[bug#47539] [PATCH 00/28] Add gh and dependencies

[Leo Prikler <leo.prikler@student.tugraz.at>]

Am Donnerstag, den 01.04.2021, 18:25 +0200 schrieb Xinglu Chen:
> On Thu, Apr 01 2021, Xinglu Chen wrote:
> 
> > > > - When building'gh', I couldn't get
> > > >   'go-github-com-charmbracelet-glamour' to build without moving
> > > > some
> > > >   native-inputs to propagated-inputs, though, if I was only
> > > > building
> > > >   'go-github-com-charmbracelet-glamour' it would build without
> > > > moving
> > > >   things to propagated-inputs.  I am not sure why this happens.
> > > Perhaps you need to add those native inputs as native inputs to
> > > gh as
> > > well?  Try adding its native inputs to gh and see whether that
> > > changes
> > > something.
> > 
> > I will try and report back.
> 
> Adding the packages as native-inputs for github-cli fixed the
> problem.
> Thank you!
You're welcome.

> > > > - The patch marked with 'W' adds a package which is needed by
> > > > 'gh',
> > > >   but only used on Windows.  It is still Free Software (BSD-2), 
> > > > but I
> > > >   have also marked it as hidden.
> > > This is at least in some sense an acceptable workaround, but how
> > > large
> > > would the effort be to outright drop references to this package,
> > > given
> > > that it's already not "actively" being used?
> > 
> > I am not familiar with the Go ecosystem so I don't know if this
> > will be
> > possible, but I will look into it.
> 
> Compiling github-cli without the package doesn't work, and the
> package
> is used in multiple places in the source code.  I don't really know
> what
> we can do here.  Should I open an issue on their GitHub page, or just
> leave it as is?
For now, I don't think this is going to be a blocking issue, as long as
the package and the input are appropriately marked, e.g. with comments,
and we make sure not to endorse the Microsoft OS through them.  
As to how we might handle this, we could do our own investigations into
dropping the dependency, but asking a question (make sure to tag it as
such) should work as well.  Also be clear, that the goal is not
necessarily to remove the dependency altogether, but rather make it an
optional one.

After doing some quick investigations myself, I think the following
pair of substitute*s might work:
  (("github.com/cli/safeexec") "os/exec")
  (("safeexec") "exec")

Regards,
Leo