On 2017-03-08 17:13, Iru Cai via arch-general wrote: > Hi, > > I'm not familiar with go, but I'm trying to use some go programs, caddy for > example. I read the PKGBUILD of it. It first use `go get' to get the > dependencies and then do the `go build'.
Yes, that's a bad practice, and the fact that devtools allow network access during build doesn't help. How Debian and Fedora handles it (and we should too) is packaging source code that is later being used by the compiler. Semi-example of that can be found in go-tools[1] package, except golang.org/x/net should be effectively a standalone package and a make dependency. The other way is asking upstream to vendor their dependencies in git repository so we don't need to handle it at all. Bartłomiej
signature.asc
Description: OpenPGP digital signature
