I didn't see this addressed in any of the docs, so I'll raise the question
here.
Have you considered support for private repositories?
Many of the existing vendor tools does not handle private repositories very
well or at all. godep and govender can sort of handle it because they get
the dependencies from your $GOPATH. But existing tools that fetches directly
from the remote does not work with private repos in my experience (If someone
knows any tools that does work, please let me know :) ).
It would be great if dep could break this trend and work well with private
repositories from the start.
I'm probably not covering all use cases, but these are the use cases I would
like to see solved.
As a developer (consumer) I want to import dependencies from a private Github
Enterprise repository my.ghe.com.
Assuming I can already clone repositories either via https or ssh, I don't
want to also configure the authentication in dep. Configuring it one time
should be enough e.g. in git (or ssh).
As a developer I want to avoid committing the vendor folder, thus my CI/CD
system must be able to pull in all dependencies (also those from a private
repo) when running a build.
As a developer I don't want to encode the type of repository in my source
code e.i. I don't want to specify a vcs extension in my import: `import
"my.ghe.com/repo/package**.git**"
From my point of view this could be as simple as introducing an environment
variable which maps your private repo URL to a certain protocol. E.g.:
GO_DEP_REPO=my.ghe.com=git+ssh:my.ghe2.com=git+https
Which means whenever dep encounters an import path which starts with
my.ghe.com it will automatically choose git+ssh when fetching the repo. And
since I already have configured an ssh key on my machine it should know how to
authenticate.
Similarly when it encounters an import path with my.ghe2.com it
will choose git+https and ask me for username+password or just work if I
have configured what token to use in .gitconfig.
I'm sure someone could think of a better name for the environment variable and
a better format, but I hope you get my point.
I didn't see this addressed in any of the docs, so I'll raise the question
here.
Have you considered support for private repositories?
Many of the existing vendor tools does not handle private repositories very
well or at all.
godepandgovendercan sort of handle it because they getthe dependencies from your $GOPATH. But existing tools that fetches directly
from the remote does not work with private repos in my experience (If someone
knows any tools that does work, please let me know :) ).
It would be great if
depcould break this trend and work well with privaterepositories from the start.
I'm probably not covering all use cases, but these are the use cases I would
like to see solved.
From my point of view this could be as simple as introducing an environment
variable which maps your private repo URL to a certain protocol. E.g.:
Which means whenever
depencounters an import path which starts withmy.ghe.comit will automatically choosegit+sshwhen fetching the repo. Andsince I already have configured an ssh key on my machine it should know how to
authenticate.
Similarly when it encounters an import path with
my.ghe2.comitwill choose
git+httpsand ask me for username+password or just work if Ihave configured what token to use in
.gitconfig.I'm sure someone could think of a better name for the environment variable and
a better format, but I hope you get my point.