3 ms·
So you install the go equivalents from your distro. If your distro doesn't have them, you vote for them to add them (or go through whatever process your distro
by noja 11y ago
So you install the go equivalents from your distro. If your distro doesn't have them, you vote for them to add them (or go through whatever process your distro has).
- alanctgardner3 11y agoThe repo maintainers are going to be on the hook to rebuild every dependency every time any package in the dependency chain changes. That sounds like a nightmare versus the current scenario where only one package gets revved when a library has a bug.
- dcposch 11y agoNot every time a library changes, only every time one has a security bug.
- noja 11y agoSo either the repo maintainers do it, or they stop being relevant (for this use case). Or someone else comes along to fill the gap.
- cyphar 11y agoIf you have an automated build system (like OBS -- the Open Build System used by openSUSE) where dependencies are rebuilt automatically and security fixes can be pushed to maintainence automatically.