| 1 |
EGO_SUM is marked as 'deprecated' in go-module.eclass [1, 2]. I |
| 2 |
acknowledge that there are packages where the usage of EGO_SUM is very |
| 3 |
problematic. However, I wonder if there are packages where using |
| 4 |
dependency tarballs is problematic while using EGO_SUM would be not. |
| 5 |
|
| 6 |
Take for example an ebuild containing |
| 7 |
|
| 8 |
SRC_URI=" |
| 9 |
|
| 10 |
https://salsa.debian.org/baz/${PN}/-/archive/v${PV}/${PN}-v${PV}.tar.bz2 |
| 11 |
-> ${P}.tar.bz2 |
| 12 |
https://personal.site/files/gentoo/${P}-vendor.tar.xz |
| 13 |
" |
| 14 |
|
| 15 |
where ${P}-vendor.tar.xz is a Go dependency tarball, containing only a |
| 16 |
few Go modules. Hence EGO_SUM would contain only a few entries in this case. |
| 17 |
|
| 18 |
I see multiple issues of using dependency tarballs in such cases. |
| 19 |
|
| 20 |
First, my trust in a tarball created by someone and hosted somewhere is |
| 21 |
lower than the contents of the artifacts hosted on an official hub. |
| 22 |
Next, if anyone takes the time to review the contents of the dependency |
| 23 |
tarball, it may only benefit Gentoo. On the other hand, if someone |
| 24 |
reviews EGO_SUM artifacts, the whole Go ecosystem will benefit. |
| 25 |
|
| 26 |
I may not know Gentoo's mirror system in detail, but I believe using |
| 27 |
EGO_SUM facilitates cross-package distfile sharing. While dependency |
| 28 |
tarballs will increase the space requirements, and, probably more |
| 29 |
importantly, the load on the mirrors. |
| 30 |
|
| 31 |
Even more problematic are that dependency tarballs require additional |
| 32 |
steps that would not be required when EGO_SUM is used. While those steps |
| 33 |
appear simple, behavioral theory shows that even the tiniest additional |
| 34 |
steps have a huge impact (e.g., online shops loose a relative large |
| 35 |
share of customers if for each an additional checkout step). If we force |
| 36 |
dependency tarballs for Go software, then packaging Go software just |
| 37 |
become a little bit harder. |
| 38 |
|
| 39 |
This leads me to the question why are we actually deprecating EGO_SUM? |
| 40 |
It seems like a nice alternative for Go packaging that we may want to |
| 41 |
keep. But maybe I am missing something? |
| 42 |
|
| 43 |
- Flow |
| 44 |
|
| 45 |
|
| 46 |
1: |
| 47 |
https://github.com/gentoo/gentoo/blob/9fec686abf789fdff36a90c3763d9558203cbf9a/eclass/go-module.eclass#L108 |
| 48 |
2: |
| 49 |
https://github.com/gentoo/gentoo/blob/9fec686abf789fdff36a90c3763d9558203cbf9a/eclass/go-module.eclass#L349-L352 |
Archives