1 |
On 14.06.22 18:33, Holger Hoffstätte wrote: |
2 |
> So my idea here is: instead of chucking EGO_SUM (automatically |
3 |
> generated declarative dependency management) out the window, can we not |
4 |
> separate the two and instead of uploading the tarball upload the |
5 |
> dependency set instead? |
6 |
I think that this idea that has been pitched already (see for example |
7 |
Robin's post [1]), although in a broader non-Go-specific sense and it is |
8 |
one obvious way to move forward. |
9 |
|
10 |
An, and probably the largest, obstacle is that this can not be |
11 |
implemented in an eclass alone. Due the sandboxing during the build |
12 |
process, fetching distfiles, which is what we are talking about, is the |
13 |
package managers job and hence, I believe, this would require adustments |
14 |
to the package manager and package manager specification (PMS). |
15 |
|
16 |
The basic idea, at least to my understanding (or how I would propose |
17 |
it), is to have a new top-level ebuild variable |
18 |
|
19 |
SRC_URI_FILE="https://example.org/manifests/restic-0.13.1.files" |
20 |
|
21 |
where restic-0.13.1.files contains lines like |
22 |
|
23 |
<SRC_URI> <SIZE> <HASH> [<TARGET_FILENAME>] |
24 |
|
25 |
which is, as you nicely demonstrated on the restic ebuild, where the |
26 |
bytes contributing to the ebuild size bloat originate from. |
27 |
|
28 |
Those bytes are now outsourced from ::gentoo, can be fetched on-demand, |
29 |
allowing the package manager to download the individual distfiles into |
30 |
DISTDIR, where an, e.g., the go eclass can process them further within |
31 |
the constraints of the security sandbox. |
32 |
|
33 |
- Flow |
34 |
|
35 |
|
36 |
1: |
37 |
https://archives.gentoo.org/gentoo-dev/message/8e2a4002bfc6258d65dcf725db347cb9 |