Please add vendor tarballs

[ewildgoose]

Please add vendored tar files... Pretty please?

I tied to package this for Gentoo and I cannot for the life of me figure out the correct incantations without a vendored set of sources... I tried making some, but I hit errors during compile due to attempts to do network access (which are banned in gentoo's sandbox during compile)

Ta

[psanford]

I'm not sure I understand. What do you think I can do that you can't do yourself with go mod vendor or GOMODCACHE="${PWD}"/go-mod go mod download -modcacherw -x?

[ewildgoose]

https://wiki.gentoo.org/wiki/Writing_go_Ebuilds

The packaging system literally fights you to prevent that being possible...

To slightly clarify that, the build system runs under a userspace sandbox, so it's not just advisory that you can't say do network access during the compile process, but your network access is forceably removed. The intention is security to avoid rogue makefiles doing naughty things, however, it seems particularly hard to package Go projects... :-(

Note, previously it was possible to list all dependencies in the package file (boring to update), however, even that has gone away now. So near as I can see it's only possible by pre-generating a vendor tarball and hosting it somewhere. (Ideal would be if that popped out of your toolchain and could be found here on github)

Thanks for listening and considering the request

[psanford]

I would take a PR to add the vendor tarball to build_release.go

[ewildgoose]

Absolutely. OK, thanks for listening

I'm not a Go programmer, so I'll add it to my todo list, but I don't think I can volunteer a PR in the imminent future, so close the feature request for now. However, I'll try and contribute in the future.

Thanks!