[Buildroot] [PATCH v2 05/12] support/download/go-post-process: implement Go vendoring support

Christian Stewart christian at paral.in
Thu Jul 29 20:17:09 UTC 2021


Thomas, all,


On Sat, Dec 19, 2020 at 7:35 AM Thomas Petazzoni
<thomas.petazzoni at bootlin.com> wrote:
> The logic to generate go.mod when not available is moved to the
> download post-process helper, as it must be done before "go mod
> vendor" is executed. Also, "go mod init" is used instead of manually
> crafting go.mod. This was suggested by Christian Stewart
> <christian at paral.in>. The Go module name is passed down to
> go-post-process using the BR_GOMOD environment variable.

> +go mod vendor -v -modcacherw
> +popd > /dev/null
> +
> +repack ${base_name} ${output}

This works fine in most cases, however, this causes inconsistent hashes.

On my system, the hash is correct after re-pack. But on 2 of my users
machines, the hash ends up different.

So something specific to the host machine must be influencing the hash
of the repacked archive.

It's either something in "go mod vendor" that's not deterministic, or
maybe host Go is being used instead of the one compiled by Buildroot,
or perhaps it's not possible to always get deterministic hashes this
way.

Can we possibly switch to hashing the download /before/ re-packing it,
given that Go verifies the hashes in go.sum automatically as part of
the "go mod vendor" step?

Go mod vendor will fail if any of the dependencies are different, the
checksums are included in go.sum

Thanks & best regards,
Christian Stewart


More information about the buildroot mailing list