1 |
On 9/16/19 10:17 AM, William Hubbs wrote: |
2 |
> + |
3 |
> +# @FUNCTION: go-module_pkg_postinst |
4 |
> +# @DESCRIPTION: |
5 |
> +# Display a warning about security updates for Go programs. |
6 |
> +go-module_pkg_postinst() { |
7 |
> + ewarn "${PN} is written in the Go programming language." |
8 |
> + ewarn "Since this language is statically linked, security" |
9 |
> + ewarn "updates will be handled in individual packages and will be" |
10 |
> + ewarn "difficult for us to track as a distribution." |
11 |
> + ewarn "For this reason, please update any go packages asap when new" |
12 |
> + ewarn "versions enter the tree or go stable if you are running the" |
13 |
> + ewarn "stable tree." |
14 |
> +} |
15 |
> + |
16 |
> +fi |
17 |
> |
18 |
|
19 |
This word salad is 100% misinformation that gets tangled in itself |
20 |
trying to apologize for what we're about to do: |
21 |
|
22 |
* Go is not a "statically linked language." There's gccgo, and as Alec |
23 |
pointed out, the official compiler has supported dynamic linking for |
24 |
years now. |
25 |
|
26 |
* Updating DOES NOT HELP AT ALL. That's the whole problem. You're |
27 |
trying to make it sound like we haven't thrown people under a bus, |
28 |
but saying "for this reason, please update..." is just misleading. |
29 |
|
30 |
Here's what it should say: |
31 |
|
32 |
WARNING: due to a lack of manpower/interest, Go packages on Gentoo |
33 |
are statically linked. Contrary to our existing policies and what |
34 |
the website says, Go packages will never receive any security updates |
35 |
on Gentoo. Use at your own risk! |