[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Fedora planning to stop doing source-only Go packages and vendor everything



Otto Kekäläinen <otto@debian.org> writes:

> Hi,
>
> This might be an interesting reaf to people in Debian's Go team:
> https://fedoraproject.org/wiki/Changes/GolangPackagesVendoredByDefault
>
> I am not advocating we should do something just because Fedora did, but it
> is good to be aware what major players in the field are doing and what they
> motivations for doing so are.

Interesting, thanks for sharing.  Aligning the various ways to ship Go
binaries would be a nice long-term goal.

A third solution to the many-version-of-the-same-project dependency
problem -- instead of vendoring them -- could be to ship a Git Bundle
for each Go project in the Debian golang-*-dev package.  Then packages
that need different versions can both be satisfied by picking out the
"right" version.  The gnulib package in Debian include a git bundle for
a reusable C source code project, and I see similarities.

This approach would solve the problem of having many vendored copies of
the same Go source code files in different packages; allows centralized
patching (using a dh_gnulib_patch-like approach) in case of security
problems, and respect upstream desire to pin particular commits.

To me the vendoring approach Fedora is going for feels wrong, but I can
understand they aren't happy with the current situation.

/Simon

Attachment: signature.asc
Description: PGP signature


Reply to: