Re: [go-nuts] Re: module confusion
On 8/17/20 08:41, fge...@gmail.com wrote: On 8/17/20, 'K Richard Pixley' via golang-nuts wrote: On 8/15/20 00:43, fge...@gmail.com wrote: On 8/15/20, Marvin Renich wrote: * Volker Dobler [200814 14:53]: On Friday, 14 August 2020 20:39:37 UTC+2, K Richard Pixley wrote: Isn't this the default location? I just untarred the distribution... No. There is a reason https://urldefense.com/v3/__https://golang.org/doc/install*install__;Iw!!NEt6yMaO-gk!R3z5eGP7tSVHh9dkw1eEv-l-WAko3RdxhuxICWySuRetk6bW0W3c9v5JhOxueCU2Ww$ states to do tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz It also might be productive to mention that many (Linux?) distributions (e.g. Debian, Fedora, RHEL) provide reasonably up-to-date packages for Go, and that using the distribution's package manager may be easier, provide better security support, and integrate better than manually installing the official Go binary distribution. Could you please give an example to "better security support" in a distribution's package manager? Part of the job of a distribution is integration. Who owns which files, where they are stored, and who has access to them are all under the auspices of integration. Go itself can't really be expected to manage all of those details for every single distribution that might ever exist. But the local package manager can, and typically does both own and manage those details. Oh but yes, I expect that the current Go installation scheme is expected to manage all those details (a user's private namespace), so it shall be a viable alternative for quite a long time. (Although my imagination is limited, at the moment I can't imagine a change where the all too frequent global namespace pollution of operating system packages, which as I understand you can call management if you like, would mess up the private namespace of a user that much. At least for the mainstream desktop and server operating systems.) I think you're missing my point. Let me try again. If the standard location for the go compiler is /usr/local/go/bin and anyone with access to that file system can, at will, install a new compiler, then the other users are at their mercy. Policies for who can or can't install a new /usr/local/go/bin/go are up to the distribution and generally handled by the distribution's packaging and integration policies. Eg, is it owned by root? By bin? By "golang"? What group? Is /usr/local/go/bin a local file system? Shared, perhaps by NFS or ceph? Or duplicated and distributed read-only as a cloud based filesystem on a cloud-based-block-device? These are all decisions made by system admins in concert with the distribution they're using. The distributors of golang proper can't really be held responsible for each and every possible local convention. But the local sysadmins, (in concert with their distribution), certainly can. Anyway, this is a level of security that cannot reasonably be expected of the golang team but can, and typically is, expected from distributions. I believe that is an answer to the question that was asked. -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/d4bdebc9-3387-5ab4-dcfb-4c7602b16360%40juniper.net.
Re: [go-nuts] Re: module confusion
On 8/17/20, 'K Richard Pixley' via golang-nuts wrote: > On 8/15/20 00:43, fge...@gmail.com wrote: >> On 8/15/20, Marvin Renich wrote: >>> * Volker Dobler [200814 14:53]: On Friday, 14 August 2020 20:39:37 UTC+2, K Richard Pixley wrote: > Isn't this the default location? I just untarred the distribution... No. There is a reason https://urldefense.com/v3/__https://golang.org/doc/install*install__;Iw!!NEt6yMaO-gk!R3z5eGP7tSVHh9dkw1eEv-l-WAko3RdxhuxICWySuRetk6bW0W3c9v5JhOxueCU2Ww$ states to do tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz >> >>> It also might be productive to mention that many (Linux?) distributions >>> (e.g. Debian, Fedora, RHEL) provide reasonably up-to-date packages for >>> Go, and that using the distribution's package manager may be easier, >>> provide better security support, and integrate better than manually >>> installing the official Go binary distribution. >> Could you please give an example to "better security support" in a >> distribution's package manager? > Part of the job of a distribution is integration. Who owns which files, > where they are stored, and who has access to them are all under the > auspices of integration. Go itself can't really be expected to manage > all of those details for every single distribution that might ever > exist. But the local package manager can, and typically does both own > and manage those details. Oh but yes, I expect that the current Go installation scheme is expected to manage all those details (a user's private namespace), so it shall be a viable alternative for quite a long time. (Although my imagination is limited, at the moment I can't imagine a change where the all too frequent global namespace pollution of operating system packages, which as I understand you can call management if you like, would mess up the private namespace of a user that much. At least for the mainstream desktop and server operating systems.) -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/CA%2BctqrpwaRji30_iZdff9qTU8foUvnDW%3D7yZr%3D-wJ5e_ACUXSQ%40mail.gmail.com.
Re: [go-nuts] Re: module confusion
On 8/15/20 00:43, fge...@gmail.com wrote: On 8/15/20, Marvin Renich wrote: * Volker Dobler [200814 14:53]: On Friday, 14 August 2020 20:39:37 UTC+2, K Richard Pixley wrote: Isn't this the default location? I just untarred the distribution... No. There is a reason https://urldefense.com/v3/__https://golang.org/doc/install*install__;Iw!!NEt6yMaO-gk!R3z5eGP7tSVHh9dkw1eEv-l-WAko3RdxhuxICWySuRetk6bW0W3c9v5JhOxueCU2Ww$ states to do tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz It also might be productive to mention that many (Linux?) distributions (e.g. Debian, Fedora, RHEL) provide reasonably up-to-date packages for Go, and that using the distribution's package manager may be easier, provide better security support, and integrate better than manually installing the official Go binary distribution. Could you please give an example to "better security support" in a distribution's package manager? Part of the job of a distribution is integration. Who owns which files, where they are stored, and who has access to them are all under the auspices of integration. Go itself can't really be expected to manage all of those details for every single distribution that might ever exist. But the local package manager can, and typically does both own and manage those details. -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/3aa69778-c8df-ef57-04ca-6356d4a99331%40juniper.net.
Re: [go-nuts] Re: module confusion
On Sun, Aug 16, 2020, 04:42 Marvin Renich wrote: > * fge...@gmail.com [200815 03:44]: > > On 8/15/20, Marvin Renich wrote: > > > * Volker Dobler [200814 14:53]: > > >> On Friday, 14 August 2020 20:39:37 UTC+2, K Richard Pixley wrote: > > >> > Isn't this the default location? I just untarred the > distribution... > > >> > > >> No. There is a reason https://golang.org/doc/install#install > > >> states to do tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz > > > > > > > > It also might be productive to mention that many (Linux?) distributions > > > (e.g. Debian, Fedora, RHEL) provide reasonably up-to-date packages for > > > Go, and that using the distribution's package manager may be easier, > > > provide better security support, and integrate better than manually > > > installing the official Go binary distribution. > > > > Could you please give an example to "better security support" in a > > distribution's package manager? > > The user can let the package manager automatically update packages with > security fixes (at least in Debian) so the user doesn't have to stay on > top of when a security update is available and manually reinstall the > updated version of Go. (Think of trying to do this individually for > every piece of software installed on your system.) > > Perhaps "simpler" would have been a better word than "better". One of > the big reasons to use packages from a distribution rather than > installing each one from source or from upstream's binary packages is to > simplify system maintenance. > > ...Marvin > Let's just agree that the automated update scheme can be simple to some and confusing to others. Iirc that's one of the reasons why different package managers aren't mentioned or supported. If you search the list for earlier messages about the os provided package management from a couple of years ago, you'll maybe find different reasons as well. -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/CA%2BctqrpOAEWbP9hcMKCP2%2B9sTEZS2gtzyuynbgUuav5dnL%3D6pw%40mail.gmail.com.
Re: [go-nuts] Re: module confusion
* fge...@gmail.com [200815 03:44]: > On 8/15/20, Marvin Renich wrote: > > * Volker Dobler [200814 14:53]: > >> On Friday, 14 August 2020 20:39:37 UTC+2, K Richard Pixley wrote: > >> > Isn't this the default location? I just untarred the distribution... > >> > >> No. There is a reason https://golang.org/doc/install#install > >> states to do tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz > > > > > It also might be productive to mention that many (Linux?) distributions > > (e.g. Debian, Fedora, RHEL) provide reasonably up-to-date packages for > > Go, and that using the distribution's package manager may be easier, > > provide better security support, and integrate better than manually > > installing the official Go binary distribution. > > Could you please give an example to "better security support" in a > distribution's package manager? The user can let the package manager automatically update packages with security fixes (at least in Debian) so the user doesn't have to stay on top of when a security update is available and manually reinstall the updated version of Go. (Think of trying to do this individually for every piece of software installed on your system.) Perhaps "simpler" would have been a better word than "better". One of the big reasons to use packages from a distribution rather than installing each one from source or from upstream's binary packages is to simplify system maintenance. ...Marvin -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/20200815202206.6b7qbvc6kg4lzjh4%40basil.wdw.
Re: [go-nuts] Re: module confusion
On 8/15/20, Marvin Renich wrote: > * Volker Dobler [200814 14:53]: >> On Friday, 14 August 2020 20:39:37 UTC+2, K Richard Pixley wrote: >> > Isn't this the default location? I just untarred the distribution... >> >> No. There is a reason https://golang.org/doc/install#install >> states to do tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz > > It also might be productive to mention that many (Linux?) distributions > (e.g. Debian, Fedora, RHEL) provide reasonably up-to-date packages for > Go, and that using the distribution's package manager may be easier, > provide better security support, and integrate better than manually > installing the official Go binary distribution. Could you please give an example to "better security support" in a distribution's package manager? -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/CA%2BctqrqLaCVbHr8W4swdVZqd9hFNzEUDcdRh3yJopRhc_cxpng%40mail.gmail.com.
Re: [go-nuts] Re: module confusion
* Volker Dobler [200814 14:53]: > On Friday, 14 August 2020 20:39:37 UTC+2, K Richard Pixley wrote: > > Isn't this the default location? I just untarred the distribution... > > No. There is a reason https://golang.org/doc/install#install > states to do tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz While (I believe) the majority of individuals (rather than sysadmins) installing on Linux, MacOS, and FreeBSD will be the primary (essentially sole) user on such systems, and will be able to use /usr/local (usually requiring su or sudo or modifying permissions on /usr/local, which is not mentioned in the above referenced instructions), this is not a universal condition. Especially, students at universities using an account on a university machine will generally not have access to /usr/local. I think this is a significant enough use case to warrant a mention in the installation instructions, e.g. If you do not have access to /usr/local, or do not wish to install there, you may install to another directory, such as $HOME/goroot. The directory $HOME should not be used, as this would make $GOROOT the same as the default $GOPATH ($HOME/go), which is not allowed. Anything along these lines would help alleviate the confusion that the OP had. It also might be productive to mention that many (Linux?) distributions (e.g. Debian, Fedora, RHEL) provide reasonably up-to-date packages for Go, and that using the distribution's package manager may be easier, provide better security support, and integrate better than manually installing the official Go binary distribution. ...Marvin -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/20200814233137.dujkksays2luoqyt%40basil.wdw.
Re: [go-nuts] Re: module confusion
On 8/14/20 11:54, 'Carla Pfaff' via golang-nuts wrote: People and installers usually install Go in /usr/local/go on Unix-like systems. ~/go is the default GOPATH if not set, so ~/go/bin is where binaries installed via "go get" / "go install" land. But the Go distribution itself must not be under GOPATH. Thank you for the clarification. I think that's exceeding confusing and needs much better documentation. In particular, I think the installation instructions should suggest a private install location if the obvious one isn't useful. -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/837af448-8a1c-7c27-3280-cddc15b9fd5e%40juniper.net.
Re: [go-nuts] Re: module confusion
People and installers usually install Go in /usr/local/go on Unix-like systems. ~/go is the default GOPATH if not set, so ~/go/bin is where binaries installed via "go get" / "go install" land. But the Go distribution itself must not be under GOPATH. -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/fb4aeee2-53fd-49cd-b42c-b247ad332e4bn%40googlegroups.com.
Re: [go-nuts] Re: module confusion
On Friday, 14 August 2020 20:39:37 UTC+2, K Richard Pixley wrote: > > Isn't this the default location? I just untarred the distribution... > No. There is a reason https://golang.org/doc/install#install states to do tar -C /usr/local -xzf go$VERSION.$OS-$ARCH.tar.gz V. -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/74cf0d07-3d1a-4029-888c-74d8addcb891o%40googlegroups.com.
Re: [go-nuts] Re: module confusion
On 8/14/20 11:27, 'Carla Pfaff' via golang-nuts wrote: This has nothing to do with modules. You're still using the old GOPATH mode, because you're not in a directory with a go.mod file. GOPATH defaults to $HOME/go when it's not set (since 1.8), but that's where you chose to put your Go installation. This is not allowed. Either install Go to a different location, or set GOPATH to a different location. Isn't this the default location? I just untarred the distribution... The default gobin is ~/go/bin, no? So I should be untarring in ~, no? -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/394cb232-e392-3ce7-077d-775ad17598e2%40juniper.net.
[go-nuts] Re: module confusion
This has nothing to do with modules. You're still using the old GOPATH mode, because you're not in a directory with a go.mod file. GOPATH defaults to $HOME/go when it's not set (since 1.8), but that's where you chose to put your Go installation. This is not allowed. Either install Go to a different location, or set GOPATH to a different location. -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/722d0683-ceaf-4e7e-81a5-996e9abc5fabn%40googlegroups.com.
