Thank you! It seems I needed the refresher on CRAN policy regarding
downloading sources: it seems like the go.sum/go.mod provide sufficient
checksumming to comply with the policy, as you noted (with `go mod
vendor` as a backup if this turns out to not be acceptable). Downloading
Go is probably out based on the advice for Rust that explicitly forbids
this.
Cheers!
-dewey
On 2023-07-10 11:09, Ivan Krylov wrote:
В Thu, 06 Jul 2023 15:22:26 -0300
Dewey Dunnington <de...@dunnington.ca> пишет:
I've wrapped two of these drivers for R that seem to build and
install on MacOS, Linux, and Windows [3][4]; however, I am not sure
if the pattern I used is suitable for CRAN or whether these packages
will have to be GitHub-only for the foreseeable future.
There are a few parts to following the CRAN policy [*] regarding
external dependencies.
I think (but don't know for sure) that your package will not be allowed
to download Go by itself. The policy says: "Only as a last resort and
with the agreement of the CRAN team should a package download
pre-compiled software."
An already installed Go should be able to "first look to see if [a
dependency] is already installed and if so is of a suitable version"
when installing the dependencies of the Go part of the code. The go.mod
and go.sum files specify the exact versions and checksums of the
dependencies, which satisfies the requirement for fixed dependency
versions ("it is acceptable to download them as part of installation,
but do ensure that the download is of a fixed version rather than the
latest"), so your package seems to be fine in this respect.
One more thing: when bootstrapping the source package, can you run go
mod vendor [**] in order to bundle *all* the Go dependencies together
with the package? Is the resulting directory prohibitively large? Would
it satisfy the CRAN policy preference to "include the library sources
in the package and compile them as part of package installation"
without requiring Internet access? Unfortunately, I don't know enough
about Go to answer these questions myself. I think that a small bundle
of vendored Go code would be preferrable for CRAN but *not* preferrable
for packaging in a GNU/Linux distro like Debian where dynamic linking
(in the widest possible sense) is a strong preference.
--
Best regards,
Ivan
[*] https://cran.r-project.org/web/packages/policies.html
[**] https://go.dev/ref/mod#vendoring
______________________________________________
R-package-devel@r-project.org mailing list
https://stat.ethz.ch/mailman/listinfo/r-package-devel
