https://segmentfault.com/a/1190000013561841

Go dependency management tool

Go dependency management tool

Environmental requirements

• Golang >= 1.9
• Dep

Current version:

dep:
 version     : devel
 build date  : 
 git hash    : 
 go version  : go1.10
 go compiler : gc
 platform    : linux/amd64

Last release is v0.4.1

install

go get -u github.com/golang/dep/cmd/dep

If $GOPATH/bin is not under PATH, you need to move the generated dep file from $GOPATH/bin to $GOBIAN.

Verification

$ dep
Dep is a tool for managing dependencies for Go projects

Usage: "dep [command]"

Commands:

  init     Set up a new Go project, or migrate an existing one
  status   Report the status of the project's dependencies
  ensure   Ensure a dependency is safely vendored in the project
  prune    Pruning is now performed automatically by dep ensure.
  version  Show the dep version information

Examples:
  dep init                               set up a new project
  dep ensure                             install the project's dependencies
  dep ensure -update                     update the locked versions of all dependencies
  dep ensure -add github.com/pkg/errors  add a dependency to the project

Use "dep help [command]" for more information about a command.

Initialization

When the initialization command is executed in the root directory of the project, dep will analyze all the dependent packages required by the application and get the list of dependent packages.

And generate vendor directory, Gopkg.toml, Gopkg.lock files.

Default initialization

$ dep init -v

Download directly from the corresponding network resources

Priority initialization from $GOPATH

$ dep init -gopath -v

This command will first find the existing dependency package from $GOPATH, and if not, download it from the corresponding network resource.

Gopkg.toml

This file is generated by dep init and contains the rule declaration to manage dep behavior

required = ["github.com/user/thing/cmd/thing"]

ignored = [
  "github.com/user/project/pkgX",
  "bitbucket.org/user/project/pkgA/pkgY"
]

[metadata]
key1 = "value that convey data to other systems"
system1-data = "value that is used by a system"
system2-data = "value that is used by another system"

[[constraint]]
  # Required: the root import path of the project being constrained.
  name = "github.com/user/project"
  # Recommended: the version constraint to enforce for the project.
  # Note that only one of "branch", "version" or "revision" can be specified.
  version = "1.0.0"
  branch = "master"
  revision = "abc123"

  # Optional: an alternate location (URL or import path) for the project's source.
  source = "https://github.com/myfork/package.git"

  # Optional: metadata about the constraint or override that could be used by other independent systems
  [metadata]
  key1 = "value that convey data to other systems"
  system1-data = "value that is used by a system"
  system2-data = "value that is used by another system"

Gopkg.lock

This file is generated by dep ensure and dep init, and contains a complete snapshot of the project dependency graph, which is represented as a series of [[PROJECT]] sections.

# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.

[[projects]]
  branch = "master"
  name = "github.com/golang/protobuf"
  packages = [
    "jsonpb",
    "proto",
    "protoc-gen-go/descriptor",
    "ptypes",
    "ptypes/any",
    "ptypes/duration",
    "ptypes/struct",
    "ptypes/timestamp"
  ]
  revision = "bbd03ef6da3a115852eaf24c8a1c46aeb39aa175"

Frequently used commands

dep ensure

Analyze the diagram from Gopkg.toml and Gopkg.lock in the project and obtain the required dependency package

Used to ensure that the local diagram, lock and dependency package list are completely consistent

dep ensure -add

# Introduce the latest version of the dependency package
dep ensure -add github.com/pkg/foo

# Introduce dependency packages with specific constraints (specified versions)
dep ensure -add github.com/pkg/foo@^1.0.1

dep ensure -update

Update the contract dependency in Gopkg.lock to the latest version allowed by Gopkg.toml

Last

At present, dep is still in the official test stage, but it has been indicated that the production can be used safely.