Le 2019-03-13 03:24, Ian Denhardt a écrit :
Quoting Nicolas Mailhot (2019-03-12 04:22:45)
> > In a parallel thread, a Nix developer was asking about basically the
> > same use case, and was pointed at `go build -mod=vendor`. It seems like
> > this does exactly what is wanted here -- just use the code we have
> > locally. Nicolas, does that address your use case?
>
> That's definitely *not* what we want (our processes call for removing
> vendor and its equivalents in other languages before going to the
> build step).
Not sure we're on the same page re: what was suggested. The idea is
you'd point the vendor directory at something that contains the
distro's
versions of the dependencies, and use -mod=vendor to bypass all of the
smarts around fetching modules and such.
But, again, I don't *want* a vendor directory, distro or otherwise.
vendor (and GOPATH) have always been a major PITA to assemble and
maintain (and I speak as the person, that wrote at least half of the
code that assembles and maintains them Fedora-side).
Ideally, I'd like proper shared libs, because rebuilding every dependent
on changes is an obstacle to robust security (you forget one rebuild and
poof, you're owned).
Baring that, I'd settle for a directory of modules, which was what
GOPROXY was supposed to deliver, before Go upstream embarked in its mad
crusade to squeeze out anything between dev and production.
--
Nicolas Mailhot