Am Donnerstag, 20. August 2020, 13:01:17 CEST schrieb Thorsten Kukuk:
On Thu, Aug 20, Hans-Peter Jansen wrote:
It seems to miss the library located here (inside the build environment):
/usr/share/go/1.14/contrib/src/github.com/spf13/pflag
Could some kind soul help me to get over this nuisance.
go 1.14 has now modules support, no idea if the old hacks do really work with it anymore.
Hmm, I just try to package this in a sane way. Most of my "knowledge" is from here: https://en.opensuse.org/openSUSE:Packaging_Go Looks pretty much outdated..
The correct "fix" from go perspective is, to use the vendor directory. So "go mod init ...", packaging the vendor directory and "go build -mod=vendor ..." Or course only if your package does not provide the vendor directory already. More and more packages do that. If there are already go.mod, go.sum files and a vendor directory,then most likely "go -mod=vendor ..." is enough.
Thanks, that helped. Since the package contains a go.mod, the magic spell was: "go mod vendor", followed by "tar cvf ../vendor.tar.xz vendor", and some spec massage.
From a build service and maintenance perspective, this is of course a nightmare: it's next to impossible to find out which packages use a module with security problems and which need an update.
.. and will be suffering from the complexity inflation soon (since it piles up any dependencies in each and every package). This process is a serious security thread in itself (because it eases to hide bad code in the ever growing vendor tarballs everywhere). No fun. <bad pun on Google redacted> Thanks Thorsten, Pete -- To unsubscribe, e-mail: opensuse-packaging+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-packaging+owner@opensuse.org