Provide a source tarball with vendored dependencies

[maximbaz]

Hey, would you be able to provide one more archive as part of your release, a source tarball just like Github is building for you (source.tar.gz) but with vendored dependencies? These can be generated using go mod tidy; go mod vendor commands.

I want this to allow building croc in a clean environment without internet access (assuming source tarball is already present), which might for example help with reproducible builds effort.

To generate a tarball you can use git directly, for example Github itself is running this command (where the last argument is the tag name):

git archive -o v6.2.3.tar.gz --format tar.gz --prefix=croc-6.2.3/ v6.2.3

Let me know if this makes sense and if I can help with something!

[maximbaz]

I've just went through the same exercise for my own project, I wasn't correct in suggesting to use git archive, as it won't include vendor/ folder that is not under version control.

I can see you are using goreleaser, maybe you'll know a better way of achieving this, but what I found so far is based on this article:

1. Add post-build hook:

hooks:
    post: sh prepare-sources-tarball.sh

2. Prepare the archive in that script, I think something like this would work:

tmp=$(mktemp -d)
mkdir $tmp/croc
cp -r * $tmp/croc
(cd $tmp/croc && go mod tidy && go mod vendor)
(cd $tmp && tar -cvzf croc-src.tar.gz croc)
mv $tmp/croc-src.tar.gz dist/

I'm not sure based on the medium article, maybe there must be a subfolder in dist/, in which case perhaps worth trying:

...
mkdir -p dist/src
mv $tmp/croc-src.tar.gz dist/src/

Hope that helps 🙂

[schollz]

@maximbaz Thanks! I got it working, but I'm not sure how to upload the prepared tarball to Github via goreleaser. Waiting on that :)

[maximbaz]

I think it worked, looking at the 6.2.4 release I can see croc-src.tar.gz!

UPDATE: Or did you mean that you uploaded croc-src.tar.gz manually to 6.2.4?

A minor annoyance is that croc-src.tar.gz does not contain the application version (neither in its name, nor in the folder inside the archive), it's because I didn't know how to retrieve the current version from inside the hook script that creates this tarball. If you have any ideas how to pass version to the script, it would be nice, otherwise it's okay like it is now.

I'll check now on my side if I can build using that archive, will report in a few minutes

[maximbaz]

It worked really well for me, my build script can compile the binary and run all your tests without downloading anything from internet, awesome!

[schollz]

@maximbaz Great, but I actually uploaded that src manually. I still have to figure out how to integrate into goreleaser

[maximbaz]

I bet the trick is to update the line mv $tmp/croc-src.tar.gz dist/ and put the file in a subfolder inside dist/, I don't know if that has to be a real architecture like dist/linux_amd64/ or it can be anything like dist/sources/ - try both perhaps, if you have a chance! 🙂

[schollz]

According to their slack, there is no way to do this :( I will just upload manually when I can!

[maximbaz]

Oh really 😞 But thanks! I'll update Arch package to use croc_${pkgver}_src.tar.gz, and it becomes annoying too much to do it manually, let me know, maybe we can figure a way to automate this, via travis for example?

[schollz]

@maximbaz Nvm! I added it to the post-hook. All good now :)

[maximbaz]

looks like this broke @schollz, there is no _src archive attached to 6.4.7 release, would you have a chance to take a look?

[schollz]

@maximbaz Sorry, added!

[maximbaz]

Thanks! Did you need to do this manually? If hooks don't work as expected we can try to find some other way, to make it simpler for you!

[maximbaz]

Hi @schollz, the latest 8.1.0 release has an empty croc_8.1.0_src.tar.gz archive, could you please have a look what went wrong there?