Re: Golang Review Swaps

2025-02-16 Thread Łukasz Wojniłowicz
On 25-02-07 22:13, Neel Chauhan wrote: Hi, I have a package awaiting review: https://bugzilla.redhat.com/show_bug.cgi?id=2342141 Could someone please review this in exchange for me reviewing another package? I want to package Retro AIM Server but need this in first. -Neel Hi, I'll try

Re: Proposal for vendoring/bundling golang packages by default

2025-02-10 Thread Kevin Kofler via devel
Mikel Olasagasti wrote: > Go-SIG has raised a ticket with FESCo [1] to propose a significant > shift in Fedora's packaging approach for Go dependencies: moving to > vendoring/bundling by default. This would represent a major departure > from our current guidelines [2]. I am opposed to this. Bundli

Golang Review Swaps

2025-02-07 Thread Neel Chauhan
Hi, I have a package awaiting review: https://bugzilla.redhat.com/show_bug.cgi?id=2342141 Could someone please review this in exchange for me reviewing another package? I want to package Retro AIM Server but need this in first. -Neel -- ___ devel

Re: Proposal for vendoring/bundling golang packages by default

2025-01-31 Thread Neal Gompa
On Fri, Jan 31, 2025 at 11:58 AM Matthew Miller wrote: > > On Fri, Jan 31, 2025 at 12:04:33AM +0100, Neal Gompa wrote: > > Right, we need a way for the build system to count the number of times > > a commit was built and export that as an rpm macro that we can use to > > make the NVR unique. > > h

Re: Proposal for vendoring/bundling golang packages by default

2025-01-31 Thread Matthew Miller
On Fri, Jan 31, 2025 at 12:04:33AM +0100, Neal Gompa wrote: > Right, we need a way for the build system to count the number of times > a commit was built and export that as an rpm macro that we can use to > make the NVR unique. https://discussion.fedoraproject.org/t/rfc-build-tag-in-rpms-nvr-nvrb/

Re: Proposal for vendoring/bundling golang packages by default

2025-01-30 Thread Neal Gompa
On Thu, Jan 30, 2025 at 11:51 PM Kevin Fenzi wrote: > > On Thu, Jan 30, 2025 at 11:13:24PM +0100, Neal Gompa wrote: > > On Thu, Jan 30, 2025 at 11:05 PM Kevin Fenzi wrote: > > > > > > On Wed, Jan 29, 2025 at 07:18:23AM -0500, Matthew Miller wrote: > > > > On Tue, Jan 21, 2025 at 08:21:26AM -0500,

Re: Proposal for vendoring/bundling golang packages by default

2025-01-30 Thread Kevin Fenzi
On Thu, Jan 30, 2025 at 11:13:24PM +0100, Neal Gompa wrote: > On Thu, Jan 30, 2025 at 11:05 PM Kevin Fenzi wrote: > > > > On Wed, Jan 29, 2025 at 07:18:23AM -0500, Matthew Miller wrote: > > > On Tue, Jan 21, 2025 at 08:21:26AM -0500, Neal Gompa wrote: > > > > If Koschei could trigger non-scratch r

Re: Proposal for vendoring/bundling golang packages by default

2025-01-30 Thread Neal Gompa
On Thu, Jan 30, 2025 at 11:05 PM Kevin Fenzi wrote: > > On Wed, Jan 29, 2025 at 07:18:23AM -0500, Matthew Miller wrote: > > On Tue, Jan 21, 2025 at 08:21:26AM -0500, Neal Gompa wrote: > > > If Koschei could trigger non-scratch rebuilds, that would go a long > > > way toward this. > > Note that kos

Re: Proposal for vendoring/bundling golang packages by default

2025-01-30 Thread Kevin Fenzi
On Wed, Jan 29, 2025 at 07:18:23AM -0500, Matthew Miller wrote: > On Tue, Jan 21, 2025 at 08:21:26AM -0500, Neal Gompa wrote: > > If Koschei could trigger non-scratch rebuilds, that would go a long > > way toward this. Note that koschei just rebuilds existing src.rpms in scratch builds. Getting it

Re: Reflecting on Rings [was Re: Proposal for vendoring/bundling golang packages by default]

2025-01-30 Thread Daniel P . Berrangé
On Thu, Jan 30, 2025 at 11:31:33AM +0300, Benson Muite wrote: > On Wed, Jan 29, 2025, at 3:56 PM, Matthew Miller wrote: > > On Wed, Jan 22, 2025 at 09:51:28AM +, Daniel P. Berrangé wrote: > > What do we gain from building, say, Inkscape ourselves — other than allowing > > us to check the boxes

Re: Reflecting on Rings [was Re: Proposal for vendoring/bundling golang packages by default]

2025-01-30 Thread Benson Muite
On Wed, Jan 29, 2025, at 3:56 PM, Matthew Miller wrote: > On Wed, Jan 22, 2025 at 09:51:28AM +, Daniel P. Berrangé wrote: >> While the ring idea as presented there didn't come to exist inside >> Fedora as a community, I think we can see that concept has indeed >> grown up outside Fedora. > > Ye

Reflecting on Rings [was Re: Proposal for vendoring/bundling golang packages by default]

2025-01-29 Thread Matthew Miller
On Wed, Jan 22, 2025 at 09:51:28AM +, Daniel P. Berrangé wrote: > While the ring idea as presented there didn't come to exist inside > Fedora as a community, I think we can see that concept has indeed > grown up outside Fedora. Yes, 100%. This was already happening when I made the Rings propos

Re: Proposal for vendoring/bundling golang packages by default

2025-01-29 Thread Matthew Miller
On Tue, Jan 21, 2025 at 02:13:02PM +, Zbigniew Jędrzejewski-Szmek wrote: > At the fundamental level, such automation would effectively do two > steps: > 1. create a no-change commit like we do now, > 2. push the commit and fire off a build. > > (I think we want to keep 1. unchanged. We need to

Re: Proposal for vendoring/bundling golang packages by default

2025-01-29 Thread Matthew Miller
On Tue, Jan 21, 2025 at 08:21:26AM -0500, Neal Gompa wrote: > If Koschei could trigger non-scratch rebuilds, that would go a long > way toward this. This is what draft builds are for, isn't it? https://docs.pagure.org/koji/release_notes/release_notes_1.34/#draft-builds -- Matthew Miller Fedo

Re: Proposal for vendoring/bundling golang packages by default

2025-01-26 Thread Fabio Valentini
us quo that could benefit other languages where the usual way of > > > dealing with dependencies is incompatible with distributions. > > > You are aware that 1) this request is explicitly targeting Golang > > packages only, and 2) building with vendored dependencies is *alrea

Re: Proposal for vendoring/bundling golang packages by default

2025-01-25 Thread Jan Drögehoff
pendencies is incompatible with distributions. > > You are aware that 1) this request is explicitly targeting Golang > packages only, and 2) building with vendored dependencies is *already* > allowed (regardless of language ecosystem) when not doing so would > place an undue mainten

Re: Proposal for vendoring/bundling golang packages by default

2025-01-25 Thread Fabio Valentini
ware that 1) this request is explicitly targeting Golang packages only, and 2) building with vendored dependencies is *already* allowed (regardless of language ecosystem) when not doing so would place an undue maintenance burden on the packager? In particular, with zig stuff, I doubt that it'

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Fabio Valentini
On Thu, Jan 23, 2025 at 12:32 AM Richard W.M. Jones wrote: > > I don't think supply chain security was really mentioned in the thread > yet (apologies if it was - I only scanned it). > > There's a real danger that if we forgo responsibility for reviewing > packages to another project, then someone

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Richard W.M. Jones
I don't think supply chain security was really mentioned in the thread yet (apologies if it was - I only scanned it). There's a real danger that if we forgo responsibility for reviewing packages to another project, then someone can add a bad package to that other project and it becomes a problem f

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Zbigniew Jędrzejewski-Szmek
language tool" needs to learn how to compile libraries. Heck, it even needs to detect if libraries are available on the system and do other ./configure-like tasks. And sadly, this is usually the moment where those "language specific tools" are not nice and shiny anymore, and the job that they

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Fabio Valentini
On Wed, Jan 22, 2025 at 3:08 PM Jan Drögehoff wrote: > > Fabio Valentini wrote: > > On Wed, Jan 22, 2025 at 10:52 AM Daniel P. Berrangé berra...@redhat.com > > wrote: > > > An increasingly large part of the ecosystem is working and deploying > > > a way that Fedora (and derivative distros) are re

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Jan Drögehoff
Fabio Valentini wrote: > On Wed, Jan 22, 2025 at 10:52 AM Daniel P. Berrangé berra...@redhat.com wrote: > > An increasingly large part of the ecosystem is working and deploying > > a way that Fedora (and derivative distros) are relegated to only > > delivering what's illustrated as Ring 1. This is

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Daniel P . Berrangé
On Wed, Jan 22, 2025 at 01:27:09PM +0100, Fabio Valentini wrote: > On Wed, Jan 22, 2025 at 10:52 AM Daniel P. Berrangé > wrote: > > > > An increasingly large part of the ecosystem is working and deploying > > a way that Fedora (and derivative distros) are relegated to only > > delivering what's i

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Fabio Valentini
On Wed, Jan 22, 2025 at 10:52 AM Daniel P. Berrangé wrote: > > An increasingly large part of the ecosystem is working and deploying > a way that Fedora (and derivative distros) are relegated to only > delivering what's illustrated as Ring 1. This is especially the case > in the CoreOS/SilverBlue s

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Zbigniew Jędrzejewski-Szmek
On Wed, Jan 22, 2025 at 09:51:28AM +, Daniel P. Berrangé wrote: > An increasingly large part of the ecosystem is working and deploying > a way that Fedora (and derivative distros) are relegated to only > delivering what's illustrated as Ring 1. This is especially the case > in the CoreOS/Silver

Re: Proposal for vendoring/bundling golang packages by default

2025-01-22 Thread Daniel P . Berrangé
On Tue, Jan 21, 2025 at 12:49:17PM +, Zbigniew Jędrzejewski-Szmek wrote: > On Mon, Jan 20, 2025 at 04:24:28PM +0100, Miroslav Suchý wrote: > > Dne 20. 01. 25 v 11:29 dop. Michael J Gruber napsal(a): > > > There is a second point to that, and that is Fedora as a development > > > platform (not j

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Fabio Valentini
On Tue, Jan 21, 2025 at 9:07 PM Zbigniew Jędrzejewski-Szmek wrote: > > Consider https://kojipkgs.fedoraproject.org/mass-rebuild/f42-failures.html: > there are 7 failed rust packages there. Part of the reason is that > by not bundling we don't have a long tail of old versions stashed > in other pro

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Zbigniew Jędrzejewski-Szmek
big hand in all the packages within the ecosystem". If the critical threshold of packagers active in the ecosystem is met, then this works quite well. Consider https://kojipkgs.fedoraproject.org/mass-rebuild/f42-failures.html: there are 7 failed rust packages there. Part of the reason is that by

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Zbigniew Jędrzejewski-Szmek
On Tue, Jan 21, 2025 at 09:22:37AM -0500, Neal Gompa wrote: > On Tue, Jan 21, 2025 at 9:14 AM Zbigniew Jędrzejewski-Szmek > wrote: > > > > On Tue, Jan 21, 2025 at 02:09:51PM +0100, Fabio Valentini wrote: > > > Workflow with non-vendored dependencies: > > > - update library or backport fix > > > -

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Zbigniew Jędrzejewski-Szmek
On Tue, Jan 21, 2025 at 03:42:22PM +0100, Miroslav Suchý wrote: > Dne 21. 01. 25 v 3:13 odp. Zbigniew Jędrzejewski-Szmek napsal(a): > > At the fundamental level, such automation would effectively do two > > steps: > > 1. create a no-change commit like we do now, > > 2. push the commit and fire off

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Jan Drögehoff
Fabio Valentini wrote: > On Tue, Jan 21, 2025 at 5:13 PM Jan Drögehoff sentrycraft...@gmail.com wrote: > > What is a "reasonable" language ecosystem here? > > Rust sure isn't, I can see at least 6 (0.9, 0.11, 0.12, 0.13, 0.14, 0.15) > > versions of the rust-hashbrown package in Fedora 41 which all

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Fabio Valentini
On Tue, Jan 21, 2025 at 5:13 PM Jan Drögehoff wrote: > > What is a "reasonable" language ecosystem here? > Rust sure isn't, I can see at least 6 (0.9, 0.11, 0.12, 0.13, 0.14, 0.15) > versions of the rust-hashbrown package in Fedora 41 which all need to be > maintained separately and if someone w

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Maxwell G
On 1/21/25 8:00 AM, Zbigniew Jędrzejewski-Szmek wrote: On Mon, Jan 20, 2025 at 11:20:50AM +, Daniel P. Berrangé wrote: I understand that these are challenges, and they are increasing because there are so many upcoming ecosystems which build their own distribution channels and tools, be it Go

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Jan Drögehoff
Zbigniew Jędrzejewski-Szmek wrote: > we should allow bundling for consistency, and I also disagree with the > reasoning raised by other people that we must _not_ allow bundling because > that'll create a slippery slope to use it everywhere. Bundling has been done very conservatively up to this poi

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Fabio Valentini
On Tue, Jan 21, 2025 at 4:45 PM Maxwell G wrote: > > On 1/21/25 7:09 AM, Fabio Valentini wrote: > >> But rebuilds can be automated. Generating patches for vendored > >> dependencies may be possible to some extent (but of course the vendored > >> package variants could have diverging versions). A

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Maxwell G
On 1/21/25 7:09 AM, Fabio Valentini wrote: But rebuilds can be automated. Generating patches for vendored dependencies may be possible to some extent (but of course the vendored package variants could have diverging versions). And then you have to integrate the patch somehow so that it is appli

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Maxwell G
the development phase used for migration and retiring packages that may no longer fit within the updated framework. On a related note, I recently highlighted how the introduction of Golang 1.24 has caused significant breakage in over 200 packages [3], an issue that underscores the urgency of a

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Miroslav Suchý
Dne 21. 01. 25 v 3:13 odp. Zbigniew Jędrzejewski-Szmek napsal(a): At the fundamental level, such automation would effectively do two steps: 1. create a no-change commit like we do now, 2. push the commit and fire off a build. Packit team want to do this for some time. Unfortunately, it did not

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Neal Gompa
On Tue, Jan 21, 2025 at 9:14 AM Zbigniew Jędrzejewski-Szmek wrote: > > On Tue, Jan 21, 2025 at 02:09:51PM +0100, Fabio Valentini wrote: > > Workflow with non-vendored dependencies: > > - update library or backport fix > > - submit rebuilds of dependent applications (with rpmautospec, those > > are

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Zbigniew Jędrzejewski-Szmek
On Tue, Jan 21, 2025 at 02:09:51PM +0100, Fabio Valentini wrote: > Workflow with non-vendored dependencies: > - update library or backport fix > - submit rebuilds of dependent applications (with rpmautospec, those > are no-change commits) > > Workflow with vendored dependencies: > - check out appl

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Zbigniew Jędrzejewski-Szmek
On Mon, Jan 20, 2025 at 11:20:50AM +, Daniel P. Berrangé wrote: > > I understand that these are challenges, and they are increasing because > > there are so many upcoming ecosystems which build their own distribution > > channels and tools, be it Go, Rust, Julia, even Python to some degree > >

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Zbigniew Jędrzejewski-Szmek
On Tue, Jan 21, 2025 at 02:30:48PM +0100, Miroslav Suchý wrote: > Dne 21. 01. 25 v 1:49 odp. Zbigniew Jędrzejewski-Szmek napsal(a): > > Let's not try to revive this. The ring idea is very very dead. Nobody > > ever provided any coherent specification of how it could work. > > And in the mean time,

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Fabio Valentini
On Tue, Jan 21, 2025 at 2:30 PM Stephen Smoogen wrote: > > 1. Koschei is under resourced and turning it on for every package would > pretty much make it a 'why is nothing working in Fedora' like every other > good idea we add to the build system. > 2. Getting it resourced would require planning

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Miroslav Suchý
Dne 21. 01. 25 v 1:49 odp. Zbigniew Jędrzejewski-Szmek napsal(a): Let's not try to revive this. The ring idea is very very dead. Nobody ever provided any coherent specification of how it could work. And in the mean time, Copr grew up in outer ring of Fedora. :) -- Miroslav Suchy, RHCA Red Hat,

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Stephen Smoogen
On Tue, 21 Jan 2025 at 08:16, Michael Catanzaro wrote: > On Tue, Jan 21 2025 at 05:13:07 AM -05:00:00, Neal Gompa > wrote: > > We know it's possible because this is how openSUSE works today. They > > never schedule mass builds because they always happen automatically > > with the right condition

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Fabio Valentini
On Tue, Jan 21, 2025 at 2:23 PM Michael Catanzaro wrote: > > On Tue, Jan 21 2025 at 05:13:07 AM -05:00:00, Neal Gompa > wrote: > > We know it's possible because this is how openSUSE works today. They > > never schedule mass builds because they always happen automatically > > with the right condit

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Neal Gompa
On Tue, Jan 21, 2025 at 8:16 AM Michael Catanzaro wrote: > > On Tue, Jan 21 2025 at 05:13:07 AM -05:00:00, Neal Gompa > wrote: > > We know it's possible because this is how openSUSE works today. They > > never schedule mass builds because they always happen automatically > > with the right condit

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Michael Catanzaro
On Tue, Jan 21 2025 at 05:13:07 AM -05:00:00, Neal Gompa wrote: We know it's possible because this is how openSUSE works today. They never schedule mass builds because they always happen automatically with the right conditions, so it's a non-event. This is the direction we should be going, but b

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Zbigniew Jędrzejewski-Szmek
quires only *one* package to be > changed, and applications that statically link the library can be > rebuilt against the new version without requiring any spec changes. (That whole message is worth rereading a few times. It is very balanced and describes the tradeoffs.) We have at least two

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Fabio Valentini
On Tue, Jan 21, 2025 at 11:08 AM Florian Weimer wrote: > > * Gerd Hoffmann: > > >> We would also need to consider what our committement is to security > >> updates when apps are bundling stuff, as the same reasons that make > >> unbundling huard, also make fixing security issues hard. > > > > Note

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Zbigniew Jędrzejewski-Szmek
On Mon, Jan 20, 2025 at 04:24:28PM +0100, Miroslav Suchý wrote: > Dne 20. 01. 25 v 11:29 dop. Michael J Gruber napsal(a): > > There is a second point to that, and that is Fedora as a development > > platform (not just as an "app" platform). If we expect developers to > > install dependencies of the

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Neal Gompa
On Tue, Jan 21, 2025 at 4:58 AM Florian Weimer wrote: > > * Gerd Hoffmann: > > >> We would also need to consider what our committement is to security > >> updates when apps are bundling stuff, as the same reasons that make > >> unbundling huard, also make fixing security issues hard. > > > > Note

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Florian Weimer
* Gerd Hoffmann: >> We would also need to consider what our committement is to security >> updates when apps are bundling stuff, as the same reasons that make >> unbundling huard, also make fixing security issues hard. > > Note that in the go/rust world the unbundling does *not* make security > up

Re: Proposal for vendoring/bundling golang packages by default

2025-01-21 Thread Gerd Hoffmann
Hi, > We would also need to consider what our committement is to security > updates when apps are bundling stuff, as the same reasons that make > unbundling huard, also make fixing security issues hard. Note that in the go/rust world the unbundling does *not* make security updates much easier.

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Fabio Alessandro Locati via devel
On Mon, Jan 20, 2025, at 21:27, Fabio Valentini wrote: > That said, reading other posts in this thread, I just don't think this > is a good model for *all* "non-ELF" languages, and it shouldn't serve > as a precedent. > The Go ecosystem is a little bit special, in that there is no package > manager

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Mikel Olasagasti
752 packages to be installed to build the package of which 629 are golang-*-devel packages. For example, doctl's go.mod file defines 3 indirect dependencies in the containerd modules (console, containerd, and log). However, for Fedora, at least 16 containerd modules would need to be included (

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Fabio Valentini
gt; > If this proposal gains consensus, we could aim to implement the change > as part of Fedora 43, with the development phase used for migration > and retiring packages that may no longer fit within the updated > framework. > > On a related note, I recently highlighted how the intro

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Stephen Smoogen
d represent a major departure > > from our current guidelines [2]. > > > [1] https://pagure.io/fesco/issue/3330 > > [2] > https://docs.fedoraproject.org/en-US/packaging-guidelines/Golang/#_bundled_or_unbundled > > What's the benefit of vendoring over a build system

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Björn Persson
Mikel Olasagasti wrote: > Hau idatzi du Michael J Gruber (m...@fedoraproject.org) erabiltzaileak > (2025 urt. 20(a), al. (11:29)): > > > On a related note, I recently highlighted how the introduction of > > > Golang 1.24 has caused significant breakage in over 200 packages

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Benson Muite
On Mon, Jan 20, 2025, at 6:24 PM, Miroslav Suchý wrote: > Dne 20. 01. 25 v 11:29 dop. Michael J Gruber napsal(a): >> There is a second point to that, and that is Fedora as a development >> platform (not just as an "app" platform). If we expect developers to >> install dependencies of their projec

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Miroslav Suchý
Dne 20. 01. 25 v 11:29 dop. Michael J Gruber napsal(a): There is a second point to that, and that is Fedora as a development platform (not just as an "app" platform). If we expect developers to install dependencies of their project via the ecosystem tools (pip, ...) locally (envs, containers) and

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Mikel Olasagasti
ly: Do you intend to > discourage/disallow "not bundling", or packaging dependencies? Packages with minimal dependencies could still be maintained, but those with a complex dependency chain would be discouraged. For instance, if a package relies on golang-x-* modules and pkg/errors fo

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Carlos Rodriguez-Fernandez
These are all great points. I also second the Golang change. However, just to clarify, Go and Rust both generate ELF binaries as well, but Golang is not comparable to the some of the other examples mentioned. If you have a vulnerability in a package in Python, for example, you can deliver one

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Florian Weimer
ps://pagure.io/fesco/issue/3330 > [2] > https://docs.fedoraproject.org/en-US/packaging-guidelines/Golang/#_bundled_or_unbundled What's the benefit of vendoring over a build system that supports offline builds against un-vendored dependencies? I expect Konflux <https://konflu

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Daniel P . Berrangé
On Mon, Jan 20, 2025 at 11:29:55AM +0100, Michael J Gruber wrote: > Mikel Olasagasti venit, vidit, dixit 2025-01-20 08:02:18: > > Hi, > > > > Go-SIG has raised a ticket with FESCo [1] to propose a significant > > shift in Fedora's packaging approach for Go dependencies: moving to > > vendoring/bun

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Michael J Gruber
with the development phase used for migration > and retiring packages that may no longer fit within the updated > framework. How would packages "not fit"? By not bundling, i.e. by following our packaging guidelines so far? To put it differently: Do you intend to discourage/

Re: Proposal for vendoring/bundling golang packages by default

2025-01-20 Thread Jan Drögehoff
I'm generally in favor of this, especially since it would establish a status quo that could benefit other languages where the usual way of dealing with dependencies is incompatible with distributions. -- ___ devel mailing list -- devel@lists.fedoraproj

Proposal for vendoring/bundling golang packages by default

2025-01-19 Thread Mikel Olasagasti
tiring packages that may no longer fit within the updated framework. On a related note, I recently highlighted how the introduction of Golang 1.24 has caused significant breakage in over 200 packages [3], an issue that underscores the urgency of addressing these challenges. We invite all Fedo

F42 Change Proposal: Golang 1.24 (system-wide)

2024-12-12 Thread Aoife Moloney via devel-announce
Wiki - https://fedoraproject.org/wiki/Changes/golang1.24 Discussion Thread - https://discussion.fedoraproject.org/t/f42-change-proposal-golang-1-24-system-wide/139537 This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals

Take ownership of golang-github-petermattis-goid

2024-11-18 Thread Kai A. Hiller
Hello, I want to take ownership of /golang-github-petermattis-goid/. It got retied, because it was orphaned for 6+ weeks. The re-review bug is https://bugzilla.redhat.com/show_bug.cgi?id=2326926 Best wishes Kai -- ___ devel mailing list -- devel

Re: Orphaning golang-helm-3

2024-07-30 Thread Carlos Rodriguez-Fernandez
Thank you Mikel, indeed, for keeping helm available in Fedora. On 7/30/24 9:02 AM, Davide Cavalca wrote: On 2024-07-27 09:03, Davide Cavalca wrote: Hey folks, I have orphaned golang-helm-3. The package currently fails to build due to broken dependencies, and in general it's been p

Re: Orphaning golang-helm-3

2024-07-30 Thread Davide Cavalca
On 2024-07-27 09:03, Davide Cavalca wrote: Hey folks, I have orphaned golang-helm-3. The package currently fails to build due to broken dependencies, and in general it's been pretty painful to keep in working shape. While it'd be nice to continue having Helm in Fedora, I don'

Re: Orphaning golang-helm-3

2024-07-27 Thread Mikel Olasagasti
I created a vendored version with different name to replace golang-helm-3 if approved: https://bugzilla.redhat.com/show_bug.cgi?id=2300201 Regards, Mikel Hau idatzi du Davide Cavalca (dcava...@fedoraproject.org) erabiltzaileak (2024 uzt. 27(a), lr. (18:04)): > > Hey folks, > > I h

Orphaning golang-helm-3

2024-07-27 Thread Davide Cavalca
Hey folks, I have orphaned golang-helm-3. The package currently fails to build due to broken dependencies, and in general it's been pretty painful to keep in working shape. While it'd be nice to continue having Helm in Fedora, I don't think this is maintainable in its current

F41 Change Proposal: Golang 1.23 (System-Wide)

2024-05-31 Thread Aoife Moloney
Wiki - https://fedoraproject.org/wiki/Changes/golang1.23 Discussion Thread - https://discussion.fedoraproject.org/t/f41-change-proposal-golang-1-23-system-wide/118631 This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals

Re: Golang bundled() Provides generator

2024-04-02 Thread Maxwell G
On Tue Apr 2, 2024 at 17:16 +0200, Dan Čermák wrote: > Hi Maxwell & Go SIG, Hi Dan, Thank you for reaching out! > we have recently started working on introducing a bundled() provides > generator for golang in openSUSE and found a very simple solution using > the output of `go

Re: Golang bundled() Provides generator

2024-04-02 Thread Dan Čermák
Hi Maxwell & Go SIG, we have recently started working on introducing a bundled() provides generator for golang in openSUSE and found a very simple solution using the output of `go version -m /path/to/binary` [1] The solution is of course only that simple, because we build more or less al

Orphaning golang-github-apache-arrow

2024-02-20 Thread W. Michael Petullo
I have decided to orphan golang-github-apache-arrow. -- Mike :wq -- ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en

Orphaning golang-gocloud

2024-02-07 Thread W. Michael Petullo
In order to preserve my energy as I maintain hugo and its multitude of Go dependencies, I have decided to deactivate Hugo's deploy feature. This means I can drop the need for golang-gocloud, which I will also orphan. The golang-gocloud package has been hard to maintain for some time. It reli

F40 Change Proposal: Golang 1.22 (System-Wide)

2023-12-20 Thread Aoife Moloney
ing Committee. == Summary == Update of Go (golang package) to the upcoming version 1.22 in Fedora 40. == Owner == * Name: [[User:alexsaezm| Alejandro Sáez Morollón]] * Email: a...@redhat.com == Detailed Description == Update of Go (golang package) to the upcoming version 1.22 in Fedora 40. Go 1.22

Re: Strange(?) build failures for golang package

2023-10-11 Thread Fabio Valentini
m trying to update go-task for some time now and consistently getting > a build error/failure with no clear indication of what's happened: > > https://download.copr.fedorainfracloud.org/results/fuller/test-builds/fedora-rawhide-x86_64/06508072-golang-github-task/builder-live.log.gz >

Re: Strange(?) build failures for golang package

2023-10-11 Thread Jakub Čajka
Oct 11, 2023, 14:02 by ful...@fedoraproject.org: > I am trying to update go-task for some time now and consistently getting a > build error/failure with no clear indication of what's happened: > https://download.copr.fedorainfracloud.org/results/fuller/test-builds/fedora-rawhide-x8

Strange(?) build failures for golang package

2023-10-11 Thread Mark E. Fuller
I am trying to update go-task for some time now and consistently getting a build error/failure with no clear indication of what's happened: https://download.copr.fedorainfracloud.org/results/fuller/test-builds/fedora-rawhide-x86_64/06508072-golang-github-task/builder-live.log.gz Is it pos

Re: orphaning prometheus* and some other golang packages

2023-10-07 Thread fuller
gt; back during the golang scramble after an unresponsive maintainer. > I don't have the time or the interest (or the technical chops) to > maintain them. > > Obviously these are important packages, so at this time I am announcing > my intention to orphan them. > Unless I hear f

Re: orphaning prometheus* and some other golang packages

2023-10-07 Thread Mikel Olasagasti
Hi Mark, Hau idatzi du Mark E. Fuller (ful...@fedoraproject.org) erabiltzaileak (2023 urr. 7(a), lr. (12:22)): > > Hi all, > > I picked up a number of prometheus packages (see below) a few months > back during the golang scramble after an unresponsive maintainer. > I don'

orphaning prometheus* and some other golang packages

2023-10-07 Thread Mark E. Fuller
Hi all, I picked up a number of prometheus packages (see below) a few months back during the golang scramble after an unresponsive maintainer. I don't have the time or the interest (or the technical chops) to maintain them. Obviously these are important packages, so at this time

Review-swap: trivial golang package to update nats stack

2023-09-12 Thread Mark E. Fuller
I'd like to offer to swap reviews to get golang-github-nats-io-jwt-2 https://bugzilla.redhat.com/show_bug.cgi?id=2237326 into Rawhide We already have v1 and attempting to update that package in order to upgrade the nats stack led to some breakage and headaches a few months ago Thank

Re: Making sense of golang packaging guidelines

2023-07-20 Thread Carlos Rodriguez Fernandez
Hi Fabio, Robert-André, Thank you for the explanation. It makes sense. Golang has this uniqueness about libs that removes some of the shared objects pros but I see there are other things at play. Thank you, Carlos. On Thu, Jul 20, 2023 at 1:44 PM wrote: > On 7/20/23 8:20 PM, Carlos Rodrig

Re: Making sense of golang packaging guidelines

2023-07-20 Thread zebob . m
On 7/20/23 8:20 PM, Carlos Rodriguez Fernandez wrote: Hi all, I am interested in packaging some golang programs for Fedora (and EPEL), and I read through the guidelines: https://docs.fedoraproject.org/en-US/packaging-guidelines/Golang/ <https://docs.fedoraproject.org/en-US/packag

Re: Making sense of golang packaging guidelines

2023-07-20 Thread Fabio Valentini
On Thu, Jul 20, 2023 at 8:22 PM Carlos Rodriguez Fernandez wrote: > > Hi all, > > I am interested in packaging some golang programs for Fedora (and EPEL), and > I read through the guidelines: > https://docs.fedoraproject.org/en-US/packaging-guidelines/Golang/ > > My qu

Making sense of golang packaging guidelines

2023-07-20 Thread Carlos Rodriguez Fernandez
Hi all, I am interested in packaging some golang programs for Fedora (and EPEL), and I read through the guidelines: https://docs.fedoraproject.org/en-US/packaging-guidelines/Golang/ My question is more about the reasoning for the recommended handling of dependencies. Other language platforms

Re: untagging golang-github-nats-io-jwt from rawhide

2023-06-09 Thread Kevin Fenzi
On Fri, Jun 09, 2023 at 01:02:20PM +0200, Mikel Olasagasti wrote: > Hi all, > > TL;DR: Would it be possible to untag > golang-github-nats-io-jwt-2.4.1-1.fc39[1] from rawhide? Yes, but... we really try and avoid that if it's gone out in a compose. If it's gone out, use

untagging golang-github-nats-io-jwt from rawhide

2023-06-09 Thread Mikel Olasagasti
Hi all, TL;DR: Would it be possible to untag golang-github-nats-io-jwt-2.4.1-1.fc39[1] from rawhide? Some days ago golang-github-nats-io-jwt was bumped from 1.2.2 version to 2.4.1. The new version doesn't provide "golang(github.com/nats-io/jwt)" and is causing a dependency chain

Re: Stuck package - golang-github-prometheus-node-exporter

2023-05-10 Thread Mark E. Fuller
I'll try to push this along - there's a build error that needs resolving (but not at 2:30 AM) see https://bugzilla.redhat.com/show_bug.cgi?id=2112130 Anyone from the golang list want to take a look? -fuller On 02/05/2023 19:25, Pat Riehecky wrote: golang-github-prometheus-node-expo

Stuck package - golang-github-prometheus-node-exporter

2023-05-02 Thread Pat Riehecky
golang-github-prometheus-node-exporter seems to be unmaintained at this point. There are a few open CVEs that have been corrected upstream in the last year but not made it down to the fedora package. In Feb I opened a maintainer check ticket : https://bugzilla.redhat.com/show_bug.cgi?id

orphaning golang-github-exoscale-egoscale

2023-03-28 Thread Carl George
I just orphaned golang-github-exoscale-egoscale. I'm no longer interested in maintaining it. It's up for grabs for any interested parties. Do note that currently it fails to install in F39 [0] because one of its dependencies was retired [1], so that will need to be sorted out t

Re: F39 proposal: Mass Retire Golang Leaves (Self-Contained Change proposal)

2023-02-02 Thread Maxwell G via devel
elease} Requires: golist +Requires: blocker %ifarch %{golang_arches} Requires: golang Provides: compiler(golang) Provides: compiler(go-compiler) = 2 -Obsoletes: go-compilers-golang-compiler < %{version}-%{release} +Obsoletes: go-compilers-golang-compiler < %{?epoch:%{epoch}:}%{vers

Re: F39 proposal: Mass Retire Golang Leaves (Self-Contained Change proposal)

2023-02-02 Thread Maxwell G via devel
On Fri Feb 3, 2023 at 02:00 +0100, Miro Hrončok wrote: > On 02. 02. 23 17:06, Ben Cotton wrote: > > # Create a blank ''blocker'' package that Conflicts with the to be > > removed packages. > > # Create a new Copr with the blocker package in its default buildroot. > > This will simulate the actual r

Re: F39 proposal: Mass Retire Golang Leaves (Self-Contained Change proposal)

2023-02-02 Thread Miro Hrončok
On 02. 02. 23 17:06, Ben Cotton wrote: # Create a blank ''blocker'' package that Conflicts with the to be removed packages. # Create a new Copr with the blocker package in its default buildroot. This will simulate the actual removal of these packages. Was this verified to actually work that way

F39 proposal: Mass Retire Golang Leaves (Self-Contained Change proposal)

2023-02-02 Thread Ben Cotton
== Definitions == * ''library only source package'' -- a component/source package that only contains noarch golang ''*-devel'' subpackages. * ''binary subpackage'' -- an arched subpackage that contains go binaries. * ''source

  1   2   3   4   >