From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: Re: Guix & IPFS Date: Tue, 16 Oct 2018 12:27:47 -0400 Message-ID: <20181016162747.GB25057@jasmine.lan> References: <87r2grk5dj.fsf@ambrevar.xyz> <87lg6zfr20.fsf@gnu.org> <87lg6zjxwt.fsf@ambrevar.xyz> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="hHWLQfXTYDoKhP50" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:37312) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gCSCL-0003qi-Jg for guix-devel@gnu.org; Tue, 16 Oct 2018 12:27:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gCSCH-0006Vj-Io for guix-devel@gnu.org; Tue, 16 Oct 2018 12:27:57 -0400 Content-Disposition: inline In-Reply-To: <87lg6zjxwt.fsf@ambrevar.xyz> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Pierre Neidhardt Cc: Guix-devel --hHWLQfXTYDoKhP50 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Oct 15, 2018 at 12:40:18PM +0200, Pierre Neidhardt wrote: > No, Go programs typically refer only to repositories, not to their commit= =2E This > is precisely why it's a problem. Golang's dependency management was not = very > well designed I'm afraid. >=20 > Misunderstanding? I think you and Ludo talked past each a bit. To clarify: Go code refers to dependencies by the URL of their repositories. For example, the code will import the modules it depends on like this: ------ import ("github.com/thejerf/suture" "github.com/rcrowley/go-metrics") ------ The Go compiler will actually fetch these Git repos if they are not already available locally, cloning and using the HEAD commit (?!). But in practice, any complex Go software will use a dependency management tool that also specifies the Git commit to use, because... =2E.. there is basically no concept of "releases" or "stable APIs" in Go world, although there are 3rd party tools that try to fill the gap. Since nobody is thinking about releasing or maintaining an API, they don't, and it becomes important to use the right Git commit. My opinion is that we should use the "correct" Git commit every time, even it means we have to package several versions of the same Go library, or use channels, or Scheme macros, etc. Otherwise we will have a lot of debugging to do, and upstream developers will start to resent us when they get bug reports. With Guile, we have the tools to achieve this. I've been doing it "manually" for the Syncthing package. We discussed this previously: https://lists.gnu.org/archive/html/guix-devel/2017-10/msg00030.html --hHWLQfXTYDoKhP50 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlvGEYMACgkQJkb6MLrK fwgBlBAAx/RpsIqmHf5YaJ2t+76YOEc1cFZs5xQf5QVxf3/R0DuHJC9TDIG9uSZ3 TGKLvblt84rVJDDsWVvoefpIGpAjkKRSEbzUkfiSrcuZb703yv8x2JjuitB5ZfY7 MBMOu6e0nTL4jl471a0M/CXlrMdrxUBjGtteUgNidBzDXU8EygZHzjPk0d0gHpxl 2Nzn35tNp4mipOhIU37ey73qN7UMHK3iE/vMDFAvYYW2hTCX7/9/P31XTa+qojY3 L4HE0OmGMyqxzKWJJQHTrxZPKQ2nbuFhYeVdvnwJbNsQNZVRQMe1hwEuapRqnDRi ZkMLqsFhKBa1IBfhw8F4VxB6IN2ibL+QkezJJEdqA3s0KCOh7xQniRbgZfLI3/OE eZye0zymsyT8LFPVpBwRU096qtTuuBQYQyex4P3THSwtFat+x9BY0cuHMOtTh7oN c1L9Pvrdgxt/It3EK7tRp4H/p9GhlxpHwBapBKBm7sHC7VMUZpqKrlivJC/0sdp7 Q2HVHhe/dOCr4ds+XW9HczC2ckenJbbVJbpBJo66EpHOGAm7AHY3Ee+M9Jn0Lx8c aaZHMADpcRMgl/RanUEdhKHLePh3R5wXuFBj4oDMYNbxuZfApim7qDBRH31M5Wu0 ffuCbIwf9boFenEr1MYBJD/cptmgns8UEQy65XP1rJzG2nDfQzs= =BGIG -----END PGP SIGNATURE----- --hHWLQfXTYDoKhP50--