Re: [gentoo-project] Call for agenda items - Council meeting on 2022-02-13

[William Hubbs]

On Wed, Feb 09, 2022 at 10:40:20AM -0600, William Hubbs wrote:

*snip*

> I hope vendor tarballs are a temporary solution.
> The down side of them is duplicate data across vendor tarballs. In other
> words, the vendor tarball for cosign could include data that is in other
> vendor tarballs and there is no way to prevent that.
>
> The best solution would be to have a src_fetch_extra phase like I
> mentioned earlier in the thread. If I had that ability, the cosign
> ebuild would look like this. Note that the src_fetch_extra function
> would be in the go-module eclass not the cosign ebuild so the ebuild
> would be smaller still.

I just realized a down side to this approach, but I don't know how
important that down side is.

As the example shows, if a package has a vendor directory we would trust
it so nothing would need to be done. If we have to run "go mod
download", however, this populates the dependency cache from the
internet. This means that a package that requires this could not be
built if the building machine is not on the net.

I don't know how important this is, because it is true for any go
package without a vendor directory no matter how you build it.

Thoughts?

William