[libre-riscv-dev] libre-riscv-dev Digest, Vol 23, Issue 16

Luke Kenneth Casson Leighton lkcl at lkcl.net
Sat Jul 11 00:07:43 BST 2020

On Friday, July 10, 2020, Jacob Lifshay <programmerjake at gmail.com> wrote:

> apparently whitequark fixed the dependency issues with nmigen_soc:
> https://github.com/nmigen/nmigen-soc/commit/5509bd2aad3012eed09c06f660cb9b
> 60cd2cff95
> So, if you install from https://github.com/nmigen/nmigen-soc instead
> of PyPI or m-labs it will probably work


that will...sort-of do the trick.

installation of nmigen-soc will pull in an arbitrary, unverified and
untrusted version of nmigen off the internet

then, you git clone the nmigen repo and install that.

the pre-installed nmigen-soc dependencies will *match* the version of
nmigen being installed manually, resulting in successful replacement.

we are going to have to sort this out for the reproducible builds for

we absolutely cannot have arbitrary dependencies randomly downloaded, not
for any reason.

any one of those arbitrary untrusted packages could result in major
differences in the GDSII files

i mean *all* dependencies of nmigen.

pip3 is basically completely inappropriate, here, given that it could
result in USD 10 to 20 million dollars in NREs wasted because some random
software got installed.


crowd-funded eco-conscious hardware: https://www.crowdsupply.com/eoma68

More information about the libre-riscv-dev mailing list