1 |
On Mon, Sep 09, 2019 at 09:00:31PM +0200, Michał Górny wrote: |
2 |
> On Mon, 2019-09-09 at 13:41 -0500, William Hubbs wrote: |
3 |
> > On Mon, Sep 09, 2019 at 11:19:02AM -0700, Zac Medico wrote: |
4 |
> > > On 9/9/19 10:34 AM, William Hubbs wrote: |
5 |
> > > |
6 |
> > > > There is another option I want to try which is adding "go mod vendor" to |
7 |
> > > > src_unpack for go packages. |
8 |
> > > |
9 |
> > > If you do that then it will violate FEATURES=network-sandbox (default) |
10 |
> > > unless you also do PROPERTIES+=" live". |
11 |
> > > |
12 |
> > > We could add a separate PROPERTIES value for this, I've suggested it |
13 |
> > > before but both Michał Górny and Ulrich Mueller were against it: |
14 |
> > > |
15 |
> > > https://archives.gentoo.org/gentoo-portage-dev/message/6d696661b29b6e2b8c82061e89e4718f |
16 |
> > |
17 |
> > If checksum verification is the concern, Go 1.13 also has this: |
18 |
> > |
19 |
> > https://blog.golang.org/module-mirror-launch |
20 |
> > |
21 |
> > Thoughts? Does this make the case for a property for these kinds of |
22 |
> > ebuilds? |
23 |
> > |
24 |
> |
25 |
> Checksum verification is only one of the problems. The other one is |
26 |
> that it won't work if you don't have permanent Internet access or are |
27 |
> using strong firewalling. |
28 |
> |
29 |
> Ebuilds are using a single fetching mechanisms so that people can adjust |
30 |
> it as necessary for their setup. It's not fine to try to silently work |
31 |
> around that and access Internet. |
32 |
|
33 |
This argument is pretty irrelivent, because if you are using that strong |
34 |
firewalling, you will block people from compiling go sourcewith external |
35 |
dependencies whether or not they are using ebuilds. |
36 |
Also, you will block emerge --sync since it uses rsync and that protocol |
37 |
is more likely to be blocked than http. |
38 |
|
39 |
This also applies to your comment about not having a permanent internet |
40 |
connection. |
41 |
|
42 |
William |