3 ms·
go.sum is not imports. It's a checksums file, it's used in determining which versions of things to pin to. It doesn't necessarily mean all of those things end u
by francislavoie 2y ago
go.sum is not imports. It's a checksums file, it's used in determining which versions of things to pin to. It doesn't necessarily mean all of those things end up in the final binary. See https://go.dev/ref/mod#go-sum-files https://go.dev/ref/mod#go-sum-files. You can run `caddy build-info` to see everything that is a dependency in the build. From my count, a vanilla build of Caddy v2.8.0 has 122 packages as dependencies (many of which are indirect).
- 38 2y ago> You can run `caddy build-info` Or just go version -m > 122 packages That's still a lot > many of which are indirect) That means literally nothing. Indirect still gets built, indirect still in the exe.
- francislavoie 2y agoI think you underestimate how much a general purpose webserver needs to be able to do. Do you have any specific criticism about the list of dependencies? What do you think is actually unnecessary?
- vundercind 2y agoNot the original poster, but at a glance, oauth, sso, and a whole bunch of PostgreSQL(?!) packages stand out as surprising things to see in a web server.
- francislavoie 2y agoIf you actually run `caddy build-info`, you'll see that none of those are actually in the build. You can't just look at go.sum, like I explained above.