Hi! Sadly, "go mod why" doesn't really work for gomobile ( https://cs.opensource.google/go/x/mobile) and its dependencies since they are technically not used in my library/package. They are used at build time to generate language bindings that make it possible to call Go functions from Java and Objective-C.
go mod why golang.org/x/exp/shiny go: downloading golang.org/x/exp v0.0.0-20190731235908-ec7cb31e5a56 # golang.org/x/exp/shiny (main module does not need package golang.org/x/exp/shiny) My doubt is: why is dmitri.shuralyov.com/gpu/mtl, a package for gpu use and geometry rendering, listed as a dependency of https://cs.opensource.google/go/x/mobile (a package to generate language bindings to call Go functions from Java/Obj-C)? That doesn't sound right to me. Given the widely known supply chain attacks this is something that should be looked into, right? On Thu, Jul 11, 2024 at 9:04 PM Kurtis Rader <kra...@skepticism.us> wrote: > Try "go mod why $dependency"; e.g., > > > go mod why github.com/sourcegraph/jsonrpc2 > # github.com/sourcegraph/jsonrpc2 > src.elv.sh/pkg/lsp > github.com/sourcegraph/jsonrpc2 > > There's also "go mod graph". > > On Thu, Jul 11, 2024 at 4:44 PM Alvaro Crespo < > alvaro.andres.cre...@gmail.com> wrote: > >> Hi there! >> >> I'm not an expert go dev but I'm using >> https://cs.opensource.google/go/x/mobile to build a domain layer for >> both an Android and an iOS app. First of all, congrats on the good work. >> The project is amazing. >> >> I recently updated the gomobile package version and found out a strange >> looking new addition to my go.sum. Namely, this one: >> >> dmitri.shuralyov.com/gpu/mtl v0.0.0-20221208032759-85de2813cf6b/go.mod >> h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= >> >> I researched a bit and found out Dmitri (great job!) and his package ( >> https://dmitri.shuralyov.com/gpu/mtl). But from the description it >> doesn't look like something the gomobile project would need to use: >> >> Package mtl provides access to Apple's Metal API ( >> https://developer.apple.com/documentation/metal). >> (...) >> This package is in very early stages of development. The API will change >> when opportunities for improvement are discovered; it is not yet frozen. >> Less than 20% of the Metal API surface is implemented. Current >> functionality is sufficient to render very basic geometry. >> >> Is this ok? Using *go mod graph*it appears this is a dependency of >> *golang.org/x/exp/shiny >> <http://golang.org/x/exp/shiny>,* which I'm also not entirely sure why >> its included as a whole. >> >> Is this something that should be reported? I would love some >> clarification on this. >> >> >> -- >> You received this message because you are subscribed to the Google Groups >> "golang-nuts" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to golang-nuts+unsubscr...@googlegroups.com. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/golang-nuts/aaa96093-696e-469a-895e-9cb99c82fc58n%40googlegroups.com >> <https://groups.google.com/d/msgid/golang-nuts/aaa96093-696e-469a-895e-9cb99c82fc58n%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> > > > -- > Kurtis Rader > Caretaker of the exceptional canines Junior and Hank > -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/CAGZQT_9YOPq%3DRJO7%3DoU8k1jwenyoPj%2BmWDf%3DqU2rueBw2W08ew%40mail.gmail.com.
