1 |
On Mon, Sep 09, 2019 at 02:54:51PM -0400, Michael Orlitzky wrote: |
2 |
> On 9/9/19 2:19 PM, Zac Medico wrote: |
3 |
> > On 9/9/19 10:34 AM, William Hubbs wrote: |
4 |
> > |
5 |
> >> There is another option I want to try which is adding "go mod vendor" to |
6 |
> >> src_unpack for go packages. |
7 |
> > |
8 |
> > If you do that then it will violate FEATURES=network-sandbox (default) |
9 |
> > unless you also do PROPERTIES+=" live". |
10 |
> > |
11 |
> > We could add a separate PROPERTIES value for this, I've suggested it |
12 |
> > before but both Michał Górny and Ulrich Mueller were against it: |
13 |
> > |
14 |
> |
15 |
> This is the precisely what FEATURES=network-sandbox exists to prevent. |
16 |
> |
17 |
> Bundling dependencies, hitting the network, shelling out to a |
18 |
> language-specific package manager, depending on specific upstream |
19 |
> commits, and sidestepping existing QA mechanisms to make this all |
20 |
> possible... it's bad idea bingo. |
21 |
|
22 |
Michael, |
23 |
|
24 |
Please read all of the info on go modules. In particular, I don't think |
25 |
you read the info about the mirror database and checksum verification. |
26 |
|
27 |
William |