From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id UGQ1IDQwD2AdOQAA0tVLHw (envelope-from ) for ; Mon, 25 Jan 2021 20:55:16 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id kA8NHDQwD2BDEwAAB5/wlQ (envelope-from ) for ; Mon, 25 Jan 2021 20:55:16 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id ADE8F940251 for ; Mon, 25 Jan 2021 20:55:15 +0000 (UTC) Received: from localhost ([::1]:33408 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1l48tG-0001VJ-Mr for larch@yhetil.org; Mon, 25 Jan 2021 15:55:14 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:35534) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1l48nU-0000VS-AD for help-guix@gnu.org; Mon, 25 Jan 2021 15:49:16 -0500 Received: from mx07-00115501.pphosted.com ([185.132.182.48]:23322 helo=mx08-00115501.pphosted.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1l48nR-00056g-Bn for help-guix@gnu.org; Mon, 25 Jan 2021 15:49:15 -0500 Received: from pps.filterd (m0001541.ppops.net [127.0.0.1]) by mx07-00115501.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 10PKjJAj013277; Mon, 25 Jan 2021 21:49:04 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=radiofrance.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=radiofrance20190306; bh=rWxlSOYu82xkUvGUNwVC8F1Yh0HyGNmjzSk12cjwPC0=; b=qMLxlmf6hELWreIFufJib0eHRBT2By8/Z7CqtpIQz6tW+Lp+91MGD1yGqXYZUGxjzHRb h2qK1aeAsPgLC1N/TcFRWjIYrY999bZEBcH6ufQbDYVXGgcSsc9P1h3ZWSrjtctVxWTa ZlwnrBV//+1puLrNAQDB435ebB+IghvqUBlkOvhZkyhLBnSBDLPZBuGRExOArQoSVhCo zbgWOY0ONStCFZErI0UZJegFCKEHXSije8UILCSfx5PWhvqVztnd9lLSsE5/z9B64EP1 CCu8g+7k6XEbWzirNKOQ8KeRptKLomsFKRorjbWQq8DrmRdDTXMayO/pM/n10vTCAHFz aw== Received: from fra01-pr2-obe.outbound.protection.outlook.com (mail-pr2fra01on0100.outbound.protection.outlook.com [104.47.24.100]) by mx07-00115501.pphosted.com with ESMTP id 3688x93qfb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 25 Jan 2021 21:49:04 +0100 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Go3YCv3CkXL3FOsjfrVbXl/XEI8VCl3mATVx3zzCwN0BEzd6GOO423PCEIWF0e1cb1DkJxWivg+R1nnHZPXQ1EgwPqNbsWx2cXIoTS2kfrEAePqsJLJ1+EBUGditF7EDwMWq8+YGCksN6Wx17kEXCQQo/avFyIILpeG4P+3feNGSpQAxAnxQLe6Q0axC/isSA6KpAUlC/eN0CtgPsHfrEpGza3vpf4iTnLgm/ZxYhkuEQxGTTK+M6201QNh+3qGGzRL41hJ0Xj91vC51SAux4T7hV0epKFIpo7VGXy7ZKjdqUiciowyuvZkf5ZZYYL6uw45qO4pX/KYpTDkf1VdNlA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rWxlSOYu82xkUvGUNwVC8F1Yh0HyGNmjzSk12cjwPC0=; b=oFTjaYQ0petU4FwRum5oXHSPJtYNsj0EKpRis2MBowP+VrFqh4PBxHTp+HtvKB3anhPVK5KaI7sWalOiou2e8giWNXvZN3B/xAkJHh4ETb9lMPfoipfIvSTfq0UO2WQddwDmh1kaO2cyMK80wRP6rrge4NzCx9HWWaISWaxL/kWekCzkvF3N5yUjqAL24ns2ZpHMVcWR/+ne4Ynnv8sj/AmzwSXJYnZUzVB+eTgNB3fB/fQ0g/zFBWs2Y+DTxv5vsZmnUw6MVbG6Tkk9RE0r8YCWN2y2P93jK6rhmimCEHHe1h0EFztGXnolz8CsIhYPRTZtElUhKUjrE4AmF1pdvg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=radiofrance.com; dmarc=pass action=none header.from=radiofrance.com; dkim=pass header.d=radiofrance.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=RFonline.onmicrosoft.com; s=selector2-RFonline-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rWxlSOYu82xkUvGUNwVC8F1Yh0HyGNmjzSk12cjwPC0=; b=JMkL3QstJ8ovXPovefmSWWmXliYRHxQ2MzcC70rM3ukWKP+ELjHO1cywRGeUbEuu9YUPTJv77ISyePw6mXoWUNSebJeTE6dDEEMbJBXQiWcXJQqJiYxnoolKpgwsPuGEx074jHPovp0DChQYMw0vlasipA57edH8HraSMbKWJJk= Received: from PR0P264MB0425.FRAP264.PROD.OUTLOOK.COM (2603:10a6:100:b::20) by PR1P264MB1518.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:181::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3784.16; Mon, 25 Jan 2021 20:49:03 +0000 Received: from PR0P264MB0425.FRAP264.PROD.OUTLOOK.COM ([fe80::51bc:289d:ff1a:6b58]) by PR0P264MB0425.FRAP264.PROD.OUTLOOK.COM ([fe80::51bc:289d:ff1a:6b58%6]) with mapi id 15.20.3784.017; Mon, 25 Jan 2021 20:49:03 +0000 To: Helio Machado <0x2b3bfa0@gmail.com>, Timmy Douglas Subject: Re: packaging a golang package Thread-Topic: packaging a golang package Thread-Index: AQHW81uDCYzLJKaQ4EK59m1n5SprPg== Date: Mon, 25 Jan 2021 20:49:02 +0000 Message-ID: <20210125204534.ovhvt7rzj7tbqrnt@fjo-extia-HPdeb.example.avalenn.eu> References: <87h7nrud2a.fsf@timmydouglas.com> <4bdbc469-ad45-4739-b001-739ad3a60adc@www.fastmail.com> <87a6thtyvm.fsf@timmydouglas.com> <87bldw0ztb.fsf@timmydouglas.com> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [88.126.13.52] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3e553a53-2c60-4b4f-7c2b-08d8c172a629 x-ms-traffictypediagnostic: PR1P264MB1518: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4125; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: k+GqnrJiEQyXsXnEa1LxSgv8znsJGftAkA0QAlykP/t4HzBAYw/suv7OnSCH1/V2zpRUuOevYnVGRvuPLfBttEaa4icvFlyXgtpDYFHEoNF8PzldpyOCq2/iXRa9S4fEk85FVuCAt7ntujloPZEBOXXY/tAWhMlV6Dmf6j+cEt8s2xoOWYgRhODChrbg4JxcnjQexUl/xjFc77WV1dL/Qzb1z7/yKJD+VmRe9OfCYB+ELgSjbM3afsiORig61ev+Ft8CSzw7BjLJBSKZUsqCzZ8xFOaimkVkLdmwsKXT7FgF3kwkKDBjoLGlGMH1sUuCAta9G4ZAiW+SG7ShtsXe1YHpVW1OlVGuoV69++8+kbPa1PLU2xH5DWIAg7pejnWofYZkWXQjftlPvzLe77S7mFImVJq7Jb3NWsDnGVBsL+8GJX6Jyy1NDQ8i7/+PfR+yfCJKgu4KaxlTKl8/R9xv1G7mIa3nIqxlv61S3pU9HfDdIydRLMDBpp3iNo6i31k+GJPOcUNj2rRc811AzDGjcw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PR0P264MB0425.FRAP264.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(4636009)(136003)(366004)(39850400004)(346002)(396003)(376002)(3480700007)(83380400001)(9686003)(6486002)(4326008)(316002)(66946007)(1076003)(64756008)(66476007)(6512007)(76116006)(26005)(71200400001)(478600001)(66556008)(66574015)(66446008)(6506007)(8936002)(110136005)(5660300002)(86362001)(2906002)(186003)(54906003)(966005)(8676002)(6606295002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?iso-8859-1?Q?34/oa3/lofwfgSkiGhRnpXBKW5Mj54dA41EjWeHyxFaJgVhmckjBzCQktn?= =?iso-8859-1?Q?SwGg9BsW+n7CVK4sRK5kBdkovMSlSTaE/Xi7TEb/Lf4V9xOd4OskW5u+da?= =?iso-8859-1?Q?39YZUDf/dQynDlBmCMVRMqcwfHUXLFw3V70NTaFrpSDaZhsfqmkM++Ngin?= =?iso-8859-1?Q?pEIEQUqPHHe0A7Kk2I5q6FQQ48byhRrQCccWG7cayYRFIOoPXizoWc8ZCo?= =?iso-8859-1?Q?p6zXG2eOVIOVelmSsaVxaLSRWEGmWgwx7K090IR2Ux0IK0QtcNKcu3x7nh?= =?iso-8859-1?Q?fvbnfHB27W3e8ruyXOXDPpo96Nd3UU+rVe1RhnpipDJLpD3twJLXkTXz2a?= =?iso-8859-1?Q?DLgRGMqfYtlZU658Np72j7JbI0d6DCmJYACU4SzREFCNpc//POt/1RDw1k?= =?iso-8859-1?Q?W77tG/ZbYGCyUwDScylgmTlMPPRqE4KkbM7l8oscY+9KkF84zZsgYaaxFA?= =?iso-8859-1?Q?T2+/qd5AXzAF26sVxM+3+HJBx3o24K8QW0vE2Y1tJcvOoPXMPd8OKmkN4C?= =?iso-8859-1?Q?9esEAzG4NHtm86MK4+n3HmqN4dKVUw3rWPkEVzVY07kZ9yzAyMWEGTc7HS?= =?iso-8859-1?Q?7ljbtyMkqYFm+CkDo45sOVyKa2WK3Ga8zuzdoRCq7Wk/Aw9hER8glewN3J?= =?iso-8859-1?Q?aV+Rj2kaypVq0N3s3L5k6gXcm1HhxSo45+ahZYLTE8iRtV7KP+2VBFpa86?= =?iso-8859-1?Q?+p1uDU+/A26zDSMdtgM//Lp9yHLYVz9qITgzCyLmR3NXUn7F4zcw1m8Qy5?= =?iso-8859-1?Q?V+0YobiXToPBtBZFGNl8naHPIyYwgw4PPU7zz3hiXZkFetsVxDjzMl++Ho?= =?iso-8859-1?Q?W6RGHQFNGiFQiee/eYhtWpTq0YY1iRZAqL2BhcDy1jERN3p1WxpYClGEs1?= =?iso-8859-1?Q?O5N6ZE2msz870FLhqc8oVv3hC2jEzhrvUcTXCeg4c0WY5SNo96LVTVtk7g?= =?iso-8859-1?Q?jqWnz2FQjYeK2ccynfNqjH8m++pttsO7tfrE08xf0rg9zLsvwcP0B4tMB1?= =?iso-8859-1?Q?z+t9DyAX42RD2P6zTCiJaz/z/oN+wuvbhUogVJTv8Iw2AU782A4WvKIUrE?= =?iso-8859-1?Q?UgBTFPT6iYOQPi+egy+LwHyiIAsKS6D6uaO0nA4pxO9o?= Content-Type: text/plain; charset="iso-8859-1" Content-ID: <8CA583273F372E429B424B2B7E6183A1@FRAP264.PROD.OUTLOOK.COM> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: radiofrance.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PR0P264MB0425.FRAP264.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-Network-Message-Id: 3e553a53-2c60-4b4f-7c2b-08d8c172a629 X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jan 2021 20:49:03.0374 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 1d643b07-8cf5-4e2d-ad1e-86d6b948fc3b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ZxeyV608yBefjMZqSXmtyTdV3PQpoxXNrJ8kIKv1ZJkjbPhociwUeEiCh4EXwh7PdXnCMd1AG+9nFA2cfMMLbNTQ4MKeJtYKUr292tYuQj6yVfTxG0+kGrP15kAD9Yr0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR1P264MB1518 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.343, 18.0.737 definitions=2021-01-25_09:2021-01-25, 2021-01-25 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 phishscore=0 clxscore=1011 bulkscore=0 impostorscore=0 adultscore=0 priorityscore=1501 suspectscore=0 mlxlogscore=736 lowpriorityscore=0 spamscore=0 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2101250106 Received-SPF: pass client-ip=185.132.182.48; envelope-from=prvs=86595c9de9=francois.joulaud@radiofrance.com; helo=mx08-00115501.pphosted.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Mailman-Approved-At: Mon, 25 Jan 2021 15:55:03 -0500 X-BeenThere: help-guix@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Katherine Cox-Buday , "help-guix@gnu.org" Errors-To: help-guix-bounces+larch=yhetil.org@gnu.org Sender: "Help-Guix" Reply-to: =?iso-8859-1?Q?JOULAUD_Fran=E7ois?= From: Francois.JOULAUD--- via X-Migadu-Flow: FLOW_IN X-Migadu-Spam-Score: 0.65 Authentication-Results: aspmx1.migadu.com; dkim=fail ("headers rsa verify failed") header.d=radiofrance.com header.s=radiofrance20190306 header.b=qMLxlmf6; dkim=fail ("headers rsa verify failed") header.d=RFonline.onmicrosoft.com header.s=selector2-RFonline-onmicrosoft-com header.b=JMkL3Qst; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}"); dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of help-guix-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=help-guix-bounces@gnu.org X-Migadu-Queue-Id: ADE8F940251 X-Spam-Score: 0.65 X-Migadu-Scanner: scn0.migadu.com X-TUID: 9GDEZ2IGn2aN Hello, On Sun, Jan 17, 2021 at 02:31:39PM +0100, Helio Machado wrote: > Looks like it ran into the replace syntax and didn't parse it correctly? > > https://golang.org/ref/mod#go-mod-file New version of the patch on https://issues.guix.gnu.org/issue/44178#10 fixes some of those problems. There is still others bugs left but you could give it a new try. Git repo with patch applied is available at [6] > Guix seems to have a strong opinion about dependency vendoring, but it's > technically viable as long as you don't produce architecture-specific > artifacts when packaging. See https://issues.guix.info/43872 for more > information about the pitfalls I encountered while packaging go-ethereum > the fast way. It seems to me we have three possible ways to handle Go packaging. First is to use vendored dependencies (when upstream provides them). This one has the merits of simplicity (as we just have to download the source and launch `go build` or whatever is needed) and less risks of bugs. The downsides are known: difficult to audit Licences, duplication of code source, difficulty to follow security bugs, etc. Second is to re-vendor package from go.mod (coming directly from code source or synthetized from source) by creating a source derivation including all dependencies. This is the strategy followed by Nixpkgs as explained in [1]. (It seems to me this is the route followed in the patches to from Helio in [2] but I did not take the time to read them.) With this approach we still have some of the downsides of using vendored upstream but it is at least easier to verify the existence of upstream. Third is to package every dependencies. This is the most transparent way and the one that leads to less code duplication but the downside is the difficulty to scale with the number of packages (even if the objective of patch at [3] is to automate it) and the need to have only one reference version for each package in the distribution which have its own share of problems (one of them being that we don't use those tested by upstream as stated in [4]). I think Guix should support all three in its tooling to be able to support several use-cases. For inclusion of packages in Guix proper we should try the individual packaging of dependencies and see how it works. Perhaps we will need exceptions as the one Debian does for Kubernetes [5]. Perhaps we will need to fallback to vendoring or re-vendoring in more cases but we will learn as we walk. Best regards, Fran=E7ois [1]: https://github.com/NixOS/nixpkgs/issues/84826 [2]: https://github.com/0x2b3bfa0/guix-go-modules/commit/5defe897065c5d3e63= 740932b360474132c77877 [3]: https://issues.guix.gnu.org/issue/44178#10 [4]: https://github.com/NixOS/nixpkgs/issues/84826#issuecomment-616663815 [5]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D971515 [6]: https://github.com/kat-co/guix/tree/create-go-importer=