On 12/01/2025 13.56, Michał Górny wrote:
Emit a QA warning suggesting the use of crate tarball, when the package
in question uses 300 crates or more. Such a long crate lists cause
ebuilds and Manifests to grow very fast, causing significant space
consumption on end user systems (including users who are not using
the package in question) and git history growth. On top of that,
fetching that many crates takes significant time.
The number of 300 is pretty arbitrary, chosen approximately to match
Manifests that are over 100 KiB in size. We should probably look into
lowering in the future, as more packages are transitioned.
Thanks for your proposal. I know you wrote it because Gentoo is
important to you.
I am sorry, however, but the arbitrary limit you propose is harmful, and
its necessity is questionable.
It is unnecessary, at least in its current form, because the size growth
of Gentoo's package repository is manageable. See the previous analysis
for EGO_SUM [1].
What is more worrisome, however, is that it is harmful.
First, switching from individual crates to a single crate tarball
disallows inter-package crate archive reuse. Often, users will already
have the required crates downloaded because another installed package
used them. With an artificial create count limit, users must download
rather large crate tarballs, causing unnecessary traffic and increasing
the disk space on Gentoo's mirrors and end-user systems. The crate
tarballs quickly eat away the saved disk space in the ebuild repository.
Even worse, crate tarballs negatively impact the security of Gentoo
users as they make it harder to audit ebuilds, and third-party crate
tarballs add a further distinct party that can inject malicious code.
Considering the recent supply chain attacks, this alone is a show-stopper.
Why is this warning suddenly necessary? Did a user run into an issue
caused by more than 300 entries?
- Flow
1:
https://public-inbox.gentoo.org/gentoo-dev/[email protected]/
