The state of the go packages

[illiliti]

Some(well, all of them except dnscrypt-proxy) go packages still use internet connection to fetch dependencies. This is bad because only kiss itself should be allowed(we should really enforce this via unshare) to fetch something from internet. We should use go build -mod=vendor where possible, and if not possible - convince upstream to add support for it.

• syncthing -- @Vouivre switch to this source and set GOFLAGS='-mod=vendor'
• age -- waiting for upstream decision Consider shipping release tarball with vendored dependencies FiloSottile/age#394
• caddy -- waiting for upstream decision Consider shipping release tarball with vendored dependencies caddyserver/caddy#4573
• micro -- waiting for upstream decision Consider shipping release tarball with vendored dependencies zyedidia/micro#2364
• fzf -- waiting for upstream decision Consider shipping release tarball with vendored dependencies junegunn/fzf#2733
• amfora -- waiting for upstream decision Consider shipping release tarball with vendored dependencies makew0rld/amfora#296
• github-cli -- waiting for upstream decision Consider shipping release tarball with vendored dependencies cli/cli#5201
• go-ipfs -- @mmatongo set GOFLAGS='-mod=vendor'
• aerc-git -- TBD
• gron-git -- upstream is kinda dead
• rclone -- @xuxiaodong upstream provides extra tarball with vendored dependencies
• restric -- waiting for upstream decision Consider shipping release tarball with vendored dependencies restic/restic#3647
• slides -- @xuxiaodong upstream provides extra branch with vendored dependencies
• (gi)tea -- @mmatongo set GOFLAGS='-mod=vendor'
• goimports -- FUCK YOU GOOGLE!

[Vouivre]

I'm not the maintainer of go-ipfs

$ kiss-maintainer go-ipfs                                                      
=> /home/user/repos/community/community/go-ipfs
Daniel M. Matongo <me@danielm.pw>

@mmatongo: can you have a look at it ?

[mmatongo]

I keep forgetting to do this for some reason, I'll send two PR's in a bit.

[illiliti]

I'm not the maintainer of go-ipfs

Fixed, thanks.

[dilyn-corner]

@aabacchus -- maybe poke amfora?

@git-bruh -- maybe poke github-cli?

The others are either wontfix or ignored -- I suppose we should just consider it a lost cause.

Maintainers are probably welcome to vendor dependencies themselves and point sources to their fork (though should probably be discussed...)

[aabacchus]

Does anyone more familiar with GitHub actions want to have a go at this? makew0rld/amfora#296 (comment)

[aabacchus]

by the way, the maintainer of aerc said they don't want the "burden" of vendoring deps in tarballs.