proposal: go.mod: cgo dependency

[pjebs]

Proposal Details

It would be beneficial if there was some way for a package to "advertise" that the package REQUIRES cgo.

Perhaps a pseudo require in the go.mod file.

And following from that, if CGO is not enabled when building and the go.mod file states that CGO is required, it doesn't build: Even if the !cgo build constraints suggest it should build.

[thepudds]

See for example https://github.com/tailscale/depaware:

It generates a list of your dependencies which you check in to your repo:

https://github.com/tailscale/tailscale/blob/main/cmd/tailscaled/depaware.txt

Then you and others can easily see what your dependencies are, how they vary by operating system (the letters L(inux), D(arwin), W(indows) in the left column), and whether they use unsafe/cgo (bomb icon).

You might also be interested in things like https://github.com/google/capslock:

Capslock is a capability analysis CLI for Go packages that informs users of which privileged operations a given package can access. This works by classifying the capabilities of Go packages by following transitive calls to privileged standard library operations.

My guess it is unlikely that some specific cgo annotation would be added to go.mod.