[tor-bugs] #14316 [Pluggable transport]: Obfs4proxy commit cdeda5724124ca393c87be6d01c84fe4f906d612 breaks nightly builds

[Tor Bug Tracker & Wiki]

#14316: Obfs4proxy commit cdeda5724124ca393c87be6d01c84fe4f906d612 breaks nightly
builds
-------------------------------------+-------------------------------
     Reporter:  gk                   |      Owner:  yawning
         Type:  defect               |     Status:  accepted
     Priority:  normal               |  Milestone:
    Component:  Pluggable transport  |    Version:
   Resolution:                       |   Keywords:  tbb-gitian, obfs4
Actual Points:                       |  Parent ID:
       Points:                       |
-------------------------------------+-------------------------------
Changes (by yawning):

 * status:  new => accepted


Comment:

 Ugh.  Yeah it will do that.

 The problem is that the Go developers decided to move where they host the
 "go.crypto" package from mercurial on Google code to a git repo on
 golang.org, so the import paths changed.  I'm not sure what the best fix
 for this is because as far as I know our build stuff doesn't maintain
 separate branches for nightly vs non-nightly.  It's worth noting that Go
 1.4.x will break horribly on the old go.crypto code (including the tarball
 I have mirrored) at compile time.

 The long term thing is to switch to pulling in golang.org/x/crypto with a
 pinned hash instead of the tarballs that I mirrored onto people.tp.o like
 most other dependencies.  This will break non-nightly builds, since they
 pull in a signed tag (till I release a new version, not quite ready yet).

 The short term thing is to have nightly pull in the commit prior to the
 one where I changed the import locations.

 I can provide patches that do either/both/some combination in between,
 just let me know what the "right thing to do" here is from the browser
 people's point of view.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/14316#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online