3 ms·
Prior to 1.17, go.mod was not a complete representation of the dep graph. More broadly, the problem is that programmers expect dependency management tooling to
by preseinger 4y ago
Prior to 1.17, go.mod was not a complete representation of the dep graph. More broadly, the problem is that programmers expect dependency management tooling to have a lock file, see go.sum, and assume it's a lock file. This isn't a problem with those programmers, it's a problem with Go modules.
- remus 4y ago> This isn't a problem with those programmers, it's a problem with Go modules. That seems like a bit of a jump! Maybe there's a better way of building dependency management tooling that doesn't use lock files, it seems strange to tie yourself to this approach just because it's how other tools work.
- Thaxll 4y agogo.mod is the lock file.
- preseinger 4y agoIt isn't in the traditional sense. There isn't anything in its specification that guarantees the things that most people expect lock files to guarantee.