Feature - Vendor dependencies for hermetic builds

[naveensrinivasan]

Is your feature request related to a problem? Please describe.
Vendor dependencies for hermetic builds.

[laurentsimon]

Can you elaborate a little more?

1. Is this "let's do it for scorecard builds" or "let's add a check in scorecard"?
2. What do you mean by vendored dependencies? Is it like hash pinning? Or you're thinking of "runtime" vendored dependencies (fetch dependencies then build without network access)? If the former, what are the advantages of vendored vs hash pinning? Are tools like dependabot/renovabot able to update dependencies that are copied/vendored into a repo?

[naveensrinivasan]

Can you elaborate a little more?

1. Is this "let's do it for scorecard builds" or "let's add a check in scorecard"?

Let's do it for scorecard builds

2. What do you mean by vendored dependencies? Is it like hash pinning? Or you're thinking of "runtime" vendored dependencies (fetch dependencies then build without network access)? If the former, what are the advantages of vendored vs hash pinning? Are tools like dependabot/renovabot able to update dependencies that are copied/vendored into a repo?

runtime vendored go mod vendor - Download the dependencies so that we can build without network access. Dependabot can update vendored dependencies.

[laurentsimon]

where does go stored the vendored dependencies?

[naveensrinivasan]

https://golang.org/ref/mod#go-mod-vendor /vendor and here are a couple of examples

• https://github.com/tektoncd/chains/tree/main/vendor
• https://github.com/kubernetes/kubernetes/tree/master/vendor

[laurentsimon]

do you know how much latency this would add to the download of the tarball?
Let's add this topic to the agenda for next meeting?

[naveensrinivasan]

do you know how much latency this would add to the download of the tarball?
Could you please explain which tarball? The Scorecard or our dependencies.

Let's add this topic to the agenda for next meeting?
Yes I will.

[github-actions]

Stale issue message

[github-actions]

This issue is stale because it has been open for 60 days with no activity.

[justaugustus]

@naveensrinivasan — do we know if there was further discussion here?

[justaugustus]

Closing as not planned given the discussion in #1208.