On Mon, Sep 09, 2019 at 02:54:51PM -0400, Michael Orlitzky wrote:
> On 9/9/19 2:19 PM, Zac Medico wrote:
> > On 9/9/19 10:34 AM, William Hubbs wrote:
> > 
> >> There is another option I want to try which is adding "go mod vendor" to
> >> src_unpack for go packages.
> > 
> > If you do that then it will violate FEATURES=network-sandbox (default)
> > unless you also do PROPERTIES+=" live".
> > 
> > We could add a separate PROPERTIES value for this, I've suggested it
> > before but both Michał Górny and Ulrich Mueller were against it:
> > 
> 
> This is the precisely what FEATURES=network-sandbox exists to prevent.
> 
> Bundling dependencies, hitting the network, shelling out to a
> language-specific package manager, depending on specific upstream
> commits, and sidestepping existing QA mechanisms to make this all
> possible... it's bad idea bingo.

Michael,

Please read all of the info on go modules. In particular, I don't think
you read the info about the mirror database and checksum verification.

William