = "0c3154a3c2ce79d3271985848659870599dfb77c",  # Sep 26, 2016 (v1.0.0)
     importpath = "github.com/opentracing/opentracing-go",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_opentracing_basictracer",
     commit = "1b32af207119a14b1b231d451df3ed04a72efebf",  # Sep 29, 2016 (no releases)
     importpath = "github.com/opentracing/basictracer-go",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_prometheus_client_golang",
     commit = "c5b7fccd204277076155f10851dad72b76a49317",  # Aug 17, 2016 (v0.8.0)
     importpath = "github.com/prometheus/client_golang",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_prometheus_common",
     commit = "dd2f054febf4a6c00f2343686efb775948a8bff4",  # Jan 8, 2017 (no releases)
     importpath = "github.com/prometheus/common",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_matttproud_golang_protobuf_extensions",
     commit = "c12348ce28de40eed0136aa2b644d0ee0650e56c",  # Apr 24, 2016 (v1.0.0)
     importpath = "github.com/matttproud/golang_protobuf_extensions",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_prometheus_procfs",
     commit = "1878d9fbb537119d24b21ca07effd591627cd160",  # Jan 28, 2017 (no releases)
     importpath = "github.com/prometheus/procfs",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_beorn7_perks",
     commit = "4c0e84591b9aa9e6dcfdf3e020114cd81f89d5f9",  # Aug 4, 2016 (no releases)
     importpath = "github.com/beorn7/perks",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_prometheus_client_model",
     commit = "fa8ad6fec33561be4280a8f0514318c79d7f6cb6",  # Feb 12, 2015 (only release too old)
     importpath = "github.com/prometheus/client_model",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_cactus_statsd_client",
     commit = "91c326c3f7bd20f0226d3d1c289dd9f8ce28d33d",  # release 3.1.0, 5/30/2016
     importpath = "github.com/cactus/go-statsd-client",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_redis_client",
     commit = "1ac54a28f5934ea5e08f588647e734aba2383cb8",  # Jan 28, 2017 (no releases)
     importpath = "github.com/mediocregopher/radix.v2",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_mini_redis",
     commit = "e9169f14d501184b6cc94e270e5a93e4bab203d7",  # release 2.0.0, 4/15/2017
     importpath = "github.com/alicebob/miniredis",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_bsm_redeo",
     commit = "1ce09fc76693fb3c1ca9b529c66f38920beb6fb8",  # Aug 17, 2016 (no releases)
     importpath = "github.com/bsm/redeo",
 )
 
-new_go_repository(
+go_repository(
     name = "io_k8s_client_go",
     commit = "243d8a9cb66a51ad8676157f79e71033b4014a2a",  # Dec 11, 2016 (matches istio manager)
     importpath = "k8s.io/client-go",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_ugorji_go",
     commit = "708a42d246822952f38190a8d8c4e6b16a0e600c",  # Mar 12, 2017 (no releases)
     importpath = "github.com/ugorji/go",
 )
 
-new_go_repository(
+go_repository(
     name = "in_gopkg_inf_v0",
     commit = "3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4",  # Sep 11, 2015 (latest commit)
     importpath = "gopkg.in/inf.v0",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_docker_distribution",
     commit = "a25b9ef0c9fe242ac04bb20d3a028442b7d266b6",  # Apr 5, 2017 (v2.6.1)
     importpath = "github.com/docker/distribution",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_davecgh_go_spew",
     commit = "346938d642f2ec3594ed81d874461961cd0faa76",  # Oct 29, 2016 (v1.1.0)
     importpath = "github.com/davecgh/go-spew",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_go_openapi_spec",
     commit = "6aced65f8501fe1217321abf0749d354824ba2ff",  # Aug 8, 2016 (no releases)
     importpath = "github.com/go-openapi/spec",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_google_gofuzz",
     commit = "44d81051d367757e1c7c6a5a86423ece9afcf63c",  # Nov 22, 2016 (no releases)
     importpath = "github.com/google/gofuzz",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_emicklei_go_restful",
     commit = "09691a3b6378b740595c1002f40c34dd5f218a22",  # Dec 12, 2016 (k8s deps)
     importpath = "github.com/emicklei/go-restful",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_go_openapi_jsonpointer",
     commit = "46af16f9f7b149af66e5d1bd010e3574dc06de98",  # Jul 4, 2016 (no releases)
     importpath = "github.com/go-openapi/jsonpointer",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_go_openapi_jsonreference",
     commit = "13c6e3589ad90f49bd3e3bbe2c2cb3d7a4142272",  # Jul 4, 2016 (no releases)
     importpath = "github.com/go-openapi/jsonreference",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_go_openapi_swag",
     commit = "1d0bd113de87027671077d3c71eb3ac5d7dbba72",  # Jul 4, 2016 (no releases)
     importpath = "github.com/go-openapi/swag",
 )
 
-new_go_repository(
+go_repository(
     name = "org_golang_x_oauth2",
     commit = "3c3a985cb79f52a3190fbc056984415ca6763d01",  # Aug 26, 2016 (no releases)
     importpath = "golang.org/x/oauth2",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_juju_ratelimit",
     commit = "acf38b000a03e4ab89e40f20f1e548f4e6ac7f72",  # Mar 13, 2017 (no releases)
     importpath = "github.com/juju/ratelimit",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_opencontainers_go_digest",
     commit = "aa2ec055abd10d26d539eb630a92241b781ce4bc",  # Jan 31, 2017 (v1.0.0-rc0)
     importpath = "github.com/opencontainers/go-digest",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_blang_semver",
     commit = "b38d23b8782a487059e8fc8773e9a5b228a77cb6",  # Jan 30, 2017 (v3.5.0)
     importpath = "github.com/blang/semver",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_coreos_go_oidc",
     commit = "be73733bb8cc830d0205609b95d125215f8e9c70",  # Mar 7, 2017 (no releases)
     importpath = "github.com/coreos/go-oidc",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_mailru_easyjson",
     commit = "2af9a745a611440bab0528e5ac19b2805a1c50eb",  # Mar 28, 2017 (no releases)
     importpath = "github.com/mailru/easyjson",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_PuerkitoBio_purell",
     commit = "0bcb03f4b4d0a9428594752bd2a3b9aa0a9d4bd4",  # Nov 14, 2016 (v1.1.0)
     importpath = "github.com/PuerkitoBio/purell",
 )
 
-new_go_repository(
+go_repository(
     name = "org_golang_x_text",
     build_file_name = "BUILD.bazel",
     commit = "f4b4367115ec2de254587813edaa901bc1c723a8",  # Mar 31, 2017 (no releases)
     importpath = "golang.org/x/text",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_PuerkitoBio_urlesc",
     commit = "bbf7a2afc14f93e1e0a5c06df524fbd75e5031e5",  # Mar 24, 2017 (no releases)
     importpath = "github.com/PuerkitoBio/urlesc",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_pborman_uuid",
     commit = "a97ce2ca70fa5a848076093f05e639a89ca34d06",  # Feb 9, 2016 (v1.0)
     importpath = "github.com/pborman/uuid",
 )
 
-new_go_repository(
+go_repository(
     name = "com_google_cloud_go",
     commit = "2e6a95edb1071d750f6d7db777bf66cd2997af6c",  # Mar 9, 2017 (v0.7.0)
     importpath = "cloud.google.com/go",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_coreos_pkg",
     commit = "1c941d73110817a80b9fa6e14d5d2b00d977ce2a",  # Feb 6, 2017 (fix for build dir bazel issue)
     importpath = "github.com/coreos/pkg",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_jonboulle_clockwork",
     commit = "2eee05ed794112d45db504eb05aa693efd2b8b09",  # Jul 6, 2016 (v0.1.0)
     importpath = "github.com/jonboulle/clockwork",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_imdario_mergo",
     commit = "3e95a51e0639b4cf372f2ccf74c86749d747fbdc",  # Feb 16, 2016 (v0.2.2)
     importpath = "github.com/imdario/mergo",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_howeyc_gopass",
     commit = "bf9dde6d0d2c004a008c27aaee91170c786f6db8",  # Jan 9, 2017 (no releases)
     importpath = "github.com/howeyc/gopass",
 )
 
-new_go_repository(
+go_repository(
     name = "org_golang_x_crypto",
     commit = "cbc3d0884eac986df6e78a039b8792e869bff863",  # Apr 8, 2017 (no releases)
     importpath = "golang.org/x/crypto",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_googleapis_gax_go",
     commit = "9af46dd5a1713e8b5cd71106287eba3cefdde50b", # Mar 20, 2017 (no releases)
     importpath = "github.com/googleapis/gax-go",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_hashicorp_golang_lru",
     commit = "0a025b7e63adc15a622f29b0b2c4c3848243bbf6", # Aug 13, 2016 (no releases)
     importpath = "github.com/hashicorp/golang-lru",
 )
 
-new_go_repository(
+go_repository(
     name = "com_github_grpcecosystem_opentracing",
     commit = "c94552f01d20ad74ec45a8cd967833a9d0b106cf", #
     importpath = "github.com/grpc-ecosystem/grpc-opentracing",
@@ -434,5 +522,48 @@ git_repository(
 
 ############################################################
 
+# com_github_istio_mixer
+# com_github_istio_api - with custom build rule for gogo
+# another com_github_googleapis_googleapis (different from the one in mixer_client or envoy)
 load("//src/envoy/mixer/integration_test:repositories.bzl", "go_mixer_repositories")
 go_mixer_repositories()
+
+###########################################
+# Following dependencies are needed for building pilot agent, which starts envoy
+git_repository(
+    name = "com_github_istio_pilot",
+    remote = "https://github.com/istio/pilot.git",
+    commit = "0de07dd6dc3126bd5485391bdf70f051ef625bfe", # Aug 3
+)
+new_git_repository(
+    name = "io_istio_api",
+    build_file_content = """
+load("@io_bazel_rules_go//go:def.bzl", "go_prefix")
+load("@io_bazel_rules_go//proto:go_proto_library.bzl", "go_proto_library")
+package(default_visibility = ["//visibility:public"])
+go_prefix("istio.io/api/proxy/v1/config")
+go_proto_library(
+    name = "go_default_library",
+    srcs = glob(["proxy/v1/config/*.proto"]),
+    deps = [
+        "@com_github_golang_protobuf//ptypes/any:go_default_library",
+        "@com_github_golang_protobuf//ptypes/duration:go_default_library",
+        "@com_github_golang_protobuf//ptypes/wrappers:go_default_library",
+    ],
+)
+    """,
+    commit = "af5afdafc95826a5716facc2ea025f1e27bb8225",  # June 8, 2017
+    remote = "https://github.com/istio/api.git",
+)
+
+go_repository(
+    name = "org_golang_x_time",
+    commit = "8be79e1e0910c292df4e79c241bb7e8f7e725959",
+    importpath = "golang.org/x/time",
+)
+go_repository(
+    name = "com_github_howeyc_fsnotify",
+    commit = "f0c08ee9c60704c1879025f2ae0ff3e000082c13",
+    importpath = "github.com/howeyc/fsnotify",
+)
+
diff --git a/repositories.bzl b/repositories.bzl
deleted file mode 100644
index 1468bd44ade..00000000000
--- a/repositories.bzl
+++ /dev/null
@@ -1,176 +0,0 @@
-# Copyright 2016 Istio Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
-#
-def boringssl_repositories(bind=True):
-    native.git_repository(
-        name = "boringssl",
-        commit = "16efcb2dba4690b9940d9b95ef703f1bbd07494d",  # 2017-03-20
-        remote = "https://boringssl.googlesource.com/boringssl",
-    )
-
-    if bind:
-        native.bind(
-            name = "boringssl_crypto",
-            actual = "@boringssl//:crypto",
-        )
-
-        native.bind(
-            name = "libssl",
-            actual = "@boringssl//:ssl",
-        )
-
-
-def protobuf_repositories(bind=True):
-    native.git_repository(
-        name = "protobuf_git",
-        commit = "580b222e225076d0d7a6c65d472398a5f089fb51",  # istio branch
-        remote = "https://github.com/istio/protobuf.git",
-    )
-
-    if bind:
-        native.bind(
-            name = "protoc",
-            actual = "@protobuf_git//:protoc",
-        )
-
-        native.bind(
-            name = "protobuf",
-            actual = "@protobuf_git//:protobuf",
-        )
-
-        native.bind(
-            name = "cc_wkt_protos",
-            actual = "@protobuf_git//:cc_wkt_protos",
-        )
-
-        native.bind(
-            name = "cc_wkt_protos_genproto",
-            actual = "@protobuf_git//:cc_wkt_protos_genproto",
-        )
-
-        native.bind(
-            name = "protobuf_compiler",
-            actual = "@protobuf_git//:protoc_lib",
-        )
-
-        native.bind(
-            name = "protobuf_clib",
-            actual = "@protobuf_git//:protoc_lib",
-        )
-
-
-def googletest_repositories(bind=True):
-    BUILD = """
-# Copyright 2016 Google Inc. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
-#
-
-cc_library(
-    name = "googletest",
-    srcs = [
-        "googletest/src/gtest-all.cc",
-        "googlemock/src/gmock-all.cc",
-    ],
-    hdrs = glob([
-        "googletest/include/**/*.h",
-        "googlemock/include/**/*.h",
-        "googletest/src/*.cc",
-        "googletest/src/*.h",
-        "googlemock/src/*.cc",
-    ]),
-    includes = [
-        "googlemock",
-        "googletest",
-        "googletest/include",
-        "googlemock/include",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-cc_library(
-    name = "googletest_main",
-    srcs = ["googlemock/src/gmock_main.cc"],
-    visibility = ["//visibility:public"],
-    linkopts = [
-        "-lpthread",
-    ],
-    deps = [":googletest"],
-)
-
-cc_library(
-    name = "googletest_prod",
-    hdrs = [
-        "googletest/include/gtest/gtest_prod.h",
-    ],
-    includes = [
-        "googletest/include",
-    ],
-    visibility = ["//visibility:public"],
-)
-"""
-    native.new_git_repository(
-        name = "googletest_git",
-        build_file_content = BUILD,
-        commit = "d225acc90bc3a8c420a9bcd1f033033c1ccd7fe0",
-        remote = "https://github.com/google/googletest.git",
-    )
-
-    if bind:
-        native.bind(
-            name = "googletest",
-            actual = "@googletest_git//:googletest",
-        )
-
-        native.bind(
-            name = "googletest_main",
-            actual = "@googletest_git//:googletest_main",
-        )
-
-        native.bind(
-            name = "googletest_prod",
-            actual = "@googletest_git//:googletest_prod",
-        )
-
-def transcoding_repositories(bind=True):
-    native.git_repository(
-        name = "httpjson_transcoding",
-        commit = "3a90dfd2e7300e8dd60b74f0f4085f2a0bfc499e",
-        remote = "https://github.com/grpc-ecosystem/grpc-httpjson-transcoding.git",
-    )
-
-    if bind:
-        native.bind(
-            name = "transcoding",
-            actual = "@httpjson_transcoding//src:transcoding",
-        )
-
-        native.bind(
-            name = "path_matcher",
-            actual = "@httpjson_transcoding//src:path_matcher",
-        )
diff --git a/src/envoy/BUILD b/src/envoy/BUILD
deleted file mode 100644
index 1c32a9281ef..00000000000
--- a/src/envoy/BUILD
+++ /dev/null
@@ -1,16 +0,0 @@
-# Copyright 2017 Istio Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
-#
diff --git a/src/envoy/mixer/BUILD b/src/envoy/mixer/BUILD
index ae221797277..6898c7a7810 100644
--- a/src/envoy/mixer/BUILD
+++ b/src/envoy/mixer/BUILD
@@ -33,9 +33,9 @@ cc_library(
         "config.h",
         "grpc_transport.cc",
         "grpc_transport.h",
+        "http_filter.cc",
         "mixer_control.cc",
         "mixer_control.h",
-        "http_filter.cc",
         "tcp_filter.cc",
         "thread_dispatcher.cc",
         "thread_dispatcher.h",
@@ -57,7 +57,7 @@ cc_binary(
         "-luuid",
     ],
     linkstatic = 1,
-    visibility = [":__subpackages__"],
+    visibility = ["//visibility:public"],
     deps = [
         ":filter_lib",
         "@envoy//source/exe:envoy_main_entry_lib",
@@ -88,4 +88,3 @@ pkg_tar(
     package_dir = "/etc/opt/proxy",
     tags = ["manual"],
 )
-
diff --git a/src/envoy/mixer/repositories.bzl b/src/envoy/mixer/repositories.bzl
deleted file mode 100644
index 59a9a1476e8..00000000000
--- a/src/envoy/mixer/repositories.bzl
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright 2016 Istio Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
-#
-
-MIXER_CLIENT = "6746a3b4e564e0a8a582f84ad1e72ba55dc1aa6d"
-
-def mixer_client_repositories(bind=True):
-    native.git_repository(
-        name = "mixerclient_git",
-        commit = MIXER_CLIENT,
-        remote = "https://github.com/istio/mixerclient.git",
-    )
-
-    if bind:
-        native.bind(
-            name = "mixer_client_lib",
-            actual = "@mixerclient_git//:mixer_client_lib",
-        )
diff --git a/src/envoy/repositories.bzl b/src/envoy/repositories.bzl
deleted file mode 100644
index 955fcbf4422..00000000000
--- a/src/envoy/repositories.bzl
+++ /dev/null
@@ -1,104 +0,0 @@
-# Copyright 2016 Istio Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-################################################################################
-#
-def lightstep_repositories(bind=True):
-    BUILD = """
-load("@protobuf_git//:protobuf.bzl", "cc_proto_library")
-
-cc_library(
-    name = "lightstep_core",
-    srcs = [
-        "src/c++11/impl.cc",
-        "src/c++11/span.cc",
-        "src/c++11/tracer.cc",
-        "src/c++11/util.cc",
-    ],
-    hdrs = [
-        "src/c++11/lightstep/impl.h",
-        "src/c++11/lightstep/options.h",
-        "src/c++11/lightstep/propagation.h",
-        "src/c++11/lightstep/carrier.h",
-        "src/c++11/lightstep/span.h",
-        "src/c++11/lightstep/tracer.h",
-        "src/c++11/lightstep/util.h",
-        "src/c++11/lightstep/value.h",
-        "src/c++11/mapbox_variant/recursive_wrapper.hpp",
-        "src/c++11/mapbox_variant/variant.hpp",
-    ],
-    copts = [
-        "-DPACKAGE_VERSION='\\"0.36\\"'",
-        "-Iexternal/lightstep_git/src/c++11/lightstep",
-        "-Iexternal/lightstep_git/src/c++11/mapbox_variant",
-    ],
-    includes = [
-        "src/c++11",
-    ],
-    visibility = ["//visibility:public"],
-    deps = [
-        "@lightstep_common_git//:collector_proto",
-        "@lightstep_common_git//:lightstep_carrier_proto",
-        "//external:protobuf",
-    ],
-)"""
-
-    COMMON_BUILD = """
-load("@protobuf_git//:protobuf.bzl", "cc_proto_library")
-
-cc_proto_library(
-    name = "collector_proto",
-    srcs = ["collector.proto"],
-    include = ".",
-    deps = [
-        "//external:cc_wkt_protos",
-    ],
-    protoc = "//external:protoc",
-    default_runtime = "//external:protobuf",
-    visibility = ["//visibility:public"],
-)
-
-cc_proto_library(
-    name = "lightstep_carrier_proto",
-    srcs = ["lightstep_carrier.proto"],
-    include = ".",
-    deps = [
-        "//external:cc_wkt_protos",
-    ],
-    protoc = "//external:protoc",
-    default_runtime = "//external:protobuf",
-    visibility = ["//visibility:public"],
-)
-"""
-
-    native.new_git_repository(
-        name = "lightstep_common_git",
-        remote = "https://github.com/lightstep/lightstep-tracer-common.git",
-        commit = "cbbecd671c1ae1f20ae873c5da688c8c14d04ec3",
-        build_file_content = COMMON_BUILD,
-    )
-
-    native.new_git_repository(
-        name = "lightstep_git",
-        remote = "https://github.com/lightstep/lightstep-tracer-cpp.git",
-        commit = "f1dc8f3dfd529350e053fd21273e627f409ae428", # 0.36
-        build_file_content = BUILD,
-    )
-
-    if bind:
-        native.bind(
-            name = "lightstep",
-            actual = "@lightstep_git//:lightstep_core",
-        )
-
diff --git a/tools/bazel.rc b/tools/bazel.rc
index 385e8437593..9771a65856c 100644
--- a/tools/bazel.rc
+++ b/tools/bazel.rc
@@ -53,4 +53,5 @@ build:release -c opt
 build --cxxopt -Wnon-virtual-dtor
 build --cxxopt -Wformat
 build --cxxopt -Wformat-security
-
+# Hack to let envoy compile on trusty (regex won't work, but we don't use them in istio)
+build --copt "-D_GLIBCXX_REGEX_STATE_LIMIT=1"
diff --git a/tools/bazelbuild/BUILD.googletest b/tools/bazelbuild/BUILD.googletest
new file mode 100644
index 00000000000..06b53094045
--- /dev/null
+++ b/tools/bazelbuild/BUILD.googletest
@@ -0,0 +1,59 @@
+# Copyright 2016 Google Inc. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+#
+
+cc_library(
+    name = "googletest",
+    srcs = [
+        "googletest/src/gtest-all.cc",
+        "googlemock/src/gmock-all.cc",
+    ],
+    hdrs = glob([
+        "googletest/include/**/*.h",
+        "googlemock/include/**/*.h",
+        "googletest/src/*.cc",
+        "googletest/src/*.h",
+        "googlemock/src/*.cc",
+    ]),
+    includes = [
+        "googlemock",
+        "googletest",
+        "googletest/include",
+        "googlemock/include",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+cc_library(
+    name = "googletest_main",
+    srcs = ["googlemock/src/gmock_main.cc"],
+    visibility = ["//visibility:public"],
+    linkopts = [
+        "-lpthread",
+    ],
+    deps = [":googletest"],
+)
+
+cc_library(
+    name = "googletest_prod",
+    hdrs = [
+        "googletest/include/gtest/gtest_prod.h",
+    ],
+    includes = [
+        "googletest/include",
+    ],
+    visibility = ["//visibility:public"],
+)
\ No newline at end of file
diff --git a/tools/bazelbuild/BUILD.lightstep b/tools/bazelbuild/BUILD.lightstep
new file mode 100644
index 00000000000..51090e8a477
--- /dev/null
+++ b/tools/bazelbuild/BUILD.lightstep
@@ -0,0 +1,37 @@
+load("@protobuf_git//:protobuf.bzl", "cc_proto_library")
+
+cc_library(
+    name = "lightstep_core",
+    srcs = [
+        "src/c++11/impl.cc",
+        "src/c++11/span.cc",
+        "src/c++11/tracer.cc",
+        "src/c++11/util.cc",
+    ],
+    hdrs = [
+        "src/c++11/lightstep/impl.h",
+        "src/c++11/lightstep/options.h",
+        "src/c++11/lightstep/propagation.h",
+        "src/c++11/lightstep/carrier.h",
+        "src/c++11/lightstep/span.h",
+        "src/c++11/lightstep/tracer.h",
+        "src/c++11/lightstep/util.h",
+        "src/c++11/lightstep/value.h",
+        "src/c++11/mapbox_variant/recursive_wrapper.hpp",
+        "src/c++11/mapbox_variant/variant.hpp",
+    ],
+    copts = [
+        "-DPACKAGE_VERSION='\"0.36\"'",
+        "-Iexternal/lightstep_git/src/c++11/lightstep",
+        "-Iexternal/lightstep_git/src/c++11/mapbox_variant",
+    ],
+    includes = [
+        "src/c++11",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "@lightstep_common_git//:collector_proto",
+        "@lightstep_common_git//:lightstep_carrier_proto",
+        "//external:protobuf",
+    ],
+)
\ No newline at end of file
diff --git a/tools/bazelbuild/BUILD.lightstep_common b/tools/bazelbuild/BUILD.lightstep_common
new file mode 100644
index 00000000000..dc49ab74b1d
--- /dev/null
+++ b/tools/bazelbuild/BUILD.lightstep_common
@@ -0,0 +1,25 @@
+load("@protobuf_git//:protobuf.bzl", "cc_proto_library")
+
+cc_proto_library(
+    name = "collector_proto",
+    srcs = ["collector.proto"],
+    include = ".",
+    deps = [
+        "//external:cc_wkt_protos",
+    ],
+    protoc = "//external:protoc",
+    default_runtime = "//external:protobuf",
+    visibility = ["//visibility:public"],
+)
+
+cc_proto_library(
+    name = "lightstep_carrier_proto",
+    srcs = ["lightstep_carrier.proto"],
+    include = ".",
+    deps = [
+        "//external:cc_wkt_protos",
+    ],
+    protoc = "//external:protoc",
+    default_runtime = "//external:protobuf",
+    visibility = ["//visibility:public"],
+)
\ No newline at end of file
diff --git a/tools/deb/description b/tools/deb/description
new file mode 100644
index 00000000000..f639cf361d2
--- /dev/null
+++ b/tools/deb/description
@@ -0,0 +1 @@
+TODO: write a description
\ No newline at end of file
diff --git a/tools/deb/envoy.json b/tools/deb/envoy.json
new file mode 100644
index 00000000000..e257d7a5f5a
--- /dev/null
+++ b/tools/deb/envoy.json
@@ -0,0 +1,65 @@
+{
+  "listeners": [],
+  "lds": {
+    "cluster": "lds",
+    "refresh_delay_ms": 1000
+  },
+  "admin": {
+    "access_log_path": "/dev/stdout",
+    "address": "tcp://0.0.0.0:15000"
+  },
+  "cluster_manager": {
+    "clusters": [
+      {
+        "name": "rds",
+        "connect_timeout_ms": 1000,
+        "type": "strict_dns",
+        "lb_type": "round_robin",
+        "hosts": [
+          {
+            "url": "tcp://istio-pilot:8080"
+          }
+        ]
+      },
+      {
+        "name": "lds",
+        "connect_timeout_ms": 1000,
+        "type": "strict_dns",
+        "lb_type": "round_robin",
+        "hosts": [
+          {
+            "url": "tcp://istio-pilot:8080"
+          }
+        ]
+      }
+    ],
+    "sds": {
+      "cluster": {
+        "name": "sds",
+        "connect_timeout_ms": 1000,
+        "type": "strict_dns",
+        "lb_type": "round_robin",
+        "hosts": [
+          {
+            "url": "tcp://istio-pilot:8080"
+          }
+        ]
+      },
+      "refresh_delay_ms": 1000
+    },
+    "cds": {
+      "cluster": {
+        "name": "cds",
+        "connect_timeout_ms": 1000,
+        "type": "strict_dns",
+        "lb_type": "round_robin",
+        "hosts": [
+          {
+            "url": "tcp://istio-pilot:8080"
+          }
+        ]
+      },
+      "refresh_delay_ms": 1000
+    }
+  }
+}
diff --git a/tools/deb/istio-10.conf b/tools/deb/istio-10.conf
new file mode 100644
index 00000000000..0c37379970a
--- /dev/null
+++ b/tools/deb/istio-10.conf
@@ -0,0 +1,4 @@
+[Service]
+Environment="ISTIO_EXTRA_ARGS="
+ExecStart=
+ExecStart=/opt/istio/bin/pilot $ISTIO_EXTRA_ARGS
diff --git a/tools/deb/istio.service b/tools/deb/istio.service
new file mode 100644
index 00000000000..f2723a84de6
--- /dev/null
+++ b/tools/deb/istio.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=istio-sidecar: The Istio sidecar
+Documentation=http://istio.io/
+
+[Service]
+ExecStart=/usr/local/bin/pilot-agent proxy
+Restart=always
+StartLimitInterval=0
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
diff --git a/tools/deb/postinst.sh b/tools/deb/postinst.sh
new file mode 100755
index 00000000000..cc9148eed23
--- /dev/null
+++ b/tools/deb/postinst.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -e
+
+action="$1"
+oldversion="$2"
+
+umask 022
+
+if ! getent passwd istio >/dev/null; then
+    addgroup --system istio
+    adduser --system --group --home /var/lib/istio istio
+fi
+
+if [ ! -e /etc/istio ]; then
+   # Backward compat.
+   ln -s /var/lib/istio /etc/istio
+fi
+
+mkdir -p /var/lib/istio/envoy
+mkdir -p /var/lib/istio/config
+chown istio.istio /var/lib/istio/envoy /var/lib/istio/config
+
diff --git a/tools/deb/start-istio.sh b/tools/deb/start-istio.sh
new file mode 100644
index 00000000000..41ea0ae2455
--- /dev/null
+++ b/tools/deb/start-istio.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+exec /usr/local/bin/pilot-agent proxy > /var/lib/istio/istio.log 2>&1