the dichomoty between "well, we have access to the FTP server and are official packagers so we'll bundle deps somewhere else" and "I'm just writing ebuilds but don't have any stable storage"

this is why the EGO_SUM= stuff sucks. this is why the CRATES= deprecation stuff sucks

publishing random tarballs are very opaque. especially when those tarballs contain precompiled binaries. especially when there's been no documented way to publish reproduce those opaque tarballs

sometime individual dependencies do get cached on mirrors

at least the rust warning is a lot friendlier than the go warning:

 * QA Notice: This package uses a very large number of CRATES.  Please provide
 * a crate tarball instead and fetch it via SRC_URI.  You can use
 * 'pycargoebuild --crate-tarball' to create one.

• [gentoo-dev] Re: EGO_SUM
  • [gentoo-dev] [PATCH] go-module.eclass: deprecate EGO_SUM and call ego instead of go
  • [gentoo-dev] [PATCH v3] go-module.eclass: deprecate EGO_SUM
  • [gentoo-dev] Proposal to undeprecate EGO_SUM

https://public-inbox.gentoo.org/gentoo-dev/?x=t&q=xarchiveshash:1a64a8e7694c3ee11cd48a58a95f2faa

https://public-inbox.gentoo.org/gentoo-dev/?x=t&q=xarchiveshash:8e2a4002bfc6258d65dcf725db347cb9

robin's solution here is honestly the best one, sucked that we didn't get there though.

groups.google.com/g/linux.gentoo.dev/c/ERbk0uW-g70