build security of dependencies?

[adrelanos]

As a stopgap for:

• build process should not require a network connection #304

How secure is the process of downloading the dependencies?

• digital signature verification
• hash sum verification

Other options:

• start using embedded code copies?

[roddhjav]

There is hash sum verification like any go program.

Once I setup proper dh-golang Debian packaging, they would be handled via debian packages by adding the following Build-Depends:

  golang-golang-x-exp-dev,
  golang-github-arduino-go-paths-helper-dev,

• start using embedded code copies?

That was the old method go had to provide build deps. This is now deprecated.

[roddhjav]

I now included/removed all previous build dependencies (golang-golang-x-exp-dev, and golang-github-arduino-go-paths-helper-dev). You should now be able to build without network.