Re: [pkg-go] [pkg-golang-devel] Security support for packages written in Go

2016-07-11 Thread Florian Weimer
* Michael Hudson-Doyle: > On 10 July 2016 at 07:39, Florian Weimer <f...@deneb.enyo.de> wrote: >> * Dmitry Smirnov: >> >>> On Friday, 8 July 2016 8:53:20 AM AEST Florian Weimer wrote: >>>> Part of the problem is that we currently lack a decent way t

Re: [pkg-go] Security support for packages written in Go

2016-07-09 Thread Florian Weimer
* Dmitry Smirnov: > On Friday, 8 July 2016 8:53:20 AM AEST Florian Weimer wrote: >> Part of the problem is that we currently lack a decent way to list all >> these reverse dependencies. > > We can get list of all source packages to re-build from reverse build > depe

Re: [pkg-go] Security support for packages written in Go

2016-04-12 Thread Florian Weimer
* Michael Hudson-Doyle: > There is another approach to the static linking issue, which is to > start using dynamic linking instead. It's implemented upstream for > most architectures now (only mips64 le/be and ppc64 be missing I > think). I'm going to be working on starting to use dynamic linking

Re: [pkg-go] Security support for packages written in Go

2016-04-05 Thread Florian Weimer
* Martín Ferrari: >> The alternative is to rebuild reverse dependencies as needed. I can >> see two challenges with that. Right now, the Built-Using field only >> records the source versions of the *direct* dependencies (based on the >> dh_golang manual page and a few examples I looked at). If

[pkg-go] Security support for packages written in Go

2016-04-05 Thread Florian Weimer
Hi, we need to discuss how we can support applications written in Go for stretch. The most radical approach would be not to ship any Go applications in stretch, only the basic Go language implementations. This is probably not desirable. So we need something to deal with the static linking