Subject: bug#76444: closed (Re: bug#76444: [PATCH v1] gnu: go-github-com-hanwen-go-fuse-v2: Downgrade to 2.5.0. (Closes: #76444))

From: [email-masked] (GNU bug Tracking System)
Date: Thu, 20 Feb 2025 21:04:03 +0000

Your bug report

#76444: [PATCH] Blind update of Hanwen's go-fuse broke Gocryptfs

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
76444: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=76444
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#76444: [PATCH v1] gnu: go-github-com-hanwen-go-fuse-v2: Downgrade to 2.5.0. (Closes: #76444)
From: Leo Famulari <[email-masked]>
To: Felix Lechner via Bug reports for GNU Guix <[email-masked]>
Cc: [email-masked], Felix Lechner <[email-masked]>
Date: Thu, 20 Feb 2025 16:03:18 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

On Thu, Feb 20, 2025 at 11:26:27AM -0800, Felix Lechner via Bug reports for GNU Guix wrote:
> Change-Id: Idf9059dc969b3c4447e2576ae0601199f20e2525

I wrote the commit message and pushed as
1ce2226aec1e5b5f5cdeff47c0452a46e6c608a5

Subject: [PATCH] Blind update of Hanwen's go-fuse broke Gocryptfs
From: Felix Lechner <[email-masked]>
To: [email-masked]
Date: Thu, 20 Feb 2025 10:59:21 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

Package: guix
Severity: grave
Tags: patch

Hi,

The blind update of Hanwen's go-fuse to 2.7.2 [1] broke Gocryptfs. [2]

I have a working patch, which will appear here shortly.

As a general note, I disagree with Guix's stance to diverge from go.mod
when present.  I spent several hours tracking down the error and testing
the fix (not to mention bothering upstream) for nothing.  It should have
never happened

Meanwhile, I was unable to log in. [3]

It is a gross overestimation that the Go team can outsmart upstream
developers who provide a specific list of prerequisites.  It's also an
error because packaging Goland prerequisites---if one can call it
that---involves no more than tarring up source files.  That step has few
prerequisites and rebuids are rare.  Multiple source versions do not
burden the substitute servers.

The security argument is likewise bogus, as this bug shows.  Any changes
to the prerequisites should be submitted upstream (or be patched when
upstream is unresponsive).

There are several ways to implement prerequisite tracking: Maybe it's
switching package variables to functions that pull the correct version
(or commit).  The consuming package definition should then be generated
from go.mod when present.  Thanks!

Kind regards
Felix

P.S. Sharlatan, thanks for fixing Bug#71795!

[1] https://git.savannah.gnu.org/cgit/guix.git/commit/?id=d12c7edb32e3a3b2f57e8afee7ddcf4f7015363e
[2] https://github.com/rfjakob/gocryptfs/issues/897
[3] https://debbugs.gnu.org/cgi/bugreport.cgi?bug=76105#11