[pkg-go] Bug#851817: Bug#851817: Vendoring libraries

[Martín Ferrari]

severity 851817 normal
thanks

Hi,

On 18/01/17 22:15, Haruki TSURUMOTO wrote:

> Dear maintainers,
> Prometheus depends on many libraries, including source codes located
> into vendor directory.
> Is this a violation for Debian Policy 4.13 ?
> "4.13 Convenience copies of code"
> https://www.debian.org/doc/debian-policy/ch-source.html#s-embeddedfiles
> 
> Some libraries of vendor/*  had already packaged in Debian,
>  (ex: golang-github-hashicorp-go-cleanhttp-dev,
> golang-github-hashicorp-consul-dev)
> Can't we use these instead of vendoring method ?

When I packaged the prometheus ecosystem, most of the vendored
dependencies were not present in Debian. I packaged about 30 different
libraries to remove vendoring and left just a couple of them. There were
a couple of libs that were just too small and specific to justify
separate packages (not used directly by prometheus), and in the case of
the consul API because there is an API incompatibility with the package
present in Debian.

I will review this to see again if the vendoring can be removed. But I
disagree with the severity of this bug, the policy only marks this
requirement as a "should", so it is not serious.


-- 
Martín Ferrari (Tincho)