On Thursday, 6 February 2020 9:11:07 AM AEDT Bernd Zeimetz wrote:
> They are not shipped in Debian, but they are free software,
> binaries with sources being available, as far as I can see all under a
> dfsg free license.
Sources are somewhere, true. But build (binary) is not DFSG-compliant.
I feel like you are making your point by pretending not to understand...
Why all this denial?
Saying "that's how Golang works" is enough to ignore DFSG compliance?
Don't you think it would be _better_ to use (only) components from "main"?
Certainly there will be more integrity if you can do that.
> Where is the problem?
Lack of self-reliance? Using non-trusted vendor binaries (and/or container
image)? Using sloppy vendor build over proper one that we have in Debian?
Pick any.
--
Cheers,
Dmitry Smirnov.
---
Orthodoxy is the ability to say two and two make five when faith
requires it.
-- George Orwell, Nineteen Eighty-Four (1949).
Attachment:
signature.asc
Description: This is a digitally signed message part.