Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes

[Demi Marie Obenour <demiobenour () gmail com>]

On 4/20/26 12:07, Morten Linderud wrote:
> On Sun, Apr 19, 2026 at 10:46:43PM +0200, Matthias Ferdinand wrote:
> > Arch linux appears not to have recompiled Go applications (or at least
> > not all of them, only checked restic)
>
> We don't.
>
> I originall did this work a few years ago but it just produced a huge list of
> packages that would need to be worked through that carried other issues. The
> build infra is not there to dispatch larger rebuilds for this and all of it
> would be hand holding.
>
> There are 431 depending on go, and each project would need to be
> unpacked/scanned and then rebuilt accordingly.
>
> You could just rebuild everything, but that alone would take a few days
> depending on volunteer time.

I wonder if build infra needs to be updated to support automated
rebuilds when a reverse dependency is updated.  My understanding is
that FreeBSD ports, Nix, and OBS already support this.

There is a very strong trend towards static linking, and even when
dynamic linking is used, ABI stability might not be guaranteed.

I agree that this is extra work for distros, but I don't think distros
will be able to convince upstreams to prioritize ABI stability for
general libraries (as opposed to special cases).  I'll write up a
blog post about this later.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

Attachment: OpenPGP_0xB288B55FFF9C22C1.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature