On Sat, May 30, 2020 at 11:28:08PM +0200, Marius Bakke wrote:
> raingloom <raingloom@riseup.net> writes:
> 
> > Hey all!
> >
> > So, I recently gave a go to packaging EDK2 on my channel, and found out
> > that it requires several submodules, including OpenSSL, which take up
> > quite a bit of space and take way longer to download than necessary.
> >
> > Since I couldn't find a way to shallow-init the submodules, I added
> > them as separate origins and copied / symlinked them after the unpack
> > phase.
> 
> That sounds like a decent workaround.  Even better to symlink
> (package-source openssl) to use the OpenSSL sources from Guix.

Yes, we should definitely make that work instead of letting EDK2 handle
it. Same for the Oniguruma dependency, as that is also a very
security-sensitive program:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=oniguruma

Let us know if you need help raingloom!