On Fri, Jan 18, 2019, 12:36 AM Francis Chuang <f21.gro...@gmail.com> wrote:
> Hey everyone, > > I was wondering if I can get some ideas on how to solve this dependency > problem with Go modules. I am using Go 1.11.4 on Linux (Windows Subsystem > for Linux to be exact). > > The first part of the problem is that for one of my libraries, I am > importing github.com/hashicorp/vault/api, which is an api client to > access Vault servers. This package is pretty thin and does not contain a > lot of dependencies. However, the root project at > github.com/hashicorp/vault has quite a few dependencies. > If I delete the current go.mod and go.sum files in my library and start > from scratch: > - I run go mod init github.com/username/mylibrary > - I then run go mod tidy to add missing packages to my go.mod and generate > a go.sum > > Go mod imports the Vault repository at its root ( > github.com/hashicorp/vault) as expected. Unfortunately, this pulls in a > lot of subdependencies and I have a ton of indirect dependencies in my > go.mod and go.sum. This is not unexpected of course as this is how go > modules work. Unfortunately, this does slow down continuous integration > builds and is probably not great for Github and VCS hosts as each build > pulls in all of these unneeded dependencies. > > The second problem is that 2 of Vault's subdependencies (not sure how > deep) is labix.org/v2/mgo and launchpad.net/gocheck. These are bazaar > repos, so they necessitate the installation of the bzr tool. In my library, > I added the following to my go.mod to force it to pull from the Github > repos: > > replace labix.org/v2/mgo => github.com/go-mgo/mgo > v0.0.0-20160801194620-b6121c6199b7 > > replace launchpad.net/gocheck => github.com/go-check/check > v0.0.0-20180628173108-788fd7840127 > > This works great for running tests in the username/mylibrary repo as I no > longer need to install bzr when running my CI builds. However, if I create > another project such as github.com/username/some-project and import > username/mylibrary, go mod will attempt to download launchpad.net/gocheck > and labix.org/v2/mgo from the original bazaar repos when running go test > and other commands.These causes errors such as `go: > labix.org/v2/mgo@v0.0.0-20140701140051-000000000287: bzr branch > --use-existing-dir https://launchpad.net/mgo/v2 . in > /go/pkg/mod/cache/vcs/ca61c737a32b1e09a0919e15375f9c2b6aa09860cc097f1333b3c3d29e040ea8: > exec: "bzr": executable file not found in $PATH `. This is quite annoying > and I'd like to avoid having to add those `replace` statements in the > go.mod of projects that consume the mylibrary package. In addition, > consumers of my library would need to install bazaar (which most people > probably won't have installed). > > The 2 options I have thought of are: > 1. Ask the Vault team to extract the api package into a separate > repository. I am not sure how likely they would be interested in doing > this, but I am guessing it would be quite low. > 2. Make a copy of the api package and copy it directly into my library. > This is something I am hoping to avoid as much as possible, because I'd > like to use go modules to manage my dependencies. > > Are there any other options I've missed? > I'm not yet well versed in modules since I use them in a very simple way and I vendor. But is it also supported as an option to make /api a "sub module" by adding another go.mod at that level? If that is possible then it is way less intrusive of a change than splitting it into another repo. That aside, I don't know if that would help too much in this case because I don't think Go modules differentiates between test and non test when collecting dependencies. If the api tests have deps, they will get collected I think. Even the non test files have some deps anyways. Might be nice if there were a Go modules option to skip scanning tests. Anyways just throwing that out there until someone more informed that me responds. > Cheers, > Francis > > -- > You received this message because you are subscribed to the Google Groups > "golang-nuts" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to golang-nuts+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
