Hey y'all,
I'm the maintainer for google-guest-agent[0] and the most recent updates from upstream add some extra dependencies. Much of this stems from some additional confidential computing functionality added to the guest agent.
If I follow the new chain of dependencies down the path, I eventually land on Hashicorp Vault. I'm far from a licensing expert, but it appears that the Vault license is incompatible with Fedora's licensing requirements.
I see a few options here:
1) Try to pry out some of the confidential computing items from the latest upstream release. I cannot guarantee this will work and it will set Fedora back a bit on confidential computing support.
2) Try to work through the dependencies to see if the Vault dependency can be avoided somehow.
3) Find a new maintainer for the package with much better golang skills than I have. 🤣
4) Ask upstream about shortening the dependency list somehow.
I'm planning to start with #4, but I'm running very low on time to maintain this package. Does anyone else have any other suggestions I might have missed?
[0] https://src.fedoraproject.org/rpms/google-guest-agent
-- Major Hayden
On 10/2/23 11:07 PM, "Major Hayden" major@mhtx.net wrote:
Hey y'all,
I'm the maintainer for google-guest-agent[0] and the most recent updates from upstream add some extra dependencies. Much of this stems from some additional confidential computing functionality added to the guest agent.
If I follow the new chain of dependencies down the path, I eventually land on Hashicorp Vault. I'm far from a licensing expert, but it appears that the Vault license is incompatible with Fedora's licensing requirements.
I see a few options here:
Try to pry out some of the confidential computing items from the latest upstream release. I cannot guarantee this will work and it will set Fedora back a bit on confidential computing support.
Try to work through the dependencies to see if the Vault dependency can be avoided somehow.
Find a new maintainer for the package with much better golang skills than I have. 🤣
Ask upstream about shortening the dependency list somehow.
I'm planning to start with #4, but I'm running very low on time to maintain this package. Does anyone else have any other suggestions I might have missed?
[0] https://src.fedoraproject.org/rpms/google-guest-agent
-- Major Hayden _______________________________________________ golang mailing list -- golang@lists.fedoraproject.org To unsubscribe send an email to golang-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/golang@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
You could build the lates FOSS version of Vault.
Vault has already come across my path as a dependency but I always cut it out because it's a gynormous project to package and we don't have the time.
What is your dependency chain?
Best regards,
Robert-André
golang@lists.fedoraproject.org