From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id D1593138334 for ; Thu, 12 Sep 2019 21:11:41 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 72161E0CCC; Thu, 12 Sep 2019 21:11:37 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 1643AE0C7C for ; Thu, 12 Sep 2019 21:11:37 +0000 (UTC) Received: from [192.168.1.100] (c-98-218-46-55.hsd1.md.comcast.net [98.218.46.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: mjo) by smtp.gentoo.org (Postfix) with ESMTPSA id CE69F34B0CD for ; Thu, 12 Sep 2019 21:11:35 +0000 (UTC) Subject: Re: [gentoo-dev] [PATCH 3/3] dev-vcs/hub: migrate to go-module.eclass To: gentoo-dev@lists.gentoo.org References: <20190911172128.18885-1-williamh@gentoo.org> <20190911172128.18885-4-williamh@gentoo.org> <20190911234815.GA21591@whubbs1.dev.av1.gaikai.org> <20190912154634.GB23846@whubbs1.dev.av1.gaikai.org> <88094567-323c-6f6a-a1d9-0c1b77ef53e3@gentoo.org> <6acd490e-6393-62e4-5d07-71c2a3624417@gentoo.org> <2db31450-63e5-2ecc-ff3b-1858c760b287@gentoo.org> From: Michael Orlitzky Message-ID: <4ccab80c-fc9e-c843-8a1b-50a329abf6c1@gentoo.org> Date: Thu, 12 Sep 2019 17:11:30 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Archives-Salt: a6d4e5ff-4204-43db-8dda-122d5469333a X-Archives-Hash: bc3dec832fc823ca81f26aaa676de869 On 9/12/19 1:43 PM, Mike Gilbert wrote: > > They do "go away" if you pass the right options to emerge, or if you > install it from a binpkg in the first place. > The dependencies are statically linked into the final executable forever and receive no security updates. Portage doesn't even know they're there. Depclean doesn't do what you think it does in that case. (I'm sure you personally understand how this works, but a regular user has no idea that we've installed 100MB of vulnerable code on his machine and have just abandoned it there.)