[opensuse-go] How to deal with hard-wired version dependencies?
Hi! I'm currently working on packaging various Go packages which are required as dependencies for the new Go-based GoogleCloudPlatform packages [1,2]. One of the problems that I am frequently running into when packaging Go software are hard-wired version dependencies. For example, building golang-github-pkg-sftp fails with [3]
[ 4s] + go install -v -p 4 -x -buildmode=pie github.com/pkg/sftp [ 4s] # get https://proxy.golang.org/github.com/pkg/errors/@v/v0.8.1.mod [ 4s] # get https://proxy.golang.org/github.com/kr/fs/@v/v0.1.0.mod [ 4s] # get https://proxy.golang.org/github.com/stretchr/testify/@v/v1.4.0.mod [ 4s] # get https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20200221231518-2aa609... [ 4s] # get https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20200221231518-2aa609...: Get "https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20200221231518-2aa609...": dial tcp: lookup proxy.golang.org on [::1]:53: read udp [::1]:42701->[::1]:53: read: connection refused [ 4s] # get https://proxy.golang.org/github.com/pkg/errors/@v/v0.8.1.mod: Get "https://proxy.golang.org/github.com/pkg/errors/@v/v0.8.1.mod": dial tcp: lookup proxy.golang.org on [::1]:53: read udp [::1]:42701->[::1]:53: read: connection refused [ 4s] # get https://proxy.golang.org/github.com/kr/fs/@v/v0.1.0.mod: Get "https://proxy.golang.org/github.com/kr/fs/@v/v0.1.0.mod": dial tcp: lookup proxy.golang.org on [::1]:53: read udp [::1]:42701->[::1]:53: read: connection refused [ 4s] # get https://proxy.golang.org/github.com/stretchr/testify/@v/v1.4.0.mod: Get "https://proxy.golang.org/github.com/stretchr/testify/@v/v1.4.0.mod": dial tcp: lookup proxy.golang.org on [::1]:53: read udp [::1]:42701->[::1]:53: read: connection refused [ 4s] go: github.com/kr/fs@v0.1.0: Get "https://proxy.golang.org/github.com/kr/fs/@v/v0.1.0.mod": dial tcp: lookup proxy.golang.org on [::1]:53: read udp [::1]:42701->[::1]:53: read: connection refused [ 4s] error: Bad exit status from /var/tmp/rpm-tmp.Ypx3yR (%build)
which is apparently the result golang-github-pkg-sftp requesting specific versions of its dependencies in its go.mod file:
module github.com/pkg/sftp
go 1.12
require ( github.com/kr/fs v0.1.0 github.com/pkg/errors v0.8.1 github.com/stretchr/testify v1.4.0 golang.org/x/crypto v0.0.0-20200221231518-2aa609cf4a9d )
These hard-wired version dependencies obviously with the versioning policies we have in a distribution - namely that we are providing on particular version only and hence cannot provide specific versions of a certain package in order to satisfy such dependency requirements. What is the best way to work around this problem? Should I just patch the go.mod file to remove the hard-wired version requirements or is there a better way? Adrian
[1] https://github.com/GoogleCloudPlatform/guest-agent [2] https://github.com/GoogleCloudPlatform/guest-logging-go [3] https://build.opensuse.org/package/show/home:glaubitz:branches:devel:languag... -- To unsubscribe, e-mail: opensuse-go+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-go+owner@opensuse.org
Hi Adrian,
I'm not much of a go packager, but maybe I can help a bit.
John Paul Adrian Glaubitz
[snip]
These hard-wired version dependencies obviously with the versioning policies we have in a distribution - namely that we are providing on particular version only and hence cannot provide specific versions of a certain package in order to satisfy such dependency requirements.
What is the best way to work around this problem? Should I just patch the go.mod file to remove the hard-wired version requirements or is there a better way?
There is an easier way: provide the go package with the vendored sources
that it wants. For that Jeff Kowalczyk wrote the go_modules service
(https://github.com/openSUSE/obs-service-go_modules), you can check it
out in action in the hugo package:
https://build.opensuse.org/package/show/devel:languages:go/hugo
This is unfortunately not the "pure" way of building all libraries
separately, but I am afraid that that ship has sailed for Go at least.
Hope this helps,
Dan
--
Dan Čermák
Hi Dan! On 5/19/20 10:45 AM, Dan Čermák wrote:
There is an easier way: provide the go package with the vendored sources that it wants. For that Jeff Kowalczyk wrote the go_modules service (https://github.com/openSUSE/obs-service-go_modules), you can check it out in action in the hugo package: https://build.opensuse.org/package/show/devel:languages:go/hugo
This is unfortunately not the "pure" way of building all libraries separately, but I am afraid that that ship has sailed for Go at least.
Thanks, I was already assuming that it would end up vendoring the dependencies, I'm glad there is already a solution for that :). It definitely helps me moving forward, thanks. Adrian -- To unsubscribe, e-mail: opensuse-go+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-go+owner@opensuse.org
participants (2)
-
Dan Čermák -
John Paul Adrian Glaubitz