Le vendredi 21 février 2020 à 15:57 +0100, Martin Sehnoutka a écrit :
Go went even further in this case and it is
to bundle all the dependencies as a source code directly in the
repository. See this repo as an example:
Since you take Go in example – vendoring (bundling) proved such a
maintenance headache upstream that Google had to create a complete new
packaging system to get rid of it. Not for Fedora or Linux people, but
because they had huge problems with unmaintained, holed and non-legal
code lurking in this kind of vendor pile.
So Go (upstream) is going away from the kind of practice you’re
advocating. And Google’s implementation of versionning in Go modules is
even stricter and more rigid than the one in rpm (precisely because
they tried the lala-lala let’s bundle everything without caring about
versions, and were badly burned).
From a technical POW, we need to improve the mapping of their packaging
system and then integrating the Go ecosystem in Fedora will be no
harder than integrating any other language component (easier, because
the language-specific package manager produces very regular sources).
From a maintenance POW dumping huge piles of unmanaged third-party code
on build farms just does not work long term. That’s why Google had to
break its vendor piles in atomic Go modules.
From a process POW, Fedora is not ready. Not because out tech does not
work but because our processes can not handle the pile of atomic
components generated by upstream practices. Since the problem is
process, not technical side, please work on the process side, instead
of trying to bypass the process with bad technical solutions.