Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
  • T tor-browser-build
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 222
    • Issues 222
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 7
    • Merge requests 7
  • Deployments
    • Deployments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • Repository
  • Wiki
    • Wiki
  • Activity
  • Graph
  • Create a new issue
  • Commits
  • Issue Boards
Collapse sidebar

Admin message

GitLab has been upgraded GitLab 16, please report any issues!

  • The Tor Project
  • Applications
  • tor-browser-build
  • Issues
  • #40849
Closed
Open
Issue created May 04, 2023 by Pier Angelo Vendrame@pierovMaintainer

Move Go dependencies to the projects dependent on them, not as a standalone projects

Go dependencies is a big problem for us: when we update Go, compiling all the PTs takes about 30 minutes on tb-build-05 for each platform.

Go is updated very often, about monthly, which means that every time we do a release, tb-build-05 spends 5 hours to build PTs, even though they have not even changed.

In addition to that, PTs will start using the renovate bot, if I understand correctly.
This means that we will need to update dependencies more often on our side, too.

@boklm and me thought a few months ago of stop using projects for Go dependencies, and move them to their main projects.

Some dependencies might be shared between projects, too (e.g., goptlib). So, we could also create a project for shared dependencies.

I think that having multiple git repos as inputs is a needed step first. I've added a comment with the idea in rbm#33988, but I could open another issue, in case.

Another idea is using go mod download. E.g., run a container with internet access and make Go automatically download all the dependencies, then reuse them for all the platforms. The go mod format seems to be very precise and always include the version, so it should not break reproducibility (folks at the rb summit were pretty happy with Go, IIRC).

@dan might have some additional ideas (and the AC team might, too, we should ping them).

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking