Re: [gentoo-dev] Proposal to undeprecate EGO_SUM

[Arsen Arsenović]

(replying to the first post here as I believe this post is relevant to 
most, if not all, subthreads)

I've prepared a PoC of an automated solution for vendoring[1] a while 
back (around the start of this whole discussion) that would place trust 
on the infrastructure (though potentially verifiable).

My concept provides two solutions:
1) go mod vendor - not verifiable by users (as vendor tars don't include       
enough information for checksumming - see also [2])
2) modcache - significantly larger but verifiable on the client (against 
existing go.sum). These archives really go up to gigabytes in size as 
opposed to a few megs of vendored tarballs.

Please note that [1] is on a small server, possibly broken, pretty slow, 
and not fit for production yet. Ping me on IRC if you encounter issues 
so that I can "unjam" it.

Also note that this thing doesn't attempt much to figure out how to 
convert a ${PV} or any other format versions, and essentially leaves 
that up to the GOPROXY (with very little extra work, see: [3]).

The proposed solution here is that the developer passes something like 
https://go.gentoo.org/vendor/...@${PV} -> vendor.tar into $SRC_URI, 
which would get initiated with a call to ``pkgdev manifest'' or such 
(possibly authenticated via IP or keys or something, to prevent abuse), 
and be done with it.

The biggest downside I've seen so far (excluding further developing the 
solution) is that some Go programs don't respect the restrictions of the 
Go module system, and thus fail to fetch.

[1]: https://vengor.aarsen.me/
[2]: https://github.com/golang/go/issues/27348
[3]: https://git.sr.ht/~arsen/vengor/tree/ab1ae7b275ab492d4806de88cfbf67e7b97c1ade/item/vengor/__init__.py#L101-127

-- 
Arsen Arsenović