❦ 24 mars 2020 10:14 +00, Paul Wise: >> Kubernetes is already using Go modules. They happen to have decided to >> keep shipping a `vendor/` directory but this is not uncommon. It is >> often considered as a protection against disappearing modules. So, there >> is nothing to be done upstream. And BTW, there are currently 616 >> dependencies, pinned to a specific version. > > I wonder if the existence of Software Heritage could convince them > disappearing modules aren't a problem, or if another service is > needed.
There are other reasons, notably that you speed up builds by having all the source code ready. If the vendor/ directory wasn't there, the presence of `go.sum` would ensure you get something reproducible by downloading all the deps, but I think it implies a full checkout of all deps, which can be lengthy. There is also a caching mechanism (local and remote). -- Make sure every module hides something. - The Elements of Programming Style (Kernighan & Plauger)
signature.asc
Description: PGP signature