On Sat, Jan 7, 2017, 8:00 AM Justin Israel <justinisr...@gmail.com> wrote:
> > > On Sat, Jan 7, 2017, 6:53 AM Jacek Furmankiewicz <jace...@gmail.com> > wrote: > > Thank you for your answer. > > Issue is that it really is not much control with this approach. > > > If you used the suggestion from Tam's, > Silly autocorrection. I meant Tamás. to have a small http proxy which directs "go get" at your Stash, that could > do the same thing as your Java set up. > > We also have a semi locked down environment. Our Java devs have the same > solution as you, with an internal dependency server endpoint. > > > Any developer could potentially pull any package, avoid license review and > just commit it to their project. > So there is no central point of control that can limit which libraries > (exactly down to particular versions) can be used by projects within a > company. > > Also, having to commit external dependencies with your own project code > seems very clunky to me, > especially in comparison to what developers are used to coming from other > languages. > > > It is a pretty well accepted pattern for Go developers to commit their > external dependencies into a vendor location within their project. It has > the benefit of being directly supported when building. And also allows for > reproducibility of builds at any commit, on any machine, even without > access to internet or an internal dependency proxy endpoint. > > > I doubt we would get much excitement from development teams if they were > faced with such a requirement. > It's an obvious gap compared to how elegantly (overall) the Java ecosystem > has solved this problem. > > > Aside from the http proxy suggestion to make it work similar to your Java > set up, maybe you could work with an extra GOPATH entry. If you maintained > a location for external dependencies, and place the path after your own > developer GOPATH location, "go get" would fetch it into the developers > local GOPATH. > > > > -- > You received this message because you are subscribed to the Google Groups > "golang-nuts" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to golang-nuts+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > > -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
