gomobile: weird dependency on dmitri.shuralyov.com/gpu/mtl
Alvaro Crespo
I'm not an expert go dev but I'm using https://cs.opensource.google/go/x/mobile to build a domain layer for both an Android and an iOS app. First of all, congrats on the good work. The project is amazing.
I recently updated the gomobile package version and found out a strange looking new addition to my go.sum. Namely, this one:
Package mtl provides access to Apple's Metal API (https://developer.apple.com/documentation/metal).
(...)
This package is in very early stages of development. The API will change when opportunities for improvement are discovered; it is not yet frozen. Less than 20% of the Metal API surface is implemented. Current functionality is sufficient to render very basic geometry.
Is this ok? Using go mod graphit appears this is a dependency of golang.org/x/exp/shiny, which I'm also not entirely sure why its included as a whole.
Is this something that should be reported? I would love some clarification on this.
Kurtis Rader
--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/aaa96093-696e-469a-895e-9cb99c82fc58n%40googlegroups.com.
Alvaro Crespo
Sadly, "go mod why" doesn't really work for gomobile (https://cs.opensource.google/go/x/mobile) and its dependencies since they are technically not used in my library/package. They are used at build time to generate language bindings that make it possible to call Go functions from Java and Objective-C.
go mod why golang.org/x/exp/shiny
go: downloading golang.org/x/exp v0.0.0-20190731235908-ec7cb31e5a56
(main module does not need package golang.org/x/exp/shiny)
My doubt is: why is dmitri.shuralyov.com/gpu/mtl, a package for gpu use and geometry rendering, listed as a dependency of https://cs.opensource.google/go/x/mobile (a package to generate language bindings to call Go functions from Java/Obj-C)? That doesn't sound right to me. Given the widely known supply chain attacks this is something that should be looked into, right?
Sean Liao
full fledged apps, see https://pkg.go.dev/golang.org/x/mobile/app
It seems natural to require some rendering support for that.
- sean
On Wed, Jul 17, 2024 at 4:42 PM Alvaro Crespo
王旭东
Hi,
It seems there might be a misunderstanding regarding the go mod why command. Please note that any transitive dependencies will not be displayed in the output. For instance, x/exp/shiny could be a transitive dependency of a direct dependency in your main module, which is why you see the message "(main module does not need package golang.org/x/exp/shiny)."
To understand why dmitri.shuralyov.com/gpu/mtl is used by x/mobile, I recommend checking the source code of both x/mobile and x/exp/shiny.
Xudong