4 ms·
I agree that it's necessary to pin dependency versions down somehow. So I commit my Go dependencies into my project's version control. I heard Google does this
by lopatin 11y ago
I agree that it's necessary to pin dependency versions down somehow. So I commit my Go dependencies into my project's version control. I heard Google does this internally too, but I can't confirm that. But I can say that I've had zero problems using this dependency approach for building web systems in Go.
There's just something about the ecosystem of dependencies. Most of the deps I use are considered to be done. They are simple, small, and orthogonal to each other.
Maybe it's because of the convention to make your library implement interfaces defined in the standard library. Maybe it's some kind of ingenious magical feedback loop where, since there is no package version manager, authors are encouraged to write once and then publish finished products instead working on overreaching and interconnected packages that get API changes every month. Therefore alleviating the need for a package version manager.
My point is just that I wouldn't want people who are considering Go to immediately write it off because of the lack of a standard dep version manager. You can lock dependencies with godep. Or you can check in your dependencies to your project's source control. Either way, even though it's unconventional, it most likely won't be a problem.
- jjnoakes 11y agoWhat do you do when a dependency has a security problem? Or some other bug?
- Goopplesoft 11y agoIts generally unlikely those things lead to interface changes. e.g. func bcrypt(salt string, password string). Generally the bug isn't in the interface. So its somewhat safe to upgrade the dep and see if the compiler complains Also exporting of interfaces is protected by case private()/Public() which leads to refined interfaces being exported. And the go vet tool expects all exported functions be documented. Not saying a package manager wouldn't be nice.
- jjnoakes 11y agoThis didn't directly answer my question, but it implies that you just periodically update all of your dependencies to the latest versions and pray your tests pass with minimal changes required. Yes?
- Goopplesoft 11y agoThe tools essentially causes that to happen (its a bad thing). When someone installs your package (and you don't pin them somehow with something like godeps, path management, http://labix.org/gopkg.in http://labix.org/gopkg.in, etc) you recursively retrieve the deps from some source at HEAD and that package is now updated for every other package using that GOPATH.
- jjnoakes 11y agoOh, I misread the parent I replied to. I thought he was saying he downloads a copy of his dependencies and commits them to his repository without any tooling. But he was only saying he uses the tools (which auto-update as your run them), and commits the result as a poor man's pinning arrangement. Makes sense now. My questions are moot.