From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 5800A158091 for ; Tue, 14 Jun 2022 17:03:22 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 1CF0AE0839; Tue, 14 Jun 2022 17:03:18 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A2AB4E07F9 for ; Tue, 14 Jun 2022 17:03:17 +0000 (UTC) Message-ID: <47743ad6-8c4f-dc18-669c-ecf633ae5619@gentoo.org> Date: Tue, 14 Jun 2022 19:03:12 +0200 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.10.0 Subject: Re: [gentoo-dev] Re: Proposal to undeprecate EGO_SUM Content-Language: en-GB To: =?UTF-8?Q?Holger_Hoffst=c3=a4tte?= References: <20220613074411.341909-1-flow@gentoo.org> <54cc5375-c8b6-3e12-81c8-a62ea308d234@applied-asynchrony.com> From: Florian Schmaus Cc: gentoo-dev@lists.gentoo.org In-Reply-To: <54cc5375-c8b6-3e12-81c8-a62ea308d234@applied-asynchrony.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Archives-Salt: 3a408831-1600-4e71-a851-06007b413e36 X-Archives-Hash: a615adfc20a98d8271e83b24bf3223d4 On 14.06.22 18:33, Holger Hoffstätte wrote: > So my idea here is: instead of chucking EGO_SUM (automatically > generated declarative dependency management) out the window, can we not > separate the two and instead of uploading the tarball upload the > dependency set instead? I think that this idea that has been pitched already (see for example Robin's post [1]), although in a broader non-Go-specific sense and it is one obvious way to move forward. An, and probably the largest, obstacle is that this can not be implemented in an eclass alone. Due the sandboxing during the build process, fetching distfiles, which is what we are talking about, is the package managers job and hence, I believe, this would require adustments to the package manager and package manager specification (PMS). The basic idea, at least to my understanding (or how I would propose it), is to have a new top-level ebuild variable SRC_URI_FILE="https://example.org/manifests/restic-0.13.1.files" where restic-0.13.1.files contains lines like [] which is, as you nicely demonstrated on the restic ebuild, where the bytes contributing to the ebuild size bloat originate from. Those bytes are now outsourced from ::gentoo, can be fetched on-demand, allowing the package manager to download the individual distfiles into DISTDIR, where an, e.g., the go eclass can process them further within the constraints of the security sandbox. - Flow 1: https://archives.gentoo.org/gentoo-dev/message/8e2a4002bfc6258d65dcf725db347cb9