I am looking to create reproducible builds with go. For individual projects we are using glide.
So for example I use:
glide get github.com/stretchr/testify
to fix the version of the "testify" package. This does not work for tools however. For example:
glide install github.com/tebeka/go2xunit
returns success but does not actually install go2xunit so I have to use:
go get github.com/tebeka/go2xunit
which installs go2xunit to $GOPATH/bin.
Q How can I fix the version of tools like go2xunit?
I also note that glide says use dep instead and dep says golang has diverged from its implementation and will probably end up using something based on vgo. There are a plethora of dependency management tools for go perhaps one of the less well known ones supports this?
In case its relevant I'm using go 1.7.4 as provided by Debian9.
The solution for go1.11 using go modules is to create a fake tools package. You create a tools.go file like the following:
// +build tools
package tools
import (
_ "github.com/tebeka/go2xunit"
)
+build tools is a magic comment which prevents the package being built.
>go mod init tools
Will create a go.mod file for the fake tools package
>go install github.com/tebeka/go2xunit
Will install go2xunit and update go.mod as follows.
module tools
require github.com/tebeka/go2xunit v1.4.8 // indirect
Now if you run go install github.com/tebeka/go2xunit in the future (for a clean build say) its version will be fixed to v1.4 by the go.mod
For versions of go before 1.11 the tool to use is retool. It works like this:
bootstrap:
go get github.com/twitchtv/retool
add tool:
retool add github.com/jteeuwen/go-bindata/go-bindata origin/master
use tool:
retool do go-bindata -pkg testdata -o ./testdata/testdata.go ./testdata/data.json
Adding support for this may be on the roadmap to target go 1.12 (https://github.com/golang/go/issues/27653)