From: William Hubbs <williamh@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Subject: Re: [gentoo-dev] [PATCH 1/1] go-module.eclass: introduce new eclass to handle go modules
Date: Wed, 18 Sep 2019 16:11:43 -0500 [thread overview]
Message-ID: <20190918211143.GA8809@whubbs1.dev.av1.gaikai.org> (raw)
In-Reply-To: <3d5adfdf-ed54-8245-18f9-4922db627e98@gentoo.org>
[-- Attachment #1: Type: text/plain, Size: 2857 bytes --]
On Wed, Sep 18, 2019 at 12:28:29PM -0700, Zac Medico wrote:
> On 9/18/19 11:04 AM, Alec Warner wrote:
> >
> >
> > On Wed, Sep 18, 2019 at 10:50 AM Michael Orlitzky <mjo@gentoo.org
> > <mailto:mjo@gentoo.org>> wrote:
> >
> > On 9/16/19 10:17 AM, William Hubbs wrote:
> > > +
> > > +# @FUNCTION: go-module_pkg_postinst
> > > +# @DESCRIPTION:
> > > +# Display a warning about security updates for Go programs.
> > > +go-module_pkg_postinst() {
> > > + ewarn "${PN} is written in the Go programming language."
> > > + ewarn "Since this language is statically linked, security"
> > > + ewarn "updates will be handled in individual packages and
> > will be"
> > > + ewarn "difficult for us to track as a distribution."
> > > + ewarn "For this reason, please update any go packages asap
> > when new"
> > > + ewarn "versions enter the tree or go stable if you are
> > running the"
> > > + ewarn "stable tree."
> > > +}
> > > +
> > > +fi
> > >
> >
> > This word salad is 100% misinformation that gets tangled in itself
> > trying to apologize for what we're about to do:
> >
> > * Go is not a "statically linked language." There's gccgo, and as Alec
> > pointed out, the official compiler has supported dynamic linking for
> > years now.
> >
> >
> > I'm actually pretty fine with this wording, upstream has said not to
> > dynamically link in these use cases.
> >
> >
> >
> > * Updating DOES NOT HELP AT ALL. That's the whole problem. You're
> > trying to make it sound like we haven't thrown people under a bus,
> > but saying "for this reason, please update..." is just misleading.
> >
> > Here's what it should say:
> >
> > WARNING: due to a lack of manpower/interest, Go packages on Gentoo
> > are statically linked. Contrary to our existing policies and what
> > the website says, Go packages will never receive any security updates
> > on Gentoo. Use at your own risk!
> >
> >
> > So if the package *maintainer* bumps each package every time it, or a
> > dep has a security issue; then updating will work fine.
> > I'm skeptical go maintainers are volunteering for this though.
>
> There's a script here which helps to automate refresh of commit hashes
> in EGO_VENDOR:
>
> https://github.com/hsoft/gentoo-ego-vendor-update
>
> Just now I've used it to refresh vendored dependencies in
> net-misc/drive:
>
> https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3993b893d4788beaad945bc82df0f4efd91ce697
I have seen that script, and it really doesn't work for modules. it
would need to parse go.mod and grab the dependencies based on the
information in that file.
William
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
next prev parent reply other threads:[~2019-09-18 21:11 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-16 14:17 [gentoo-dev] [PATCH 0/1] introduce new eclass to handle go modules (round 3) William Hubbs
2019-09-16 14:17 ` [gentoo-dev] [PATCH 1/1] go-module.eclass: introduce new eclass to handle go modules William Hubbs
2019-09-16 17:40 ` William Hubbs
2019-09-16 17:48 ` Zac Medico
2019-09-16 18:26 ` William Hubbs
2019-09-16 19:50 ` Zac Medico
2019-09-16 18:01 ` Zac Medico
2019-09-16 18:35 ` William Hubbs
2019-09-16 18:50 ` Zac Medico
2019-09-16 22:00 ` William Hubbs
2019-09-17 5:36 ` Michał Górny
2019-09-17 14:10 ` William Hubbs
2019-09-17 17:40 ` Zac Medico
2019-09-16 18:05 ` Michał Górny
2019-09-16 18:46 ` William Hubbs
2019-09-16 19:19 ` Michał Górny
2019-09-18 17:49 ` Michael Orlitzky
2019-09-18 18:04 ` Alec Warner
2019-09-18 19:15 ` Michael Orlitzky
2019-09-18 19:33 ` Alec Warner
2019-09-19 1:09 ` Michael Orlitzky
2019-09-18 19:28 ` Zac Medico
2019-09-18 21:11 ` William Hubbs [this message]
-- strict thread matches above, loose matches on Subject: below --
2019-09-18 20:26 [gentoo-dev] [PATCH 0/1] introduce an eclass to handle go modules (round 5) William Hubbs
2019-09-18 20:26 ` [gentoo-dev] [PATCH 1/1] go-module.eclass: introduce new eclass to handle go modules William Hubbs
2019-09-18 20:29 ` Michał Górny
2019-09-18 21:28 ` William Hubbs
2019-09-19 1:02 ` Michael Orlitzky
2019-09-16 22:47 [gentoo-dev] [PATCH 0/1] introduce new eclass to handle go modules (round 4) William Hubbs
2019-09-16 22:47 ` [gentoo-dev] [PATCH 1/1] go-module.eclass: introduce new eclass to handle go modules William Hubbs
2019-09-13 15:49 [gentoo-dev] [PATCH 0/1] Introduce new eclass to handle go modules (round 2) William Hubbs
2019-09-13 15:49 ` [gentoo-dev] [PATCH 1/1] go-module.eclass: introduce new eclass to handle go modules William Hubbs
2019-09-13 15:58 ` William Hubbs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190918211143.GA8809@whubbs1.dev.av1.gaikai.org \
--to=williamh@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox