| 25 Sep 2023 |
 Paul Meyer (katexochen) | The builder has a field vendorHash, that's what I'm talking about. As far as I understand, it creates a intermediate derivation with the vendored dependencies. | 05:14:32 |
 Artturin | I consider vendoring copying files to the repo | 05:15:10 |
| Paul Meyer (katexochen) | * The builder has a field vendorHash, that's what I'm talking about. As far as I understand, it creates an intermediate derivation with the vendored dependencies. | 05:15:11 |
| Artturin | the vendorHash thingy is just for a fod | 05:15:25 |
| Artturin | so the deps can be fetched | 05:15:29 |
| Paul Meyer (katexochen) | fod? | 05:18:44 |
| Artturin | fixed output derivation | 05:18:52 |
| Artturin | only those and impure derivations have access to network | 05:19:00 |
| Paul Meyer (katexochen) | Sure, makes sense to separate those derivations. But couldn't it use the go.sum file instead of its own hash? How would I validate the vendorHash actually is the hash of the dependencies in the go.sum file? | 05:22:52 |
| Artturin | In reply to @katexochen:matrix.org
Sure, makes sense to separate those derivations. But couldn't it use the go.sum file instead of its own hash? How would I validate the vendorHash actually is the hash of the dependencies in the go.sum file? Using a file from inside the derivation would be ifd | 05:26:48 |
