[gentoo-dev] About EGO_SUM

[Florian Schmaus <flow@gentoo.org>]

EGO_SUM is marked as 'deprecated' in go-module.eclass [1, 2]. I 
acknowledge that there are packages where the usage of EGO_SUM is very 
problematic. However, I wonder if there are packages where using 
dependency tarballs is problematic while using EGO_SUM would be not.

Take for example an ebuild containing

SRC_URI="
 
https://salsa.debian.org/baz/${PN}/-/archive/v${PV}/${PN}-v${PV}.tar.bz2 
-> ${P}.tar.bz2
     https://personal.site/files/gentoo/${P}-vendor.tar.xz
"

where ${P}-vendor.tar.xz is a Go dependency tarball, containing only a 
few Go modules. Hence EGO_SUM would contain only a few entries in this case.

I see multiple issues of using dependency tarballs in such cases.

First, my trust in a tarball created by someone and hosted somewhere is 
lower than the contents of the artifacts hosted on an official hub. 
Next, if anyone takes the time to review the contents of the dependency 
tarball, it may only benefit Gentoo. On the other hand, if someone 
reviews EGO_SUM artifacts, the whole Go ecosystem will benefit.

I may not know Gentoo's mirror system in detail, but I believe using 
EGO_SUM facilitates cross-package distfile sharing. While dependency 
tarballs will increase the space requirements, and, probably more 
importantly, the load on the mirrors.

Even more problematic are that dependency tarballs require additional 
steps that would not be required when EGO_SUM is used. While those steps 
appear simple, behavioral theory shows that even the tiniest additional 
steps have a huge impact (e.g., online shops loose a relative large 
share of customers if for each an additional checkout step). If we force 
dependency tarballs for Go software, then packaging Go software just 
become a little bit harder.

This leads me to the question why are we actually deprecating EGO_SUM? 
It seems like a nice alternative for Go packaging that we may want to 
keep. But maybe I am missing something?

- Flow


1: 
https://github.com/gentoo/gentoo/blob/9fec686abf789fdff36a90c3763d9558203cbf9a/eclass/go-module.eclass#L108
2: 
https://github.com/gentoo/gentoo/blob/9fec686abf789fdff36a90c3763d9558203cbf9a/eclass/go-module.eclass#L349-L352