4 ms·
I tried to debug Go project once, and the moment I saw that, I was completely shocked that it was importing from github urls, without even tags, or versions as
by Demiurge 9y ago
I tried to debug Go project once, and the moment I saw that, I was completely shocked that it was importing from github urls, without even tags, or versions as far as I could tell. It seems dangerous to rely on a for-profit host and individual users. If 'network' dependencies are part of the language, it should at least be non-profit, or better Go project managed host. There are many examples, like PyPi, or PECL.
- dewey 9y agoThat's what vendoring and dependency tools are for.
- crdoconnor 9y agoThat was the first wtf I hit when learning go that made me think that it possibly wasn't all it was cracked up to be.
- ovao 9y agoGo doesn't specifically rely on GitHub, but it can pull in dependencies with a simplified URL that points to a git repository hosted on GitHub. This is possible because GitHub renders an HTML meta tag on project pages that the go tool can reference to fetch information about the repository. Anyone can actually 'reflect' dependencies hosted with various VCS with this method, and gopkg.in does essentially this (while adding version pinning).
- strkek 9y agoThe only drawback I see to this approach is that adding a new method is not trivial, and requires recompiling the `go` executable. Makes it more difficult to implement a handler for the BitTorrent protocol to `go get` from a DHT, just for the sake of mad science.
- Klathmon 9y agoThat sounds like an incredible idea! Has anyone tried to do something like this before? I would absolutely run a torrent server to serve up my own and others' open source packages.
- ovao 9y agoTo my knowledge it hasn’t been tried. It shouldn’t be too difficult to author a tool to do so, which could itself be made go-gettable. With this you’d avoid the mess of shipping an alternate build of the go tool and all that entails.
- Klathmon 9y agoYeah, the more I think about it the easier it seems. You could probably write "plugins" or shims/wrappers for most package managers out there pretty easily. And a great MVP would just be the ability to install from a magnet link.
- comex 9y agoThis project was fairly close to that idea: https://github.com/cjb/GitTorrent https://github.com/cjb/GitTorrent I think it’s abandoned though.
- strkek 9y agoI read somewhere that big companies use BitTorrent internally to update their codebase. But yeah, I'd really like for someone to develop a VCS like that (even more if it's in Go, with no Cgo, and under BSD, MIT or Apache license). It'd make distribution, immutability and mirroring so much easier.
- detaro 9y agoThere is https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx (based on IPFS instead of torrents, but they work extremely similarly for this use case)
- ioddly 9y ago> Go doesn't specifically rely on GitHub, but it can pull in dependencies with a simplified URL that points to a git repository hosted on GitHub. This is possible because GitHub renders an HTML meta tag on project pages that the go tool can reference to fetch information about the repository. Is there somewhere I can read more about this tag? Opened up the source of one of my repos and I couldn't find it.
- sannee 9y ago> It seems dangerous to rely on a for-profit host Unfortunately, "non-profit" hosts are somewhat in a short supply.