On Sat, Jan 7, 2017, 6:53 AM Jacek Furmankiewicz <jace...@gmail.com> wrote:
> Thank you for your answer. > > Issue is that it really is not much control with this approach. > If you used the suggestion from Tam's, to have a small http proxy which directs "go get" at your Stash, that could do the same thing as your Java set up. We also have a semi locked down environment. Our Java devs have the same solution as you, with an internal dependency server endpoint. > Any developer could potentially pull any package, avoid license review and > just commit it to their project. > So there is no central point of control that can limit which libraries > (exactly down to particular versions) can be used by projects within a > company. > > Also, having to commit external dependencies with your own project code > seems very clunky to me, > especially in comparison to what developers are used to coming from other > languages. > It is a pretty well accepted pattern for Go developers to commit their external dependencies into a vendor location within their project. It has the benefit of being directly supported when building. And also allows for reproducibility of builds at any commit, on any machine, even without access to internet or an internal dependency proxy endpoint. > I doubt we would get much excitement from development teams if they were > faced with such a requirement. > It's an obvious gap compared to how elegantly (overall) the Java ecosystem > has solved this problem. > Aside from the http proxy suggestion to make it work similar to your Java set up, maybe you could work with an extra GOPATH entry. If you maintained a location for external dependencies, and place the path after your own developer GOPATH location, "go get" would fetch it into the developers local GOPATH. > > -- > You received this message because you are subscribed to the Google Groups > "golang-nuts" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to golang-nuts+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
