On Wed, Sep 18, 2019 at 12:28:29PM -0700, Zac Medico wrote: > On 9/18/19 11:04 AM, Alec Warner wrote: > > > > > > On Wed, Sep 18, 2019 at 10:50 AM Michael Orlitzky <m...@gentoo.org > > <mailto:m...@gentoo.org>> wrote: > > > > On 9/16/19 10:17 AM, William Hubbs wrote: > > > + > > > +# @FUNCTION: go-module_pkg_postinst > > > +# @DESCRIPTION: > > > +# Display a warning about security updates for Go programs. > > > +go-module_pkg_postinst() { > > > + ewarn "${PN} is written in the Go programming language." > > > + ewarn "Since this language is statically linked, security" > > > + ewarn "updates will be handled in individual packages and > > will be" > > > + ewarn "difficult for us to track as a distribution." > > > + ewarn "For this reason, please update any go packages asap > > when new" > > > + ewarn "versions enter the tree or go stable if you are > > running the" > > > + ewarn "stable tree." > > > +} > > > + > > > +fi > > > > > > > This word salad is 100% misinformation that gets tangled in itself > > trying to apologize for what we're about to do: > > > > * Go is not a "statically linked language." There's gccgo, and as Alec > > pointed out, the official compiler has supported dynamic linking for > > years now. > > > > > > I'm actually pretty fine with this wording, upstream has said not to > > dynamically link in these use cases. > > > > > > > > * Updating DOES NOT HELP AT ALL. That's the whole problem. You're > > trying to make it sound like we haven't thrown people under a bus, > > but saying "for this reason, please update..." is just misleading. > > > > Here's what it should say: > > > > WARNING: due to a lack of manpower/interest, Go packages on Gentoo > > are statically linked. Contrary to our existing policies and what > > the website says, Go packages will never receive any security updates > > on Gentoo. Use at your own risk! > > > > > > So if the package *maintainer* bumps each package every time it, or a > > dep has a security issue; then updating will work fine. > > I'm skeptical go maintainers are volunteering for this though. > > There's a script here which helps to automate refresh of commit hashes > in EGO_VENDOR: > > https://github.com/hsoft/gentoo-ego-vendor-update > > Just now I've used it to refresh vendored dependencies in > net-misc/drive: > > > https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3993b893d4788beaad945bc82df0f4efd91ce697
I have seen that script, and it really doesn't work for modules. it would need to parse go.mod and grab the dependencies based on the information in that file. William
signature.asc
Description: Digital signature
