Hi,
It seems there might be a misunderstanding regarding the go mod why command. Please note that any transitive dependencies will not be displayed in the output. For instance, x/exp/shiny could be a transitive dependency of a direct dependency in your main module, which is why you see the message "(main module does not need package golang.org/x/exp/shiny)." To understand why dmitri.shuralyov.com/gpu/mtl is used by x/mobile, I recommend checking the source code of both x/mobile and x/exp/shiny. Xudong 在2024年7月17日星期三 UTC+8 23:42:28<Alvaro Crespo> 写道： > Hi! > > Sadly, "go mod why" doesn't really work for gomobile ( > https://cs.opensource.google/go/x/mobile) and its dependencies since they > are technically not used in my library/package. They are used at build time > to generate language bindings that make it possible to call Go functions > from Java and Objective-C. > > go mod why golang.org/x/exp/shiny > > go: downloading golang.org/x/exp v0.0.0-20190731235908-ec7cb31e5a56 > > # golang.org/x/exp/shiny > > (main module does not need package golang.org/x/exp/shiny) > > My doubt is: why is dmitri.shuralyov.com/gpu/mtl, a package for gpu use > and geometry rendering, listed as a dependency of > https://cs.opensource.google/go/x/mobile (a package to generate language > bindings to call Go functions from Java/Obj-C)? That doesn't sound right to > me. Given the widely known supply chain attacks this is something that > should be looked into, right? > > > > On Thu, Jul 11, 2024 at 9:04 PM Kurtis Rader <kra...@skepticism.us> wrote: > >> Try "go mod why $dependency"; e.g., >> >> > go mod why github.com/sourcegraph/jsonrpc2 >> # github.com/sourcegraph/jsonrpc2 >> src.elv.sh/pkg/lsp >> github.com/sourcegraph/jsonrpc2 >> >> There's also "go mod graph". >> >> On Thu, Jul 11, 2024 at 4:44 PM Alvaro Crespo <alvaro.and...@gmail.com> >> wrote: >> >>> Hi there! >>> >>> I'm not an expert go dev but I'm using >>> https://cs.opensource.google/go/x/mobile to build a domain layer for >>> both an Android and an iOS app. First of all, congrats on the good work. >>> The project is amazing. >>> >>> I recently updated the gomobile package version and found out a strange >>> looking new addition to my go.sum. Namely, this one: >>> >>> dmitri.shuralyov.com/gpu/mtl v0.0.0-20221208032759-85de2813cf6b/go.mod >>> h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= >>> >>> I researched a bit and found out Dmitri (great job!) and his package ( >>> https://dmitri.shuralyov.com/gpu/mtl). But from the description it >>> doesn't look like something the gomobile project would need to use: >>> >>> Package mtl provides access to Apple's Metal API ( >>> https://developer.apple.com/documentation/metal). >>> (...) >>> This package is in very early stages of development. The API will change >>> when opportunities for improvement are discovered; it is not yet frozen. >>> Less than 20% of the Metal API surface is implemented. Current >>> functionality is sufficient to render very basic geometry. >>> >>> Is this ok? Using *go mod graph*it appears this is a dependency of >>> *golang.org/x/exp/shiny >>> <http://golang.org/x/exp/shiny>,* which I'm also not entirely sure why >>> its included as a whole. >>> >>> Is this something that should be reported? I would love some >>> clarification on this. >>> >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "golang-nuts" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to golang-nuts...@googlegroups.com. >>> To view this discussion on the web visit >>> https://groups.google.com/d/msgid/golang-nuts/aaa96093-696e-469a-895e-9cb99c82fc58n%40googlegroups.com >>> >>> <https://groups.google.com/d/msgid/golang-nuts/aaa96093-696e-469a-895e-9cb99c82fc58n%40googlegroups.com?utm_medium=email&utm_source=footer> >>> . >>> >> >> >> -- >> Kurtis Rader >> Caretaker of the exceptional canines Junior and Hank >> > -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/cf6609d6-2102-4884-858d-d222e5a10830n%40googlegroups.com.
