Re: Automatic versioned buildrequires for Go packages

2025-03-27 Thread Florian Weimer via golang
* Zdenek Dohnal via golang: > Once CVE fix comes into golang and new golang version is released, > presence of the older version in buildrequires of other package will > indicate the package includes vulnerable code, and it has to be > rebuilt once the original package includes a fix. A different

Re: Automatic versioned buildrequires for Go packages

2025-03-27 Thread Zdenek Dohnal via golang
On 3/26/25 16:10, Florian Weimer wrote: How did you get such output from 'go version -m'? Or is it a theoretical output? Because if I call this on my ipp-usb binary, I get this output: $ go version -m /usr/sbin/ipp-usb /usr/sbin/ipp-usb: go1.23.7     path    github.com/OpenPrinting/ipp-usb    

Re: Automatic versioned buildrequires for Go packages

2025-03-27 Thread Maxwell G via golang
On 3/27/25 2:46 AM, Zdenek Dohnal via golang wrote: FTR it is because podman uses vendor/modules.txt which is used by script Alejandro sent in the other email. It's actually because podman enables modules mode (https://src.fedoraproject.org/rpms/podman/blob/rawhide/f/podman.spec#_10). This