-
Notifications
You must be signed in to change notification settings - Fork 18k
proposal: cmd/go: maintain 'classic' vendor behaviour #44519
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
To continue using your git submodule layout while using modules, I think you can add a |
Unfortunately, "classic" vendor lets you end up with multiple copies of different (or even identical) minor versions of a package in the same build, which causes all manner of headaches. Adding that to module mode would introduce a special case that violates one of module mode's basic guarantees.
I apologize for the work you'll need to do to deduplicate your vendor directories into a single top-level vendor directory. All I can say is that if you make each one use a go.mod instead of vendor, that will set you up much better for understanding which code versions you are actually using, for updating in response to security fixes, and so on. It really does lead to a better, more agile setup. I would push back a little on the "until recently" part. Go modules were first made available for use in Go 1.11 (August 2018), and we announced our intent to remove GOPATH in the "Go Modules in 2019" blog post (December 2018). Also, Go 1.16 will be supported until the release of Go 1.18 (~February 2022).
Note also that the document explicitly excludes tools such as the Go command. It is concerned with the Go language and the standard library. We do try to follow the spirit of the document generally, and again we are aware that it is painful to update old code trees. We don't intend to make a break like this again any time soon, if ever. But this one really is necessary for the progress of the Go ecosystem. |
@rsc You statement assumes that people always uses other dependencies or such dependences always have version problems. But these simply are not always true. When those cases don't occur, it is unnecesary to enforce all Go code must be in a module. For this reason, the classical behavior should be maintained. |
I believe this won't happen, and some basic level of GOPATH support will remain indefinitely. |
Proposal: Maintain 'classic' vendor behaviour
This is a proposal to keep resolution of 'vendored' code consistent with the behaviour possible in
go1.16 <
versions of the compiler.The express of intent to remove
GOPATH
from the compiler toolchain as soon asgo1.17
, and furthermore theGO111MODULE
flag, combined with the fact-mod=vendor
ignores vendor directories in locations other than the main module's root directory; means applications designed and written in the years beforego mod
could no longer compile.To be clear, this proposal does not make an argument to keep
GOPATH
code resolution 1:1, but to allow code to be resolved from both the project root'svendor
directory and anyvendor
directories found to be relative to import statements within.In order to take any subsequent security updates and language features, teams are faced with non-insignificant engineering and logistical tasks to make this possible. For us and I imagine many others this is multiplied across a number of applications into the hundreds.
Our specific set up is to use git submodules of packages into the
vendor
directory, which is sufficient for our use-case of a large body of internally owned packages.The applications have grown and adapted these structures over time based on the features available in the compiler until now, and the fact that until recently there was no 1st party solution for package management.
Removing the ability to resolve code in this way feels inconsistent with the spirit of the below paragraph taken from the go1compat document, which I appreciate people are likely familiar with.
Example
In the above example,
github.com/protobuf
sits in the foldermyapp/vendor/git.lb.local/pkg/example/vendor
but is unable to be resolved. In go 1.16 this can be mitigated via theGO111MODULE
flag.References
GOPATH
mode in Go 1.17"The text was updated successfully, but these errors were encountered: