Many modern languages (such as go, rust, nodejs) include their own dependency
management components that are responsible for ensuring the correct source is
available for the build. While this addresses many of the issues with dependency
management and packaging at the source/build level, it causes issues when
several core OE features are considered: reproducibility, licensing/SBOM,
offline builds, sstate/hash equivalence, etc. There are also indirect issues
such as CVE management, debugability, recipe transparency, code sharing, that
are sources of maintenance challenges.

The approach/implementation to solving these issues are largely language
specific, but have the common themes of OE fetcher integration, dependency
packaging (and reuse) versus per-recipe source code management, dependency
specification, etc. Balancing reuse, build performance, scalability and other
issues are also challenges that remain with the different solutions.

Using golang as an example, this talk will cover these issues in more detail,
and use meta-virtualization's go recipes as an example of one way to solve the
problem. It will also summarize the issues with other languages and discuss what
should be considered when doing an OE core fetcher implementation for a given
language.