Re: [gentoo-project] Call for agenda items - Council meeting on 2022-02-13

[Anna Vyalkova]

On 2022-02-12 22:58, Michał Górny wrote:
> On Fri, 2022-02-11 at 00:53 -0600, William Hubbs wrote:
> > On Thu, Feb 10, 2022 at 07:27:15PM +0100, Andreas K. Huettel wrote:
> > > > I just realized a down side to this approach, but I don't know how
> > > > important that down side is.
> > > >
> > > > As the example shows, if a package has a vendor directory we would trust
> > > > it so nothing would need to be done. If we have to run "go mod
> > > > download", however, this populates the dependency cache from the
> > > > internet. This means that a package that requires this could not be
> > > > built if the building machine is not on the net.
> > >
> > > (hands William a golden potato)
> > >
> > > Congratulations, you've just rediscovered why we do the things the way
> > > we're doing them now...
> >
> > And, you dropped my question at the end of this message,
> > so let me bring it back.
> >
> > > I don't know how important this is, because it is true for any go
> > > package without a vendor directory no matter how you build it.
> >
> > This could also apply to a rust or nodejs package.
> >
> > The build process for all of these languages has the potential to reach
> > out to the net to download dependencies.
> >
> > Iam talking mostly about Go, because that's what I work with, but I know
> > it isn't the only language that does this.
> >
> > In the list of solutions Robin put on this thread, I prefer the third
> > group. That would involve the fetch_extra phase which would for go
> > basically be "cd ${S} || die; go mod download || die" along with an
> > environment variable that would put modules under distfiles.
> >
> > If you have an idea for a better solution, I'm willing to hear it.
> >
>
> The "better solution" has already been provided -- repackage it.
> All of your solutions solve only part of the problem, and usually
> introduce more problems.  The current distfile fetching solution works
> well for over 99% of the Gentoo packages today (this is not "the 99%"
> but actual numbers, more below).  The problem is with Go, and Go needs
> to be fixed (or worked around), and don't extend it to "theoretically
> Rust or NodeJS" because they're nowhere close to how badly designed Go
> ecosystem is.

In addition to repackaging maintainers should ask upstream to include
vendor directory in their release tarballs or VCS. It's as simple as
running "go mod vendor". I think upstream will be scared enough with
current ebuilds and manifests to do it :)

Example of a project using vendor directory:
https://github.com/42wim/matterbridge

Its manifest is only one line and ebuild has no EGO_SUM and no issues
with SRC_URI.
https://git.sr.ht/~dblsaiko/ebuilds/tree/master/item/net-im/matterbridge/Manifest