def safe_short_path(file_):
    """Like `File.short_path` but safe for use with files from external repositories.
    """
    # Note: "F" is "File", "FO": is "File.owner".  (Lifted from genpkg.bzl.)
    # | File type | Repo     | `F.path`                                                 | `F.root.path`                | `F.short_path`          | `FO.workspace_name` | `FO.workspace_root` |
    # |-----------|----------|----------------------------------------------------------|------------------------------|-------------------------|---------------------|---------------------|
    # | Source    | Local    | `dirA/fooA`                                              |                              | `dirA/fooA`             |                     |                     |
    # | Generated | Local    | `bazel-out/k8-fastbuild/bin/dirA/gen.out`                | `bazel-out/k8-fastbuild/bin` | `dirA/gen.out`          |                     |                     |
    # | Source    | External | `external/repo2/dirA/fooA`                               |                              | `../repo2/dirA/fooA`    | `repo2`             | `external/repo2`    |
    # | Generated | External | `bazel-out/k8-fastbuild/bin/external/repo2/dirA/gen.out` | `bazel-out/k8-fastbuild/bin` | `../repo2/dirA/gen.out` | `repo2`             | `external/repo2`    |

    # Beginning with `file_.path`, remove optional `F.root.path`.
    working_path = file_.path
    if not file_.is_source:
        working_path = working_path[len(file_.root.path)+1:]
    return working_path