Re: Create influxdb package

[Attila Fülöp <attila%fueloep.org@localhost>]

On 1/14/19 10:20 AM, Jonathan Perkin wrote:
>> On 1/14/19 9:22 AM, Jonathan Perkin wrote:
>>>
>>> Right, this is completely incompatible with the way pkgsrc works.  You
>>> have to ensure that all downloads are done up-front, which is what the
>>> go-dep.mk infrastructure does.
>>
>> Well, my pksrc knowledge is quite limited, so I can't see why this must
>> be. Let me try this in real life, maybe I'll stumble over the obvious.
> 
> There are at least 3 reasons that immediately come to mind:
> 
>  - Security and repeatability. 
> >  - Some pkgsrc users like to perform a full source download run first,
>    and then build their packages on a machine that is offline.
>
>  - From a practical point of view, "patch" comes before "build"
>
> There are probably others, but suffice to say that any downloads
> during the "build" phase are completely forbidden.

Thanks for your thorough explanation, I think I do understand the
problem better now.  The main problem is downloading any files during
the build, not building the deps as part of the main build.

All points you raise are valid and I fully agree.  Temper resistance,
reproducible and offline builds are valuable features.

Looking at your branch, I'm not sure I fully understand what gets done,
especially where the downloaded deps are stored.  But I think all of
this should be doable with go modules too, at least if the src repo has
proper go.mod and go.sum files in place.

As a side note, shouldn't we move this technical discussion to the
github branch, since I think most mailing list members aren't interested
in the details of go packaging?

Also please give me a day or two to grok all of this, since I caught a
flu today and not feeling up to par right now.

Thanks,

Attila