Failed to learn/play with Guix again... It's impossible to package a golang software (such as v2ray) as it requires all dependencies be packaged by Guix... even if your go.sum contains thousands of lines lol 🙃
@aya @merrick Some distros want packages to be local, so they can be built from the distro's repository, sometimes without network connection (once all dependencies are prepared). Upstream lock files don't matter in this case. The concern is not unreasonable, though sometimes irrelevant for certain people.
@ncts @aya gentoo also do that, but they provide some workaround:
1. for golang packages, they now force packagers to provide "vendor" tarballs
2. they allow -9999 (live) packages to access the internet when building.
btw I actually get #1 work with Guix too, so maybe I'm wrong, you can hack Guix any way you want after all.
@merrick @aya Vendoring is a common practice, seen in many places, but it differs from (the normal) go.sum, which pulls dependencies on the fly. It's OK to vendor all Go dependencies in a package, as long as you can convince the archive masters (well, I know only Debian, but you get the idea). Whether to allow network access during build depends, it's not a hard universal rule and totally fine for some cases.
