From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp0 ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms0.migadu.com with LMTPS id 2LMkNuL9l2DFFgAAgWs5BA (envelope-from ) for ; Sun, 09 May 2021 17:21:06 +0200 Received: from aspmx1.migadu.com ([2001:41d0:2:bcc0::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp0 with LMTPS id yCvkMeL9l2BpawAA1q6Kng (envelope-from ) for ; Sun, 09 May 2021 15:21:06 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 511D510D83 for ; Sun, 9 May 2021 17:21:06 +0200 (CEST) Received: from localhost ([::1]:36980 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lflEv-0006vB-3O for larch@yhetil.org; Sun, 09 May 2021 11:21:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:44024) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lflC0-0008Nu-Lg for guix-patches@gnu.org; Sun, 09 May 2021 11:18:05 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:44269) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lflBy-0006Ce-VL for guix-patches@gnu.org; Sun, 09 May 2021 11:18:03 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1lflBy-0000cK-Ip for guix-patches@gnu.org; Sun, 09 May 2021 11:18:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#48259] [PATCH 1/2] gnu: Replace go-github-com-golang-protobuf-proto with go-github-com-golang-protobuf Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 09 May 2021 15:18:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 48259 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Dion Mendel Cc: 48259@debbugs.gnu.org Received: via spool by 48259-submit@debbugs.gnu.org id=B48259.16205734602361 (code B ref 48259); Sun, 09 May 2021 15:18:02 +0000 Received: (at 48259) by debbugs.gnu.org; 9 May 2021 15:17:40 +0000 Received: from localhost ([127.0.0.1]:55814 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lflBb-0000c1-KN for submit@debbugs.gnu.org; Sun, 09 May 2021 11:17:39 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:35561) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lflBY-0000bv-2H for 48259@debbugs.gnu.org; Sun, 09 May 2021 11:17:38 -0400 Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id AC3DC5C00F4; Sun, 9 May 2021 11:17:30 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute3.internal (MEProxy); Sun, 09 May 2021 11:17:30 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=mesmtp; bh=Y0jtdb2UpV/PhgHC1j1wAw+D c71cMhghHUqh6spVxzs=; b=Lrb9lSM78pxrUOZKa1ISPbqLtHYNWP6EmAa13cZY DjokxyLxlOA3rtwYtPpvbj03j2LPzTjDPKfWrSl1sN8Gj5zct0DZcLbDkVG5P7Hy tIly3urqmn75AtWajYkLVbB6rHruoVN9P1Vts50AztF0gqivPEoQLOPRSrbOFzOg rgs= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=Y0jtdb 2UpV/PhgHC1j1wAw+Dc71cMhghHUqh6spVxzs=; b=PEW79gKvlRinGfqxxS2HFQ pVvOoWnf3ARS/ZLOS4QwWjfwtY29mfCOU4+6pIoIInPoL0gea2bKcMWY3AvxIco6 8YrxkmkfMfbxgDI6QBgDMVsjYCEVj16OIkUpZFXvVb8jTdcjPjGS1ky0TXwQCUNy OTY+qa6vRYNyyqG/KSuFCxZdFri9jXZdOTeSmr3BJhlLQgn8St0yr4ybgfi1dgtR 6zL6//c6lZfNyadWV+mZWieyKG9y+JyRBDr/7YyXvbniZpm9shDxVvG6qXvQi3Al w/thJ1pS1RdeP7LBEkrR290D37bFd2PaTUpZ8mbQVhXamaBBMEUDw/ZDGBqEe7Cg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrvdegiedgkeelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpeffhffvuffkfhggtggujgesthdtre dttddtvdenucfhrhhomhepnfgvohcuhfgrmhhulhgrrhhiuceolhgvohesfhgrmhhulhgr rhhirdhnrghmvgeqnecuggftrfgrthhtvghrnhepheegfedvkefgudeuheejtdejtddvie ehleekvefhledvjeevffdtveelveegieejnecuffhomhgrihhnpehgnhhurdhorhhgpdhg ihhthhhusgdrtghomhenucfkphepuddttddruddurdduieelrdduudeknecuvehluhhsth gvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheplhgvohesfhgrmhhulhgr rhhirdhnrghmvg X-ME-Proxy: Received: from localhost (pool-100-11-169-118.phlapa.fios.verizon.net [100.11.169.118]) by mail.messagingengine.com (Postfix) with ESMTPA; Sun, 9 May 2021 11:17:29 -0400 (EDT) Date: Sun, 9 May 2021 11:17:27 -0400 From: Leo Famulari Message-ID: References: <20210506163511.GB27260@dm9.info> <20210509123700.GA5323@dm9.info> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210509123700.GA5323@dm9.info> X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+larch=yhetil.org@gnu.org Sender: "Guix-patches" X-Migadu-Flow: FLOW_IN ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1620573666; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:resent-cc:resent-from:resent-sender: resent-message-id:in-reply-to:in-reply-to:references:references: list-id:list-help:list-unsubscribe:list-subscribe:list-post: dkim-signature; bh=Y0jtdb2UpV/PhgHC1j1wAw+Dc71cMhghHUqh6spVxzs=; b=KT0ZrKT2EHWzMsgsoTYjEi/7Uj6qZhIvKrOGrE3NSIR6OzOnfVobSWDrJYA1cI51roCaPS D8GrV54AtJva9kEETrzAlvauMFMGuCjFULwJsxKj74wzWkRDq34C3jBp2QIPkgGAlXpO/A kQSfnIwg4YLLHmBMJV/OyNOA/4NAkNmghdmaUoAj19KUbJiDBR1kUa1r7D9h7UIjJkfbdi Y7bh9D2QCpK5l4gW5DQ2kXIfjJHIwksvjpZI/IYg2mak2XOHE5LlGYsMOLYZ0fHqQoFU7v 9qJ/vCPYQS3gOuizRIz5hZXEmJMjhoAVO/74mTMuy1JcZc4viO6ouJz5GiLJJw== ARC-Seal: i=1; s=key1; d=yhetil.org; t=1620573666; a=rsa-sha256; cv=none; b=vDaK3ciVOgrlvN2PM/oLPyVn1Av9Xv6EkbZW/qlglcqoqW/5lasnGG2FSrRePqjYJOOu9+ 5Gsm9YqGTZ8FrkIFcgz0acZMcFBURKu5tUQoR+0WkJg2p58Fsvo01U0OKkGc6siFvoF5xw sr5cFsEQVrjA3hMa0PBhCbqO9rDaNGjKpDVKZ4tZMFkVCaU0xT3bqm14rwM13Ho1h9jLGu dVfnZANqF7e0Tyoox+fo1gHDTJ9LT7+I0f1zMskZuRB66zvuAD6Ej3jpUD1JYw7VOecFyu UXTlCYRQed2UDzn7IVDV+k7V0t6j0hH7/pZjXPmShQWK2/0XUl38TOS9kwRyow== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=famulari.name header.s=mesmtp header.b=Lrb9lSM7; dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm2 header.b=PEW79gKv; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-patches-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-patches-bounces@gnu.org X-Migadu-Spam-Score: -1.45 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=famulari.name header.s=mesmtp header.b=Lrb9lSM7; dkim=fail ("headers rsa verify failed") header.d=messagingengine.com header.s=fm2 header.b=PEW79gKv; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-patches-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-patches-bounces@gnu.org X-Migadu-Queue-Id: 511D510D83 X-Spam-Score: -1.45 X-Migadu-Scanner: scn0.migadu.com X-TUID: LlZWvMs1wpOq On Sun, May 09, 2021 at 08:37:00PM +0800, Dion Mendel wrote: > Is it acceptable to use bundled copies of dependencies? The manual (section > 16.6, checklist #6) says otherwise. This item, from the manual section Submitting Patches, says: "Make sure the package does not use bundled copies of software already available as separate packages." So, already, there is some wiggle room based on whether or not things are "already available as separate packages." Using bundled dependnencies is strongly discouraged and you are expected to try to avoid it. With Syncthing, there were unfixed security vulnerabilities in our package, and our go-build-system could not build later versions of Syncthing. So, until our go-build-system is overhauled [0], we'll use Syncthing's bundled dependencies. They are all free software anyways. With Go, the old distro model of "no bundling" is not idiomatic, so the future of Go in Guix may look different from how it is now. Go software typically has no concept of "versions" and every program pins its dependencies at specific Git commits. So, to unbundle everything would leave us with hundreds or thousands of versions of popular libraries. We'll have to be creative in how we deal with that. But for now, we try to unbundle. > If it's okay, this would make packaging lxd much simpler. I've had to > package around 90 Go libraries so far. > > If using lxd's bundled copies of dependencies would be accepted, then I > withdraw this patch request. Please, either try packaging them "by hand" or with the Go module importer [1]. Code reviewers will ask you to explain why you are using the bundled dependencies. [0] The work to overhaul go-build-system is progressing. [1] https://guix.gnu.org/manual/devel/en/html_node/Invoking-guix-import.html#Invoking-guix-import I guess it would be a command like: `guix import go github.com/lcx/lxd --recursive -pin-versions` But, it depends on LXD using the standard Go module mechanisms. If it doesn't, maybe each top-level dependency can be imported along with its dependency graph.