Re: [gentoo-dev] EGO_SUM (was: [gentoo-project] Gentoo Council Election 202306 ... Nominations Open

[Hank Leininger <hlein@korelogic.com>]

[-- Attachment #1: Type: text/plain, Size: 2245 bytes --]

On Thu, Jul 6, 2023 Zoltan Puskas wrote:
> I've been following the EGO_SUM thread for quite some time now. One
> other thing I did not see mentioned in favour of EGO_SUM so far:
> reproducibility.

> The problem with external tarballs is that they are gone once the
> ebuild is dropped from the tree. Should a user ever want to roll back
> to a previous version of an application, either by checking out on
> older version of the portage tree or copying said ebuild into their
> local overlay, they still cannot simply run an emerge on the it as
> they have to somehow recreate the tarball itself too.

> While upstream may not host everything forever, it's pretty much
> guaranteed to be available for much longer than Gentoo's custom
> tarball bundles of dependencies.

I see this brought up every once in a while in these EGO_SUM threads,
but I think reproducable tarballs are a solved problem, or at least, the
tools exist and we just need to decide how to best equip people with
them.

thesamesam/sam-gentoo-scripts has maint/bump-go which builds these
tarballs smartly and reproducably:

- use --sort=name to order files inside in a consistent way
- use consistent owner:group (portage:portage)
- use consistent LC and TZ settings
- set a standard timestamp (since 'go mod download' doesn't preserve
  upstream timestamps anyway, this loses no useful information)

With that, multiple developers can independently generate a -deps
tarball for a given Go package version with checksums that match. The
main distro tarball's checksums are verified against Manifest, and then
within it are the list and checksums of the individual downloads which
would be verified by go mod download (right?) and the resulting -deps
files should also match Manifest entries.

So a similar approach could be used in the case of expired ::gentoo
versions being installed, or overlays using -deps files without a way to
host them. Set things up so this can be done easily on demand or perhaps
automatically as needed (maybe through a variation on pkg_nofetch in a
Go eclass; that part is not obvious to me). 

Thanks,

-- 

Hank Leininger <hlein@korelogic.com>
9606 3BF9 B593 4CBC E31A  A384 6200 F6E3 781E 3DD7

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]