[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#971515: kubernetes: excessive vendoring (private libraries)



On Tue, Oct 20, 2020 at 12:16:03PM -0700, Sean Whitton wrote:
> 
> - are people trying to do cross-archive work going to find the packaging
>   of kubernetes getting in their way?  (e.g. other Go team members
>   trying to update things, improve our binNMU techniques and machinery,
>   etc.)
> 

The kubernetes maintainer is not in the Go packaging team, so doesn't follow
the team practice. But as kubernetes vendor everything, it doesn't need to
work with all other Go packages.

However kubernetes is also a library, and the maintainer doesn't provide it.
It becomes headache for other maintainers.
We (the Go packaging team) need to vendor the kubernetes in our packages,
for example:

+ https://sources.debian.org/src/golang-github-openshift-api/4.0+git20190508.81d064c-4/vendor/k8s.io/
+ https://sources.debian.org/src/gitlab-ci-multi-runner/13.3.1+dfsg-1/vendor/k8s.io/
+ https://sources.debian.org/src/flannel/0.9.1~ds1-1/vendor/k8s.io/
+ https://sources.debian.org/src/consul/1.7.4+dfsg1-1/vendor/k8s.io/

And many, they can be found with:

https://codesearch.debian.net/search?q=%22k8s.io%2F+filetype%3Ago&literal=1

It has been asked at #970331, without response from maintainer.

If kubernetes package want to make other package which Build-Depends on it
to build successfully, it needs to decouple the dependencies from vendor dir.
When building other packages, the Go toolchain can't use the vendor in
kubernetes, since the Go toolchain only supports the top level vendor dir.

The way the kubernetes maintainer chooses, is making others difficult.
Every package that uses kubernetes as a library, has to keep a local copy of
the source.

It's not Janos fault, as he doesn't make things worse. Kubernetes package is
in a bad state for a long time.
But I hope Janos can cooperate with the Go packaging team to make Debian,
especially the Go packages in Debian more maintainable.

-- 
Shengjing Zhu

Attachment: signature.asc
Description: PGP signature


Reply to: