vndr
vndr copied to clipboard
LK4D4
Stupid vendoring tool
Running `vndr` with a `vendor.conf` which contains some large repositories can take quite some time to clone them all every time. This is particularly apparent when iterating adding transitive dependencies...
In https://github.com/docker/swarmkit/pull/2220 I proposed moving some vendoring from using hashes to using tagged releases, however it was pointed out that this is vulnerable to (possibly even malicious) retagging by upstreams....
For example - it will get the `github.com/mattn/go-colorable` and `github.com/mattn/go-isatty` for `github.com/fatih/color`, but will not get the transitive dependency of `golang.org/x/sys/unix` from https://github.com/mattn/go-isatty/blob/master/isatty_solaris.go#L7
If I vendor a package which itself vendors stuff then I somehow need to ensure that I satisfy the requirements of that package. I'll use swarmkit as an example. If...
This switches to [Go modules](https://go.dev/blog/using-go-modules), which have now been the standard for dependency management in Go codebases for a while.
