On 2017-03-21 11:14, Bartłomiej Piotrowski wrote: > On 2017-03-08 17:13, Iru Cai via arch-general wrote: >> Hi, >> >> I'm not familiar with go, but I'm trying to use some go programs, caddy for >> example. I read the PKGBUILD of it. It first use `go get' to get the >> dependencies and then do the `go build'. > > Yes, that's a bad practice, and the fact that devtools allow network > access during build doesn't help. > > How Debian and Fedora handles it (and we should too) is packaging source > code that is later being used by the compiler. Semi-example of that can > be found in go-tools[1] package, except golang.org/x/net should be > effectively a standalone package and a make dependency. > > The other way is asking upstream to vendor their dependencies in git > repository so we don't need to handle it at all. > > Bartłomiej > And here's the missing link... [1] https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/go-tools
