On 3/31/20 8:48 PM, Samuel Bernardo wrote: > > My question started with the network sandbox issue when we need to load > external code dependencies. For example, a go project will download all > dependencies from git repositories that will happen after src_unpack. In > this case I need to add an additional tar.gz with that code along with > the software release tar.gz. > That additional tar.gz needs to be stored somewhere and as I understand > local mirror could be the right place.
Normally we don't bundle dependencies, avoiding that problem entirely. The Go eclasses however are badly designed, committed against protest by paid corporate interests, and serve only to facilitate large-scale copyright infringement and security vulnerabilities. If you're looking for a consistent explanation of how they're supposed to work with the rest of Gentoo, you won't find one.
