Re: [gentoo-dev] Re: EGO_SUM

2023-06-09 Thread Florian Schmaus
On 02/06/2023 10.31, Michał Górny wrote: On Fri, 2023-06-02 at 10:17 +0200, Florian Schmaus wrote: On 30/05/2023 18.35, Arthur Zamarin wrote: On 30/05/2023 18.52, Florian Schmaus wrote: To prevent harm from Gentoo, we should reach an agreement that everyone can live with. To achieve a

Re: [gentoo-dev] Re: EGO_SUM

2023-06-02 Thread Michał Górny
On Fri, 2023-06-02 at 10:17 +0200, Florian Schmaus wrote: > On 30/05/2023 18.35, Arthur Zamarin wrote: > > On 30/05/2023 18.52, Florian Schmaus wrote: > > > To prevent harm from Gentoo, we should reach an agreement that everyone > > > can live with. To achieve a consensus, and since I can not rule

Re: [gentoo-dev] Re: EGO_SUM

2023-06-02 Thread Florian Schmaus
Hi Arthur, thanks for your mail. On 30/05/2023 18.35, Arthur Zamarin wrote: On 30/05/2023 18.52, Florian Schmaus wrote: To prevent harm from Gentoo, we should reach an agreement that everyone can live with. To achieve a consensus, and since I can not rule out that I missed a post that

Re: [gentoo-dev] Re: EGO_SUM

2023-05-31 Thread William Hubbs
On Wed, May 31, 2023 at 08:30:58AM +0200, pascal.jaeger leimstift.de wrote: > > > Arthur Zamarin hat am 30.05.2023 18:35 CEST > > geschrieben: > > > > > > Currently the best solution *per package* is to speak with upstream, to > > add a CI workflow which create a source tarball which includes

Re: [gentoo-dev] Re: EGO_SUM

2023-05-31 Thread Arsen Arsenović
Andrew Ammerlaan writes: > On 30/05/2023 18:35, Arthur Zamarin wrote: >> My solution is as such: >> 1. Undeprecate EGO_SUM in eclass >> 2. Forbid it's usage in ::gentoo (done by pkgcheck, error level, will >> fail CI and as such we can see the misuse). Overlays are allowed. >> 3. Maintainer

Re: [gentoo-dev] Re: EGO_SUM

2023-05-31 Thread Ryan Qian
Just FYI, here is a working GitHub action for generating vendor tarballs in the same repo but with different branches https://github.com/bekcpear/gopkg-vendors/blob/main/.github/workflows/make-vendor.yaml It has already worked for a long time. Sincerely. Ryan > 在 2023年5月31日,14:20,Andrew

Re: [gentoo-dev] Re: EGO_SUM

2023-05-31 Thread pascal.jaeger leimstift.de
> Arthur Zamarin hat am 30.05.2023 18:35 CEST > geschrieben: > > > Currently the best solution *per package* is to speak with upstream, to > add a CI workflow which create a source tarball which includes `vendor` > dir. This is the best way, and I'm doing that for multiple upstream of > some

Re: [gentoo-dev] Re: EGO_SUM

2023-05-31 Thread Andrew Ammerlaan
On 30/05/2023 18:35, Arthur Zamarin wrote: My solution is as such: 1. Undeprecate EGO_SUM in eclass 2. Forbid it's usage in ::gentoo (done by pkgcheck, error level, will fail CI and as such we can see the misuse). Overlays are allowed. 3. Maintainer starts talks with upstreams to add release

Re: [gentoo-dev] Re: EGO_SUM

2023-05-30 Thread Oskari Pirhonen
On Tue, May 30, 2023 at 21:30:49 +0500, Anna (cybertailor) Vyalkova wrote: > On 2023-05-30 17:52, Florian Schmaus wrote: > > To prevent harm from Gentoo, we should reach an agreement that everyone > > can live with. To achieve a consensus, and since I can not rule out that > > I missed a post

Re: [gentoo-dev] Re: EGO_SUM

2023-05-30 Thread Arthur Zamarin
On 30/05/2023 18.52, Florian Schmaus wrote: > > I am thankful that the council considered my request to vote on the > topic. However, the council decided not to vote on this in its last > session and to return the issue to the mailing lists. > > Some see the requirement of some limitations as

[gentoo-dev] Re: EGO_SUM

2023-05-30 Thread Anna (cybertailor) Vyalkova
On 2023-05-30 17:52, Florian Schmaus wrote: > To prevent harm from Gentoo, we should reach an agreement that everyone > can live with. To achieve a consensus, and since I can not rule out that > I missed a post that includes specific numbers, please share your ideas > on how EGO_SUM could be

[gentoo-dev] Re: EGO_SUM

2023-05-30 Thread Florian Schmaus
On 24/04/2023 18.11, Florian Schmaus wrote: I like to ask the Gentoo council to vote on whether EGO_SUM should be reinstated ("un-deprecated") or not. I am thankful that the council considered my request to vote on the topic. However, the council decided not to vote on this in its last

Re: [gentoo-dev] Re: EGO_SUM

2023-05-22 Thread Florian Schmaus
On 08/05/2023 14.03, Michał Górny wrote: On Mon, 2023-05-08 at 09:53 +0200, Florian Schmaus wrote: Furthermore, both numbers, 256 MiB and 410 MiB, are based on the over-approximation that every EGO_SUM package uses 1.6 MiB, which is almost certainly not the case. The mean package-directory size

Re: [gentoo-dev] Re: EGO_SUM

2023-05-08 Thread Michał Górny
On Mon, 2023-05-08 at 09:53 +0200, Florian Schmaus wrote: > On 02.05.23 21:45, Sam James wrote: > > Florian Schmaus writes: > > > On 27/04/2023 23.16, Sam James wrote: > > > > Florian Schmaus writes: > > > > > On 26/04/2023 18.12, Matt Turner wrote: > > > > > > On Wed, Apr 26, 2023 at 11:31 AM

Re: [gentoo-dev] Re: EGO_SUM

2023-05-08 Thread Florian Schmaus
On 02.05.23 21:45, Sam James wrote: Florian Schmaus writes: On 27/04/2023 23.16, Sam James wrote: Florian Schmaus writes: On 26/04/2023 18.12, Matt Turner wrote: On Wed, Apr 26, 2023 at 11:31 AM Florian Schmaus wrote: The discussion would be more productive if someone who is supporting

Re: [gentoo-dev] Re: EGO_SUM

2023-05-08 Thread Florian Schmaus
On 02.05.23 22:04, Matt Turner wrote: On Tue, May 2, 2023 at 3:33 PM Florian Schmaus wrote: I performed a tree-wide analysis regarding EGO_SUM and IIRC published the results in my previous post about EGO_SUM last year. https://dev.gentoo.org/~flow/ego_sum-2022-01-01.txt shows the analysis

Re: [gentoo-dev] Re: EGO_SUM

2023-05-02 Thread Matt Turner
On Tue, May 2, 2023 at 3:33 PM Florian Schmaus wrote: > I performed a tree-wide analysis regarding EGO_SUM and IIRC published > the results in my previous post about EGO_SUM last year. > https://dev.gentoo.org/~flow/ego_sum-2022-01-01.txt shows the analysis > results for ::gentoo as of 2022-01-01

Re: [gentoo-dev] Re: EGO_SUM

2023-05-02 Thread Sam James
Florian Schmaus writes: > [[PGP Signed Part:Undecided]] > On 27/04/2023 23.16, Sam James wrote: >> Florian Schmaus writes: >> >>> [[PGP Signed Part:Undecided]] >>> On 26/04/2023 18.12, Matt Turner wrote: On Wed, Apr 26, 2023 at 11:31 AM Florian Schmaus wrote: > The discussion would

Re: [gentoo-dev] Re: EGO_SUM

2023-05-02 Thread Sam James
Florian Schmaus writes: > [[PGP Signed Part:Undecided]] > On 28/04/2023 16.34, Michał Górny wrote: >> On Fri, 2023-04-28 at 08:59 +0200, Florian Schmaus wrote: >>> And I never said that I believe in representing the majority's opinion. >>> That said, I prefer to have this voted on by an

Re: [gentoo-dev] Re: EGO_SUM

2023-05-02 Thread Florian Schmaus
On 28/04/2023 16.34, Michał Górny wrote: On Fri, 2023-04-28 at 08:59 +0200, Florian Schmaus wrote: And I never said that I believe in representing the majority's opinion. That said, I prefer to have this voted on by an all-developer vote than a council vote. Then we would know what the majority

Re: [gentoo-dev] Re: EGO_SUM

2023-05-02 Thread Florian Schmaus
On 27/04/2023 23.16, Sam James wrote: Florian Schmaus writes: [[PGP Signed Part:Undecided]] On 26/04/2023 18.12, Matt Turner wrote: On Wed, Apr 26, 2023 at 11:31 AM Florian Schmaus wrote: The discussion would be more productive if someone who is supporting the EGO_SUM deprecation could

Re: [gentoo-dev] Re: EGO_SUM

2023-04-29 Thread Robin H. Johnson
On Fri, Apr 28, 2023 at 08:59:29AM +0200, Florian Schmaus wrote: > On 27/04/2023 14.54, Michał Górny wrote: > > On Thu, 2023-04-27 at 09:58 +0200, Florian Schmaus wrote: > >> Disk space is cheap. > > > > No, it's not. Gentoo supports more hardware than your average PC with > > beefy hard drive

Re: [gentoo-dev] Re: EGO_SUM

2023-04-28 Thread Michał Górny
On Fri, 2023-04-28 at 08:59 +0200, Florian Schmaus wrote: > On 27/04/2023 14.54, Michał Górny wrote: > > On Thu, 2023-04-27 at 09:58 +0200, Florian Schmaus wrote: > > > Disk space is cheap. > > > > No, it's not. Gentoo supports more hardware than your average PC with > > beefy hard drive and/or

Re: [gentoo-dev] Re: EGO_SUM

2023-04-28 Thread Florian Schmaus
On 27/04/2023 14.54, Michał Górny wrote: On Thu, 2023-04-27 at 09:58 +0200, Florian Schmaus wrote: Disk space is cheap. No, it's not. Gentoo supports more hardware than your average PC with beefy hard drive and/or possibility of installing one. Let's not forget that you need a ::gentoo

[gentoo-dev] Re: EGO_SUM

2023-04-28 Thread Florian Schmaus
On 27/04/2023 11.24, Ulrich Mueller wrote: On Thu, 27 Apr 2023, Florian Schmaus wrote: Network traffic, while also being cheap, may be more of an issue. Currently, gentoo-latest.tar.xz is ~41 MiB. So on a conservative approximation ::gentoo compresses to 1/10. So, the 10 Go-packages cause 200

Re: [gentoo-dev] Re: EGO_SUM

2023-04-27 Thread Sam James
Michał Górny writes: > On Fri, 2023-04-28 at 01:38 +0100, Sam James wrote: >> Pascal Jäger writes: >> >> > Maybe I’m getting this wrong, but didn’t  we switch to shallow >> > checkouts for the systems repository? I remember it was a major >> > outcry on the mailing list. So at least for end

Re: [gentoo-dev] Re: EGO_SUM

2023-04-27 Thread Michał Górny
On Fri, 2023-04-28 at 01:38 +0100, Sam James wrote: > Pascal Jäger writes: > > > Maybe I’m getting this wrong, but didn’t  we switch to shallow > > checkouts for the systems repository? I remember it was a major > > outcry on the mailing list. So at least for end users git keeps no > > history

Re: [gentoo-dev] Re: EGO_SUM

2023-04-27 Thread Sam James
Pascal Jäger writes: > Maybe I’m getting this wrong, but didn’t  we switch to shallow > checkouts for the systems repository? I remember it was a major > outcry on the mailing list. So at least for end users git keeps no > history and our repository history should not impact clone size of a >

Re: [gentoo-dev] Re: EGO_SUM

2023-04-27 Thread Pascal Jäger
Maybe I’m getting this wrong, but didn’t we switch to shallow checkouts for the systems repository? I remember it was a major outcry on the mailing list. So at least for end users git keeps no history and our repository history should not impact clone size of a shallow copy, should it? > On

Re: [gentoo-dev] Re: EGO_SUM

2023-04-27 Thread Sam James
Florian Schmaus writes: > [[PGP Signed Part:Undecided]] > On 26/04/2023 18.12, Matt Turner wrote: >> On Wed, Apr 26, 2023 at 11:31 AM Florian Schmaus wrote: >>> The discussion would be more productive if someone who is supporting the >>> EGO_SUM deprecation could rationally summarize the main

Re: [gentoo-dev] Re: EGO_SUM

2023-04-27 Thread David Seifert
On Thu, 2023-04-27 at 13:00 -0500, William Hubbs wrote: >  That, however, doesn't remove the concern about big ebuilds and >  manifests. I will look at the remainder of the thread to figure out >  what is going on with that. You do know that the main reason it was deprecated in ::gentoo was the

Re: [gentoo-dev] Re: EGO_SUM

2023-04-27 Thread William Hubbs
On Mon, Apr 17, 2023 at 02:28:22PM +0500, Anna (cybertailor) Vyalkova wrote: > On 2023-04-17 09:37, Florian Schmaus wrote: > > The EGO_SUM alternatives > > - do not have the same level of trust and therefore have a negative > > impact on security (a dubious tarball someone put somewhere,

Re: [gentoo-dev] Re: EGO_SUM

2023-04-27 Thread Michał Górny
On Thu, 2023-04-27 at 09:58 +0200, Florian Schmaus wrote: > Disk space is cheap. No, it's not. Gentoo supports more hardware than your average PC with beefy hard drive and/or possibility of installing one. Let's not forget that you need a ::gentoo checkout even on a system running purely on

[gentoo-dev] Re: EGO_SUM

2023-04-27 Thread Ulrich Mueller
> On Thu, 27 Apr 2023, Florian Schmaus wrote: > Network traffic, while also being cheap, may be more of an issue. > Currently, gentoo-latest.tar.xz is ~41 MiB. So on a conservative > approximation ::gentoo compresses to 1/10. So, the 10 Go-packages > cause 200 KiB of additional traffic. Even

[gentoo-dev] Re: EGO_SUM

2023-04-27 Thread Florian Schmaus
On 26/04/2023 18.12, Matt Turner wrote: On Wed, Apr 26, 2023 at 11:31 AM Florian Schmaus wrote: The discussion would be more productive if someone who is supporting the EGO_SUM deprecation could rationally summarize the main arguments why we deprecated EGO_SUM. You're requesting the changes.

Re: [gentoo-dev] Re: EGO_SUM

2023-04-26 Thread Sam James
Florian Schmaus writes: > Hi Sam, > > thanks for your feedback. I am glad for everyone who engages in this > discussion and shares their views and new information. > > On 24/04/2023 22.28, Sam James wrote: >> Florian Schmaus writes: >> [CCing williamh@ as go-module.eclass & dev-lang/go

Re: [gentoo-dev] Re: EGO_SUM

2023-04-26 Thread Matt Turner
On Wed, Apr 26, 2023 at 3:31 PM Andrew Ammerlaan wrote: > > On 26/04/2023 18:12, Matt Turner wrote: > > On Wed, Apr 26, 2023 at 11:31 AM Florian Schmaus wrote: > >> The discussion would be more productive if someone who is supporting the > >> EGO_SUM deprecation could rationally summarize the

RE: [gentoo-dev] Re: EGO_SUM

2023-04-26 Thread Chris Pritchard
> This way ridiculously large manifests are gone out of ::gentoo. But overlays > can > still use the EGO_SUM method for their go packages if a tarball is too much of > a hassle. And everyone is happy. It is then the responsibility of the overlay > maintainers to ensure that their manifests don't

Re: [gentoo-dev] Re: EGO_SUM

2023-04-26 Thread Andrew Ammerlaan
On 26/04/2023 18:12, Matt Turner wrote: On Wed, Apr 26, 2023 at 11:31 AM Florian Schmaus wrote: The discussion would be more productive if someone who is supporting the EGO_SUM deprecation could rationally summarize the main arguments why we deprecated EGO_SUM. You're requesting the changes.

[gentoo-dev] Re: EGO_SUM

2023-04-26 Thread Matt Turner
On Wed, Apr 26, 2023 at 11:31 AM Florian Schmaus wrote: > The discussion would be more productive if someone who is supporting the > EGO_SUM deprecation could rationally summarize the main arguments why we > deprecated EGO_SUM. You're requesting the changes. It's on you to read the previous

[gentoo-dev] Re: EGO_SUM

2023-04-26 Thread Florian Schmaus
Hi Sam, thanks for your feedback. I am glad for everyone who engages in this discussion and shares their views and new information. On 24/04/2023 22.28, Sam James wrote: Florian Schmaus writes: [CCing williamh@ as go-module.eclass & dev-lang/go maintainer.] I like to ask the Gentoo

Re: [gentoo-dev] Re: EGO_SUM

2023-04-24 Thread Alexey Zapparov
My 2 cents. As somebody who contributes to ::guru, I would like to second that having a burden of hosting dependencies tarballs feels like an obstacle. Pursuing upstream projects to adopt dependencies bundling is often difficult (it's hard to convince developers to change their workflows to make

[gentoo-dev] Re: EGO_SUM

2023-04-24 Thread Sam James
Florian Schmaus writes: [CCing williamh@ as go-module.eclass & dev-lang/go maintainer.] > I like to ask the Gentoo council to vote on whether EGO_SUM should be > reinstated ("un-deprecated") or not. > > EGO_SUM is a project-comprehensive matter, as it affects not only > Go-lang packaging but

[gentoo-dev] Re: EGO_SUM

2023-04-24 Thread Florian Schmaus
I like to ask the Gentoo council to vote on whether EGO_SUM should be reinstated ("un-deprecated") or not. EGO_SUM is a project-comprehensive matter, as it affects not only Go-lang packaging but also the proxy-maint and GURU projects. Furthermore, as I have mentioned in my previous emails,

[gentoo-dev] Re: EGO_SUM

2023-04-17 Thread Anna (cybertailor) Vyalkova
On 2023-04-17 09:37, Florian Schmaus wrote: > The EGO_SUM alternatives > - do not have the same level of trust and therefore have a negative > impact on security (a dubious tarball someone put somewhere, especially > when proxy-maint) Solution: generate release tarballs in upstream CI/CD. > -