juju bootstrap w/ gccgo built cli and tools

[David Cheney]

On Fri, Dec 6, 2013 at 3:39 PM, John Arbash Meinel
<john at arbash-meinel.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 2013-12-06 6:24, David Cheney wrote:
>> Ok, good news first.
>>
>> gccgo compiled tools work fine.
>>
>> statically linking libgo also makes the tools as self contained as
>> our gc compiled ones.
>>
>> Bad news,
>>
>> jujud is 40mb, -Os or -O2 effect, in fact the latter makes it a bit
>> larger
>>
>> the binaries cannot be stripped, the debug data is required for
>> operation of the program, i'm guessing gccgo's reflection
>> implementation requires the debug symbols.
>>
>> Dave
>
> Two tidbits from me:
>
> 1) jujud on my system is 20MB, so this is approx 2x larger. A fair
> amount, but I think with compression we saw it wasn't quite as big of
> a deal (4.6MB vs 5.5MB in tgz form for the last test, but that was a
> smaller binary).
>
> 2) The Ubuntu security team would *really* like it if we used a system
> libgo.so so that they could supply security fixes for it (like the
> built in SSL libs) without having to have us rebuild all of our jujud
> binaries. Which would save us some of that size (I think you said
> approx 10MB was libgo.so), at a cost of having to have a libgo package
> for all supported platforms. If we name the package appropriately
> (libgo-1.1, etc) then we can probably even still migrate to a
> different version of the runtime when it becomes useful (we just
> install a different package in cloud-init).

That is a fair request, but brings with it a lot of complexity.

It isn't sufficient to have a libgo.so, but one that very closely
matches the one that the tools were built against. Considering that
libgo.so contains all the important parts of the standard library like
crypto, compression, http, json, reflection, etc. We also need to
ensure that whatever tools we are deploying, are running with an up to
date libgo.so.

In short, libgo.so and the tools need to be distributed together -- or
-- the tools need to control the version of libgo that is installed on
the system. This would be easier to accomplish if the tools were
packaged as a deb. But that come with other complications for things
like upgrades.


>
> John
> =:->
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (Cygwin)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iEUEARECAAYFAlKhVPYACgkQJdeBCYSNAAMAGgCXRPrIqBlFaHOEAuLA4zRZGarV
> ZACfS1NM6K6bIZHzaRTBvxO8f/LRrKE=
> =Xa62
> -----END PGP SIGNATURE-----