1 |
On Wed, 2022-02-09 at 14:32 -0600, William Hubbs wrote: |
2 |
> On Wed, Feb 09, 2022 at 06:09:55PM +0100, Michał Górny wrote: |
3 |
> |
4 |
> *snip* |
5 |
> |
6 |
> > This would: |
7 |
> > |
8 |
> > 1) break Gentoo installations behind restrictive firewalls, |
9 |
> |
10 |
> Maybe, maybe not. If the go module cache is populated on the firewalled |
11 |
> system ahead of time things would still work. could emerge -f handle |
12 |
> this? |
13 |
> |
14 |
> > 2) make parallel fetching much harder, |
15 |
> |
16 |
> I do not have any comments on this. |
17 |
> |
18 |
> > 3) would require custom implementations to support caching |
19 |
> > and mirroring, |
20 |
> |
21 |
> Go already handles both of these with the go proxy mirrors and the |
22 |
> GOMODCACHE environment variable. |
23 |
> We could, in the go-module eclass, point GOMODCACHE to for example |
24 |
> <distdir>/go-mod. |
25 |
|
26 |
So basically every sysadmin running Gentoo will now have to account for |
27 |
special case of fetching Go sources in addition to fetching generic |
28 |
Gentoo distfiles. |
29 |
|
30 |
> |
31 |
> > 4) will eventually lead to ebuilds fetching and using unverified data. |
32 |
> |
33 |
> Not for go at least. |
34 |
|
35 |
And how are you going to guarantee that this humongous security hole |
36 |
will not be used wrong for anything else? |
37 |
|
38 |
-- |
39 |
Best regards, |
40 |
Michał Górny |