Re: [gentoo-dev] network sandbox challenge

[Robin H. Johnson]

On Wed, Apr 01, 2020 at 12:50:56PM +0100, Samuel Bernardo wrote:
> Hi Robin,
>
> On 4/1/20 6:36 AM, Robin H. Johnson wrote:
> > Samuel:
> > I already proved that using go-module.eclass EGO_SUM it will NOT use Git
> > repositories, and all of the fetching will happen long before
> > src_unpack. Why do you persist with your statement to the contrary?
>
> Sorry my misunderstanding, but I didn't get it right with what you
> mentioned to me before:
>
> > Have you looked at the EGO_SUM in go-module? This already covers ANY go
> > package that uses go.mod + go.sum, in a fully reproducible way that does
> > not break network sandbox.
> I looked into the eclass documentation and I only found EGO_VENDOR[1].
> This seems so expensive since I need to parse all go.mod or go.sum files
> that I concluded would be better to use a tar.gz with all dependencies
> (remember that my use case is with my personal overlay).
Thanks, it seems the eclass HTML documentation is not updating
correctly (it's showing the content of the eclass-manpages-20200213
version right now, despite the "Updated: Apr 2020" text). I've pushed a
change and the corrected documentation is now visible.
Thank you for bringing this to our attention.

> Looking deeply into the source code I could find more details about
> EGO_SUM that only needs to set the urls to go.mod or/and go.sum files
> present in the repository. This is useful, but only to official gentoo
> developers, since if I want to use my own mirror type, for instance
> mirror://gooverlay, I wouldn't have that option[3]:
You don't need to override _GOMODULE_GOPROXY_BASEURI at all.

_GOMODULE_GOPROXY_BASEURI (with the default of mirror://goproxy/)
expands to the UPSTREAM locations that have the Go modules available.

It expects those mirrors to have the layout of files used by upstream.

> > # I am considering removing this and just hard coding mirror://goproxy
> > # below, so please do not rely on it.
> > : "${_GOMODULE_GOPROXY_BASEURI:=mirror://goproxy/}"|
> So, go-module.eclass provides a good base to follow SRP pattern (single
> responsibility principle). Looking into that effort I would copy
> go-module.eclass to my overlay eclass directory and adapt it to use my
> mirror type.
>
> I would like to use directly Gentoo maintained go-module.eclass, but for
> that I would like to have access to set my own mirror type.
>
> I also ask you to update documentation since there is some details to
> use EGO_SUM, such as you stated in comment[4].
It's not clear why you need to modify the mirror behavior at all; maybe
you covered that elsewhere in this overly long thread.

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@g.o
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136