1 |
On 9/18/19 11:04 AM, Alec Warner wrote: |
2 |
> |
3 |
> |
4 |
> On Wed, Sep 18, 2019 at 10:50 AM Michael Orlitzky <mjo@g.o |
5 |
> <mailto:mjo@g.o>> wrote: |
6 |
> |
7 |
> On 9/16/19 10:17 AM, William Hubbs wrote: |
8 |
> > + |
9 |
> > +# @FUNCTION: go-module_pkg_postinst |
10 |
> > +# @DESCRIPTION: |
11 |
> > +# Display a warning about security updates for Go programs. |
12 |
> > +go-module_pkg_postinst() { |
13 |
> > + ewarn "${PN} is written in the Go programming language." |
14 |
> > + ewarn "Since this language is statically linked, security" |
15 |
> > + ewarn "updates will be handled in individual packages and |
16 |
> will be" |
17 |
> > + ewarn "difficult for us to track as a distribution." |
18 |
> > + ewarn "For this reason, please update any go packages asap |
19 |
> when new" |
20 |
> > + ewarn "versions enter the tree or go stable if you are |
21 |
> running the" |
22 |
> > + ewarn "stable tree." |
23 |
> > +} |
24 |
> > + |
25 |
> > +fi |
26 |
> > |
27 |
> |
28 |
> This word salad is 100% misinformation that gets tangled in itself |
29 |
> trying to apologize for what we're about to do: |
30 |
> |
31 |
> * Go is not a "statically linked language." There's gccgo, and as Alec |
32 |
> pointed out, the official compiler has supported dynamic linking for |
33 |
> years now. |
34 |
> |
35 |
> |
36 |
> I'm actually pretty fine with this wording, upstream has said not to |
37 |
> dynamically link in these use cases. |
38 |
> |
39 |
> |
40 |
> |
41 |
> * Updating DOES NOT HELP AT ALL. That's the whole problem. You're |
42 |
> trying to make it sound like we haven't thrown people under a bus, |
43 |
> but saying "for this reason, please update..." is just misleading. |
44 |
> |
45 |
> Here's what it should say: |
46 |
> |
47 |
> WARNING: due to a lack of manpower/interest, Go packages on Gentoo |
48 |
> are statically linked. Contrary to our existing policies and what |
49 |
> the website says, Go packages will never receive any security updates |
50 |
> on Gentoo. Use at your own risk! |
51 |
> |
52 |
> |
53 |
> So if the package *maintainer* bumps each package every time it, or a |
54 |
> dep has a security issue; then updating will work fine. |
55 |
> I'm skeptical go maintainers are volunteering for this though. |
56 |
|
57 |
There's a script here which helps to automate refresh of commit hashes |
58 |
in EGO_VENDOR: |
59 |
|
60 |
https://github.com/hsoft/gentoo-ego-vendor-update |
61 |
|
62 |
Just now I've used it to refresh vendored dependencies in |
63 |
net-misc/drive: |
64 |
|
65 |
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3993b893d4788beaad945bc82df0f4efd91ce697 |
66 |
-- |
67 |
Thanks, |
68 |
Zac |