Re: [Buildroot] [PATCH v4 1/2] package/pkg-golang.mk: allow packages to override download GOPROXY

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello,

On Wed, 23 Oct 2024 09:35:16 -0700
Christian Stewart via buildroot <buildroot@buildroot.org> wrote:

> It is a proxy, not a download URL. The intent of the entire Go module
> system is to be based on source control under the hood. We should be able
> to check out the git repositories of the underlying source without having
> to use the Google proxy.
> 
> If we make a habit of ignoring these hash mismatches it will become very
> easy for people to stuff code into a release on GitHub and then change the
> tag to something else later, leaving behind the old record in GOPROXY and
> tricking maintainers into reviewing the wrong code on the modified GitHub
> tag.
> 
> There must be some reason why your package is having this issue. With
> anchore quill package we found that it was git lfs with test files causing
> the problem.

I continue to agree with Christian. If using caching proxies is needed
to avoid downloading the "real" upstream because the real upstream has
changed/is broken, things are severely wrong.

Instead, I would recommend to patch netbird to resolve this issue. I
know this requires patches to be applied *before* the vendoring step,
but that it something that anyway would be useful to have. So I would
suggest to find a way to do that. Perhaps some special patch extension,
like package/<foo>/*.vendoring-patch or some other better name, that
would be applied before the vendoring step takes place?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot