GNU bug report logs - #48259
[PATCH 1/2] gnu: Replace go-github-com-golang-protobuf-proto with go-github-com-golang-protobuf

Previous Next

To reply to this bug, email your comments to 48259 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Dion Mendel <guix <at> dm9.info>
To: guix-patches <at> gnu.org
Subject: [PATCH 1/2] gnu: Replace go-github-com-golang-protobuf-proto with
 go-github-com-golang-protobuf
Date: Fri, 7 May 2021 00:35:11 +0800

[Message part 1 (text/plain, inline)]

Hi guix,

The github.com/golang/protobuf module contains several packages.
Only proto is currently packaged.  This change updates the module from
1.3.1 to 1.5.2 and packages the entire module.

This is needed as I am preparing to package lxd (github.com/lxc/lxd), 
which depends on the unpackaged packages from golang/protobuf.

This change replaces go-github-com-golang-protobuf-proto with 
go-github-com-golang-protobuf.

There are currently two packages that depend on 
go-github-com-golang-protobuf-proto.  I have tested this changeset by 
building both of these packages.

go-github-com-lucas-clemente-quic-go: this is a source only package that 
no other package uses.

syncthing: depends on go-github-com-golang-protobuf-proto via several 
intermediary packages.  After building, I've run some of the syncthing
executables and they appear to work.

[0001-gnu-Add-go-golang-org-protobuf.patch (text/x-diff, attachment)]

[0002-gnu-Replace-go-github-com-golang-protobuf-proto-with.patch (text/x-diff, attachment)]

Message #8 received at 48259 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Dion Mendel <guix <at> dm9.info>
Cc: 48259 <at> debbugs.gnu.org
Subject: Re: [bug#48259] [PATCH 1/2] gnu: Replace
 go-github-com-golang-protobuf-proto with go-github-com-golang-protobuf
Date: Sat, 8 May 2021 11:50:42 -0400

On Fri, May 07, 2021 at 12:35:11AM +0800, Dion Mendel wrote:
> syncthing: depends on go-github-com-golang-protobuf-proto via several
> intermediary packages.  After building, I've run some of the syncthing
> executables and they appear to work.

Just to clarify, since commit ed3ef756f521a0df8596a88b66f65b7a1ad99252,
Syncthing does not depend on any Go packages, but instead uses its
bundled copies of all its dependencies.

https://git.savannah.gnu.org/cgit/guix.git/commit/?id=ed3ef756f521a0df8596a88b66f65b7a1ad99252

Message #11 received at 48259 <at> debbugs.gnu.org (full text, mbox):

From: Dion Mendel <guix <at> dm9.info>
To: 48259 <at> debbugs.gnu.org
Subject: Re: [bug#48259] [PATCH 1/2] gnu: Replace
 go-github-com-golang-protobuf-proto with go-github-com-golang-protobuf
Date: Sun, 9 May 2021 20:37:00 +0800

On Sat, May 08, 2021 at 11:50:42AM -0400, Leo Famulari wrote:
>
>Just to clarify, since commit ed3ef756f521a0df8596a88b66f65b7a1ad99252,
>Syncthing does not depend on any Go packages, but instead uses its
>bundled copies of all its dependencies.

Is it acceptable to use bundled copies of dependencies?  The manual 
(section 16.6, checklist #6) says otherwise.

If it's okay, this would make packaging lxd much simpler.  I've had to 
package around 90 Go libraries so far.

If using lxd's bundled copies of dependencies would be accepted, then I 
withdraw this patch request.

Message #14 received at 48259 <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Dion Mendel <guix <at> dm9.info>
Cc: 48259 <at> debbugs.gnu.org
Subject: Re: [bug#48259] [PATCH 1/2] gnu: Replace
 go-github-com-golang-protobuf-proto with go-github-com-golang-protobuf
Date: Sun, 9 May 2021 11:17:27 -0400

On Sun, May 09, 2021 at 08:37:00PM +0800, Dion Mendel wrote:
> Is it acceptable to use bundled copies of dependencies?  The manual (section
> 16.6, checklist #6) says otherwise.

This item, from the manual section Submitting Patches, says: 

"Make sure the package does not use bundled copies of software already
available as separate packages."

So, already, there is some wiggle room based on whether or not things
are "already available as separate packages."

Using bundled dependnencies is strongly discouraged and you are expected
to try to avoid it.

With Syncthing, there were unfixed security vulnerabilities in our
package, and our go-build-system could not build later versions of
Syncthing. So, until our go-build-system is overhauled [0], we'll use
Syncthing's bundled dependencies. They are all free software anyways.

With Go, the old distro model of "no bundling" is not idiomatic, so the
future of Go in Guix may look different from how it is now. Go software
typically has no concept of "versions" and every program pins its
dependencies at specific Git commits. So, to unbundle everything would
leave us with hundreds or thousands of versions of popular libraries.
We'll have to be creative in how we deal with that.

But for now, we try to unbundle.

> If it's okay, this would make packaging lxd much simpler.  I've had to
> package around 90 Go libraries so far.
> 
> If using lxd's bundled copies of dependencies would be accepted, then I
> withdraw this patch request.

Please, either try packaging them "by hand" or with the Go module
importer [1]. Code reviewers will ask you to explain why you are using the
bundled dependencies.

[0] The work to overhaul go-build-system is progressing.

[1] https://guix.gnu.org/manual/devel/en/html_node/Invoking-guix-import.html#Invoking-guix-import
I guess it would be a command like:
`guix import go github.com/lcx/lxd --recursive -pin-versions`
But, it depends on LXD using the standard Go module mechanisms. If it
doesn't, maybe each top-level dependency can be imported along with its
dependency graph.

Message #17 received at 48259 <at> debbugs.gnu.org (full text, mbox):

From: Dion Mendel <guix <at> dm9.info>
To: 48259 <at> debbugs.gnu.org
Subject: Re: [bug#48259] [PATCH 1/2] gnu: Replace
 go-github-com-golang-protobuf-proto with go-github-com-golang-protobuf
Date: Mon, 10 May 2021 10:58:38 +0800

On Sun, May 09, 2021 at 11:17:27AM -0400, Leo Famulari wrote:
>But for now, we try to unbundle.

Okay, thank you for clarification.

When this changeset passes review and is applied, I'll continue with 
packaging lxd and its dependencies.

(Thanks for pointing me towards guix import).

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.