retail-demo-store icon indicating copy to clipboard operation
retail-demo-store copied to clipboard

Move to using Go Modules

Open Teddy-Schmitz opened this issue 4 years ago • 0 comments

I took a look at the Go code and the binaries are built by just doing a go get during build time. This can cause issues down the line as builds are not repeatable and versions are unknown.

Take a look at using Go modules instead

https://blog.golang.org/using-go-modules

It will pin the versions and allow the builds to be repeatable, it will also let you control when you want to bump versions of libraries being used and if a vulnerability is found in a library being used you can know if you have a bad version as well.

You'll just need to commit the go.mod and go.sum files into the repo.

Teddy-Schmitz avatar May 01 '20 08:05 Teddy-Schmitz