2 ms·
This draft document[1] suggests that Fedora will use the "rebuild all packages" option for packaging Go programs, since it's unlikely to support dynamic linking
by slimsag 10y ago
This draft document[1] suggests that Fedora will use the "rebuild all packages" option for packaging Go programs, since it's unlikely to support dynamic linking in the traditional fashion any time soon.
[1] https://fedoraproject.org/wiki/PackagingDrafts/Go#Security_in_Go_Language_Packages https://fedoraproject.org/wiki/PackagingDrafts/Go#Security_i...
- lisivka 10y agoI hate Go for exactly that reason.
- snuxoll 10y agoNot much of a choice for Go, but Rust does give the option for dynamic linking so I suspect the Fedora project will take advantage of it. There is no tooling in Koji to support mass rebuilds when dependencies are updated like this, which is why in rawhide when you are about to make an soname bump you are supposed to notify anyone who depends on the package of the change so they can bump the release of their packages afterwards. I can't say anything about the build tooling other releases use (I only have real experience with Koji and a limited look at OpenSUSE's OBS), but I don't think (m)any support "rebuild all that depends on this package" without manual intervention. It's really a crappy situation to be put in by language designers who value their use case over all else, and while, again, I think static linking can have a place it really doesn't belong in distribution repositories if it can be helped.