1 |
On Wed, Sep 18, 2019 at 10:50 AM Michael Orlitzky <mjo@g.o> wrote: |
2 |
|
3 |
> On 9/16/19 10:17 AM, William Hubbs wrote: |
4 |
> > + |
5 |
> > +# @FUNCTION: go-module_pkg_postinst |
6 |
> > +# @DESCRIPTION: |
7 |
> > +# Display a warning about security updates for Go programs. |
8 |
> > +go-module_pkg_postinst() { |
9 |
> > + ewarn "${PN} is written in the Go programming language." |
10 |
> > + ewarn "Since this language is statically linked, security" |
11 |
> > + ewarn "updates will be handled in individual packages and will be" |
12 |
> > + ewarn "difficult for us to track as a distribution." |
13 |
> > + ewarn "For this reason, please update any go packages asap when |
14 |
> new" |
15 |
> > + ewarn "versions enter the tree or go stable if you are running the" |
16 |
> > + ewarn "stable tree." |
17 |
> > +} |
18 |
> > + |
19 |
> > +fi |
20 |
> > |
21 |
> |
22 |
> This word salad is 100% misinformation that gets tangled in itself |
23 |
> trying to apologize for what we're about to do: |
24 |
> |
25 |
> * Go is not a "statically linked language." There's gccgo, and as Alec |
26 |
> pointed out, the official compiler has supported dynamic linking for |
27 |
> years now. |
28 |
> |
29 |
|
30 |
I'm actually pretty fine with this wording, upstream has said not to |
31 |
dynamically link in these use cases. |
32 |
|
33 |
|
34 |
> |
35 |
> * Updating DOES NOT HELP AT ALL. That's the whole problem. You're |
36 |
> trying to make it sound like we haven't thrown people under a bus, |
37 |
> but saying "for this reason, please update..." is just misleading. |
38 |
> |
39 |
> Here's what it should say: |
40 |
> |
41 |
> WARNING: due to a lack of manpower/interest, Go packages on Gentoo |
42 |
> are statically linked. Contrary to our existing policies and what |
43 |
> the website says, Go packages will never receive any security updates |
44 |
> on Gentoo. Use at your own risk! |
45 |
|
46 |
|
47 |
So if the package *maintainer* bumps each package every time it, or a dep |
48 |
has a security issue; then updating will work fine. |
49 |
I'm skeptical go maintainers are volunteering for this though. |
50 |
|
51 |
-A |