All of lore.kernel.org
 help / color / mirror / Atom feed
* [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org
@ 2022-01-09 15:14 Romain Naour
  2022-01-09 15:14 ` [Buildroot] [PATCHv2 2/2] package/telegraf: new package Romain Naour
  2022-01-09 20:08 ` [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org Yann E. MORIN
  0 siblings, 2 replies; 5+ messages in thread
From: Romain Naour @ 2022-01-09 15:14 UTC (permalink / raw)
  To: buildroot; +Cc: Romain Naour, Thomas Petazzoni

While packaging telegraf [1] the download step failed due to a checksum
mismatch:

    go: downloading collectd.org v0.5.0
    get "collectd.org": found meta tag vcs.metaImport{Prefix:"collectd.org", VCS:"git", RepoRoot:"https://github.com/collectd/go-collectd"} at //collectd.org/?go-get=1
    verifying collectd.org@v0.5.0: checksum mismatch
        downloaded: h1:mRTLdljvxJNXPMMO9RSxf0PANDAqu/Tz+I6Dt6OjB28=
        go.sum:     h1:y4uFSAuOmeVhG3GCRa3/oH+ysePfO/+eGJNfd0Qa3d8=

    SECURITY ERROR
    This download does NOT match an earlier download recorded in go.sum.
    The bits may have been replaced on the origin server, or an attacker may
    have intercepted the download attempt.

    For more information, see 'go help module-auth'.

go-collectd was bumped in telegraf since several releases (since v1.19.0) without
any changes regarding the go-collectd hash.

Some users reported an issue [3] when using "GOPROXY=direct" and used
"GOPROXY=proxy.golang.org" as a workaround.

[1] https://github.com/influxdata/telegraf/
[2] https://github.com/influxdata/telegraf/commit/d4b051edc247a13d7fbdaa49d95fe6e93505d14e
[3] https://github.com/google/flatbuffers/issues/6466#issuecomment-781954742

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
---
 package/pkg-golang.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/pkg-golang.mk b/package/pkg-golang.mk
index 35bcb1673b..e23778d96a 100644
--- a/package/pkg-golang.mk
+++ b/package/pkg-golang.mk
@@ -85,7 +85,7 @@ $(2)_POST_PATCH_HOOKS += $(2)_GEN_GOMOD
 $(2)_DOWNLOAD_POST_PROCESS = go
 $(2)_DL_ENV = \
 	$(HOST_GO_COMMON_ENV) \
-	GOPROXY=direct \
+	GOPROXY=proxy.golang.org \
 	BR_GOMOD=$$($(2)_GOMOD)
 
 # Due to vendoring, it is pretty likely that not all licenses are
-- 
2.31.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 5+ messages in thread
* [Buildroot] [PATCHv2 2/2] package/telegraf: new package
  2022-01-09 15:14 [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org Romain Naour
@ 2022-01-09 15:14 ` Romain Naour
  2022-01-09 20:08 ` [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org Yann E. MORIN
  1 sibling, 0 replies; 5+ messages in thread
From: Romain Naour @ 2022-01-09 15:14 UTC (permalink / raw)
  To: buildroot; +Cc: Romain Naour

Install the telegraf default configuration and the systemd service files
provided by the project [1].

[1] https://github.com/influxdata/telegraf/blob/v1.21.2/scripts/deb/post-install.sh

Signed-off-by: Romain Naour <romain.naour@smile.fr>
---
Telegraf also provide an SysVinit script but I didn't tested it.

v2: re-add TELEGRAF_USERS removed while cleaning the package.
---
 DEVELOPERS                     |  1 +
 package/Config.in              |  1 +
 package/telegraf/Config.in     | 19 +++++++++++++++++
 package/telegraf/telegraf.hash |  3 +++
 package/telegraf/telegraf.mk   | 37 ++++++++++++++++++++++++++++++++++
 5 files changed, 61 insertions(+)
 create mode 100644 package/telegraf/Config.in
 create mode 100644 package/telegraf/telegraf.hash
 create mode 100644 package/telegraf/telegraf.mk

diff --git a/DEVELOPERS b/DEVELOPERS
index ed65c74319..ab4d5ba446 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -2462,6 +2462,7 @@ F:	package/solarus/
 F:	package/stress-ng/
 F:	package/supertux/
 F:	package/supertuxkart/
+F:	package/telegraf/
 F:	package/terminology/
 F:	package/tk/
 F:	package/upower/
diff --git a/package/Config.in b/package/Config.in
index 2d3ca6a3b6..d77c843465 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2595,6 +2595,7 @@ menu "System tools"
 	source "package/systemd-bootchart/Config.in"
 	source "package/sysvinit/Config.in"
 	source "package/tar/Config.in"
+	source "package/telegraf/Config.in"
 	source "package/thermald/Config.in"
 	source "package/tpm-tools/Config.in"
 	source "package/tpm2-abrmd/Config.in"
diff --git a/package/telegraf/Config.in b/package/telegraf/Config.in
new file mode 100644
index 0000000000..c95145f386
--- /dev/null
+++ b/package/telegraf/Config.in
@@ -0,0 +1,19 @@
+config BR2_PACKAGE_TELEGRAF
+	bool "telegraf"
+	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
+	depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS
+	depends on BR2_TOOLCHAIN_HAS_THREADS
+	depends on BR2_USE_MMU # logrotate
+	depends on BR2_USE_WCHAR # logrotate
+	select BR2_PACKAGE_LOGROTATE # runtime
+	help
+	  Telegraf is the open source server agent to help you
+	  collect metrics from your stacks, sensors and systems.
+
+	  https://www.influxdata.com/time-series-platform/telegraf
+
+comment "telegraf needs a toolchain w/ wchar, threads"
+	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
+	depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS
+	depends on !BR2_USE_WCHAR || !BR2_TOOLCHAIN_HAS_THREADS
+	depends on BR2_USE_MMU
diff --git a/package/telegraf/telegraf.hash b/package/telegraf/telegraf.hash
new file mode 100644
index 0000000000..0547621ea4
--- /dev/null
+++ b/package/telegraf/telegraf.hash
@@ -0,0 +1,3 @@
+# Locally computed:
+sha256  bdd33f9248872dca282f8649713dedf7fc0eafd8876664031fb37a0350059ab6  v1.21.2.tar.gz
+sha256  29d6b3c9c5671e8375a42bf4c5d4e85e05efd314ef363a56bb1728621e9cad5a  LICENSE
diff --git a/package/telegraf/telegraf.mk b/package/telegraf/telegraf.mk
new file mode 100644
index 0000000000..90156e4ca7
--- /dev/null
+++ b/package/telegraf/telegraf.mk
@@ -0,0 +1,37 @@
+################################################################################
+#
+# telegraf
+#
+################################################################################
+
+TELEGRAF_VERSION = 1.21.2
+TELEGRAF_SITE = https://github.com/influxdata/telegraf/archive
+TELEGRAF_SOURCE = v$(TELEGRAF_VERSION).tar.gz
+TELEGRAF_LICENSE = MIT
+TELEGRAF_LICENSE_FILES = LICENSE
+
+TELEGRAF_LDFLAGS = -X main.version=$(TELEGRAF_VERSION)
+TELEGRAF_BUILD_TARGETS = cmd/telegraf
+
+define TELEGRAF_INSTALL_TARGET_FIXUP
+	mkdir -p $(TARGET_DIR)/etc/telegraf/telegraf.d
+	$(INSTALL) -D -m 644 $(@D)/etc/telegraf.conf $(TARGET_DIR)/etc/telegraf.conf
+	mkdir -p $(TARGET_DIR)/etc/logrotate.d
+	$(INSTALL) -D -m 644 $(@D)/etc/logrotate.d/telegraf $(TARGET_DIR)/etc/logrotate.d/telegraf
+	mkdir -p $(TARGET_DIR)/etc/default
+	touch $(TARGET_DIR)/etc/default/telegraf
+endef
+
+TELEGRAF_POST_INSTALL_TARGET_HOOKS += TELEGRAF_INSTALL_TARGET_FIXUP
+
+define TELEGRAF_INSTALL_INIT_SYSTEMD
+	$(INSTALL) -D -m 644 $(@D)/scripts/telegraf.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/telegraf.service
+endef
+
+# telegraf.service provided by telegraf use "telegraf" user to start the service.
+define TELEGRAF_USERS
+	telegraf -1 telegraf -1 * /etc/telegraf - - Telegraf user
+endef
+
+$(eval $(golang-package))
-- 
2.31.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org
  2022-01-09 15:14 [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org Romain Naour
  2022-01-09 15:14 ` [Buildroot] [PATCHv2 2/2] package/telegraf: new package Romain Naour
@ 2022-01-09 20:08 ` Yann E. MORIN
  2022-01-09 21:42   ` Romain Naour
  1 sibling, 1 reply; 5+ messages in thread
From: Yann E. MORIN @ 2022-01-09 20:08 UTC (permalink / raw)
  To: Romain Naour; +Cc: Thomas Petazzoni, buildroot

Romain, All,

On 2022-01-09 16:14 +0100, Romain Naour spake thusly:
> While packaging telegraf [1] the download step failed due to a checksum
> mismatch:
> 
>     go: downloading collectd.org v0.5.0
>     get "collectd.org": found meta tag vcs.metaImport{Prefix:"collectd.org", VCS:"git", RepoRoot:"https://github.com/collectd/go-collectd"} at //collectd.org/?go-get=1
>     verifying collectd.org@v0.5.0: checksum mismatch
>         downloaded: h1:mRTLdljvxJNXPMMO9RSxf0PANDAqu/Tz+I6Dt6OjB28=
>         go.sum:     h1:y4uFSAuOmeVhG3GCRa3/oH+ysePfO/+eGJNfd0Qa3d8=
> 
>     SECURITY ERROR
>     This download does NOT match an earlier download recorded in go.sum.
>     The bits may have been replaced on the origin server, or an attacker may
>     have intercepted the download attempt.
> 
>     For more information, see 'go help module-auth'.
> 
> go-collectd was bumped in telegraf since several releases (since v1.19.0) without
> any changes regarding the go-collectd hash.
> 
> Some users reported an issue [3] when using "GOPROXY=direct" and used
> "GOPROXY=proxy.golang.org" as a workaround.

I'll put down what we discussed on IRC:

Unfortunately, there are cases the other way around: using a proxy broke
the vendoring, while a direct connection solved it. So we won't be able
to satisfy both cases.

Furthermore, relying on a proxy having a cached archive risks breaking
in the future anyway, as that archived may get eventually get evicted
out of the cache of the proxy. Or the proxy may disapear in the future,
or whatever.

In any case, a bad hash is most probably due to one of the following
issues:

  - upstream messed up when adding the dependency and incorrectly copied
    the hash (but that should not happen as adding a dependency is
    supposed to be done with go tools already),

  - the upstream of the dependency changed their release (i.e. they
    re-tagged a release)

  - the go proxy is caching an incorrect archive (e.g. a partial
    download, or an older archive, or is malicious, or whatever).

In any case, we can't do anything about it, and the upstream of the
project has to fix the mess.

So, from my point of view, this is a NACK on this patch.

Regards,
Yann E. MORIN.

> [1] https://github.com/influxdata/telegraf/
> [2] https://github.com/influxdata/telegraf/commit/d4b051edc247a13d7fbdaa49d95fe6e93505d14e
> [3] https://github.com/google/flatbuffers/issues/6466#issuecomment-781954742
> 
> Signed-off-by: Romain Naour <romain.naour@smile.fr>
> Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
> ---
>  package/pkg-golang.mk | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/package/pkg-golang.mk b/package/pkg-golang.mk
> index 35bcb1673b..e23778d96a 100644
> --- a/package/pkg-golang.mk
> +++ b/package/pkg-golang.mk
> @@ -85,7 +85,7 @@ $(2)_POST_PATCH_HOOKS += $(2)_GEN_GOMOD
>  $(2)_DOWNLOAD_POST_PROCESS = go
>  $(2)_DL_ENV = \
>  	$(HOST_GO_COMMON_ENV) \
> -	GOPROXY=direct \
> +	GOPROXY=proxy.golang.org \
>  	BR_GOMOD=$$($(2)_GOMOD)
>  
>  # Due to vendoring, it is pretty likely that not all licenses are
> -- 
> 2.31.1
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org
  2022-01-09 20:08 ` [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org Yann E. MORIN
@ 2022-01-09 21:42   ` Romain Naour
  2022-01-23 15:20     ` Romain Naour
  0 siblings, 1 reply; 5+ messages in thread
From: Romain Naour @ 2022-01-09 21:42 UTC (permalink / raw)
  To: Yann E. MORIN; +Cc: Thomas Petazzoni, buildroot

Hello Yann, All,

Le 09/01/2022 à 21:08, Yann E. MORIN a écrit :
> Romain, All,
> 
> On 2022-01-09 16:14 +0100, Romain Naour spake thusly:
>> While packaging telegraf [1] the download step failed due to a checksum
>> mismatch:
>>
>>     go: downloading collectd.org v0.5.0
>>     get "collectd.org": found meta tag vcs.metaImport{Prefix:"collectd.org", VCS:"git", RepoRoot:"https://github.com/collectd/go-collectd"} at //collectd.org/?go-get=1
>>     verifying collectd.org@v0.5.0: checksum mismatch
>>         downloaded: h1:mRTLdljvxJNXPMMO9RSxf0PANDAqu/Tz+I6Dt6OjB28=
>>         go.sum:     h1:y4uFSAuOmeVhG3GCRa3/oH+ysePfO/+eGJNfd0Qa3d8=
>>
>>     SECURITY ERROR
>>     This download does NOT match an earlier download recorded in go.sum.
>>     The bits may have been replaced on the origin server, or an attacker may
>>     have intercepted the download attempt.
>>
>>     For more information, see 'go help module-auth'.
>>
>> go-collectd was bumped in telegraf since several releases (since v1.19.0) without
>> any changes regarding the go-collectd hash.
>>
>> Some users reported an issue [3] when using "GOPROXY=direct" and used
>> "GOPROXY=proxy.golang.org" as a workaround.
> 
> I'll put down what we discussed on IRC:
> 
> Unfortunately, there are cases the other way around: using a proxy broke
> the vendoring, while a direct connection solved it. So we won't be able
> to satisfy both cases.

Sure, at least I posted the workaround on the ml.

> 
> Furthermore, relying on a proxy having a cached archive risks breaking
> in the future anyway, as that archived may get eventually get evicted
> out of the cache of the proxy. Or the proxy may disapear in the future,
> or whatever.
> 
> In any case, a bad hash is most probably due to one of the following
> issues:
> 
>   - upstream messed up when adding the dependency and incorrectly copied
>     the hash (but that should not happen as adding a dependency is
>     supposed to be done with go tools already),
> 
>   - the upstream of the dependency changed their release (i.e. they
>     re-tagged a release)
> 
>   - the go proxy is caching an incorrect archive (e.g. a partial
>     download, or an older archive, or is malicious, or whatever).
> 
> In any case, we can't do anything about it, and the upstream of the
> project has to fix the mess.
> 
> So, from my point of view, this is a NACK on this patch.

I created an issue on Telegraf github:
https://github.com/influxdata/telegraf/issues/10408

Best regards,
Romain


> 
> Regards,
> Yann E. MORIN.
> 
>> [1] https://github.com/influxdata/telegraf/
>> [2] https://github.com/influxdata/telegraf/commit/d4b051edc247a13d7fbdaa49d95fe6e93505d14e
>> [3] https://github.com/google/flatbuffers/issues/6466#issuecomment-781954742
>>
>> Signed-off-by: Romain Naour <romain.naour@smile.fr>
>> Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
>> ---
>>  package/pkg-golang.mk | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/package/pkg-golang.mk b/package/pkg-golang.mk
>> index 35bcb1673b..e23778d96a 100644
>> --- a/package/pkg-golang.mk
>> +++ b/package/pkg-golang.mk
>> @@ -85,7 +85,7 @@ $(2)_POST_PATCH_HOOKS += $(2)_GEN_GOMOD
>>  $(2)_DOWNLOAD_POST_PROCESS = go
>>  $(2)_DL_ENV = \
>>  	$(HOST_GO_COMMON_ENV) \
>> -	GOPROXY=direct \
>> +	GOPROXY=proxy.golang.org \
>>  	BR_GOMOD=$$($(2)_GOMOD)
>>  
>>  # Due to vendoring, it is pretty likely that not all licenses are
>> -- 
>> 2.31.1
>>
>> _______________________________________________
>> buildroot mailing list
>> buildroot@buildroot.org
>> https://lists.buildroot.org/mailman/listinfo/buildroot
> 

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org
  2022-01-09 21:42   ` Romain Naour
@ 2022-01-23 15:20     ` Romain Naour
  0 siblings, 0 replies; 5+ messages in thread
From: Romain Naour @ 2022-01-23 15:20 UTC (permalink / raw)
  To: Yann E. MORIN; +Cc: Thomas Petazzoni, buildroot

Hello Yann,

Le 09/01/2022 à 22:42, Romain Naour a écrit :
> Hello Yann, All,
> 
> Le 09/01/2022 à 21:08, Yann E. MORIN a écrit :
>> Romain, All,
>>
>> On 2022-01-09 16:14 +0100, Romain Naour spake thusly:
>>> While packaging telegraf [1] the download step failed due to a checksum
>>> mismatch:
>>>
>>>     go: downloading collectd.org v0.5.0
>>>     get "collectd.org": found meta tag vcs.metaImport{Prefix:"collectd.org", VCS:"git", RepoRoot:"https://github.com/collectd/go-collectd"} at //collectd.org/?go-get=1
>>>     verifying collectd.org@v0.5.0: checksum mismatch
>>>         downloaded: h1:mRTLdljvxJNXPMMO9RSxf0PANDAqu/Tz+I6Dt6OjB28=
>>>         go.sum:     h1:y4uFSAuOmeVhG3GCRa3/oH+ysePfO/+eGJNfd0Qa3d8=
>>>
>>>     SECURITY ERROR
>>>     This download does NOT match an earlier download recorded in go.sum.
>>>     The bits may have been replaced on the origin server, or an attacker may
>>>     have intercepted the download attempt.
>>>
>>>     For more information, see 'go help module-auth'.
>>>
>>> go-collectd was bumped in telegraf since several releases (since v1.19.0) without
>>> any changes regarding the go-collectd hash.
>>>
>>> Some users reported an issue [3] when using "GOPROXY=direct" and used
>>> "GOPROXY=proxy.golang.org" as a workaround.
>>
>> I'll put down what we discussed on IRC:
>>
>> Unfortunately, there are cases the other way around: using a proxy broke
>> the vendoring, while a direct connection solved it. So we won't be able
>> to satisfy both cases.
> 
> Sure, at least I posted the workaround on the ml.
> 
>>
>> Furthermore, relying on a proxy having a cached archive risks breaking
>> in the future anyway, as that archived may get eventually get evicted
>> out of the cache of the proxy. Or the proxy may disapear in the future,
>> or whatever.
>>
>> In any case, a bad hash is most probably due to one of the following
>> issues:
>>
>>   - upstream messed up when adding the dependency and incorrectly copied
>>     the hash (but that should not happen as adding a dependency is
>>     supposed to be done with go tools already),
>>
>>   - the upstream of the dependency changed their release (i.e. they
>>     re-tagged a release)
>>
>>   - the go proxy is caching an incorrect archive (e.g. a partial
>>     download, or an older archive, or is malicious, or whatever).
>>
>> In any case, we can't do anything about it, and the upstream of the
>> project has to fix the mess.
>>
>> So, from my point of view, this is a NACK on this patch.
> 
> I created an issue on Telegraf github:
> https://github.com/influxdata/telegraf/issues/10408

The issue has been reported to go-collectd project but not reply so far [1]

But using GOPROXY=direct is a problem itself since some git repositories are
altered or disappear after a release.

Building telegraf outside of Buildroot with GOPROXY=direct doesn't reach the
collectd problem anymore since it fail earlier due to a missing dependency

$ git clone https://github.com/influxdata/telegraf.git
$ git checkout release-1.21
$ GOPROXY=direct go mod vendor -v -modcacherw

go: github.com/harlow/kinesis-consumer@v0.3.6-0.20210911031324-5a873d6e9fec:
invalid version: unknown revision 5a873d6e9fec

https://github.com/harlow/kinesis-consumer/commit/5a873d6e9fec
"This commit does not belong to any branch on this repository, and may belong to
a fork outside of the repository."

Telegraf 1.21 build fine using GOPROXY=proxy.golang.org.

The Buildroot build seems to mix a direct download and proxy download even if we
use GOPROXY=direct:

proxy download:
go: downloading github.com/harlow/kinesis-consumer
v0.3.6-0.20210911031324-5a873d6e9fec

direct download:
get "collectd.org": found meta tag vcs.metaImport{Prefix:"collectd.org",
VCS:"git", RepoRoot:"https://github.com/collectd/go-collectd"} at
//collectd.org/?go-get=1
go: downloading github.com/antchfx/jsonquery v1.1.4
verifying collectd.org@v0.5.0: checksum mismatch
	downloaded: h1:mRTLdljvxJNXPMMO9RSxf0PANDAqu/Tz+I6Dt6OjB28=
	go.sum:     h1:y4uFSAuOmeVhG3GCRa3/oH+ysePfO/+eGJNfd0Qa3d8=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

See infos about GOPROXY [2].

Cloning all git repo is really slow and use a lot of disk space, 5Go for
telegraf. We can use GOPROXY="proxy.golang.org,direct" to use direct download as
a fallback [3].

But GOPROXY doesn't save all modules forever [4]
"Why did a previously available module become unavailable in the mirror?

proxy.golang.org does not save all modules forever. There are a number of
reasons for this, but one reason is if proxy.golang.org is not able to detect a
suitable license. In this case, only a temporarily cached copy of the module
will be made available, and may become unavailable if it is removed from the
original source and becomes outdated. The checksums will still remain in the
checksum database regardless of whether or not they have become unavailable in
the mirror."

So we don't have any reliable way to retrieve all required sources to build go
packages from sources. Telegraf fetch several hundred of git repository
(sometime from personal repos)...

[1] https://github.com/collectd/go-collectd/issues/94
[2] https://arslan.io/2019/08/02/why-you-should-use-a-go-module-proxy
[3] https://github.com/renovatebot/renovate/issues/7233
[4] https://proxy.golang.org/

Best regards,
Romain


> 
> Best regards,
> Romain
> 
> 
>>
>> Regards,
>> Yann E. MORIN.
>>
>>> [1] https://github.com/influxdata/telegraf/
>>> [2] https://github.com/influxdata/telegraf/commit/d4b051edc247a13d7fbdaa49d95fe6e93505d14e
>>> [3] https://github.com/google/flatbuffers/issues/6466#issuecomment-781954742
>>>
>>> Signed-off-by: Romain Naour <romain.naour@smile.fr>
>>> Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
>>> ---
>>>  package/pkg-golang.mk | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/package/pkg-golang.mk b/package/pkg-golang.mk
>>> index 35bcb1673b..e23778d96a 100644
>>> --- a/package/pkg-golang.mk
>>> +++ b/package/pkg-golang.mk
>>> @@ -85,7 +85,7 @@ $(2)_POST_PATCH_HOOKS += $(2)_GEN_GOMOD
>>>  $(2)_DOWNLOAD_POST_PROCESS = go
>>>  $(2)_DL_ENV = \
>>>  	$(HOST_GO_COMMON_ENV) \
>>> -	GOPROXY=direct \
>>> +	GOPROXY=proxy.golang.org \
>>>  	BR_GOMOD=$$($(2)_GOMOD)
>>>  
>>>  # Due to vendoring, it is pretty likely that not all licenses are
>>> -- 
>>> 2.31.1
>>>
>>> _______________________________________________
>>> buildroot mailing list
>>> buildroot@buildroot.org
>>> https://lists.buildroot.org/mailman/listinfo/buildroot
>>
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
> 

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-01-23 15:20 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-09 15:14 [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org Romain Naour
2022-01-09 15:14 ` [Buildroot] [PATCHv2 2/2] package/telegraf: new package Romain Naour
2022-01-09 20:08 ` [Buildroot] [PATCHv2 1/2] package/pkg-golang.mk: set GOPROXY to proxy.golang.org Yann E. MORIN
2022-01-09 21:42   ` Romain Naour
2022-01-23 15:20     ` Romain Naour

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.