[arch-dev-public] RFC: go-pie removal in favour of GOFLAGS

[Anatol Pomozov]

Hello

On Sun, Mar 15, 2020 at 12:24 PM Morten Linderud via arch-dev-public
<arch-dev-public at archlinux.org> wrote:
>
> On Sun, Mar 15, 2020 at 12:09:07PM -0700, Anatol Pomozov via arch-dev-public wrote:
> > > Notice that `-mod=vendor` is also added to `GOFLAGS`.
> >
> > Most of the Go projects do not vendorize their dependencies to avoid
> > polluting the source tree.
> >
> > And there is no point to force vendorizing in the PKGBUILD neither. go
> > modules are doing a great job with pinning dependencies to a specific
> > version thus eliminating the main reason for vendor'ization existence
> > (i.e. reproducible builds).
> >
> > Thus following YAGNI principle I propose to drop this "-mod=vendor" flag.
>
> `-mod=vendor` is implicit as of go 1.14.

-mod=vendor is neither implicit nor required. -mod=vendor flag is
enabled by default only if upstream project uses vendorized project
structure so the build scripts do not have to add this flag manually.

The decisions whether to use a vendor directory structure or not
should be up to upstream developers.

> We are forcing this to ensure we are
> not running into new implicit behaviour in the future, such as updating pinned
> versions or what not. They have changed this once before already.

I do not quite follow this argument. Could you please expand more on it?

>  We need to fetch the dependencies before over the wire before build() and
> check().

go modules will fetch the dependencies using the information from
go.sum. I have go packages with dependencies, and following build()

build() {
  cd $dir
  go build
}

works great, including chroot environment.