How to Safely and Efficiently Build your App with Modules - Aaron Schlesinger - Microsoft

Go 1.11 introduced modules as the new dependency management technology for Go, and since then, we've been hit with a lot of new technologies in this space. With version 1.13, we're now using a Google-hosted module proxy and a checksum DB, all by default.

In order to safely and efficiently build our programs, we need to not only understand these technologies, but to understand how they affect our workflow and the safety of our app.

In this session, I'll briefly introduce the new features that Go 1.13 turns on by default, the pros and cons of these features, why you might want to opt out of them, and how to do so. Much of this talk will be live demos illustrating why to use the default features and why/how to turn them off. We'll use [Athens](https://github.com/gomods/athens) for the demos of turning the defaults off.

You'll walk away from this talk with a good understand of what your builds are doing under the hood, under what circumstances you should use them or turn them off, and how to do just that.

This talk is for everyone who writes Go code, and no prior knowledge of modules is necessary. You'll be introduced to the pieces of dependency management that you'll need for this talk.

Transcript

2. How did we get here? How did we get here?
3. How did we get here? How did we get here? nil
4. How did we get here? How did we get here? nil go get
5. How did we get here? How did we get here? nil go get GO15VENDOREXPERIMENT
6. How did we get here? How did we get here? nil go get GO15VENDOREXPERIMENT glide, dep, ...
7. How did we get here? How did we get here? nil go get GO15VENDOREXPERIMENT glide, dep, ... go get
8. go get is brand new is brand new
9. Aaron Aaron Schlesinger Schlesinger Core maintainer & Creator, Sr. Cloud Developer Advocate, Microsoft Athens @arschles
10. Everything uses Everything uses go
11. Everything uses Everything uses go With a deceivingly familiar workflow.
12. Behind the scenes Behind the scenes
13. Behind the scenes Behind the scenes proxy.golang.org
14. Behind the scenes Behind the scenes proxy.golang.org (No VCS downloads. Custom HTTP API)
15. Behind the scenes Behind the scenes proxy.golang.org (No VCS downloads. Custom HTTP API) sum.golang.org
16. Behind the scenes Behind the scenes proxy.golang.org (No VCS downloads. Custom HTTP API) sum.golang.org (Global checksum database)
17. Layers to preparedness Layers to preparedness
18. Layers to preparedness Layers to preparedness Tracking & securing dependencies
19. Layers to preparedness Layers to preparedness Tracking & securing dependencies Where code comes from
20. Layers to preparedness Layers to preparedness Tracking & securing dependencies Where code comes from Where it's stored
21. Layers to preparedness Layers to preparedness Tracking & securing dependencies Where code comes from Where it's stored Handling private code
22. A basic build A basic build (demo) Your project with public dependencies Your project with public dependencies
23. A shared A shared vendor folder? folder?
24. Your private code Your private code (demo) proxy.golang.org and sum.golang.org should not see private module names
25. Using a private server Using a private server (demo) Own your shared vendor
26. Things to Things to remember remember
27. A fundamental change A fundamental change (under the hood)
28. Increased security Increased security
29. Increased security Increased security With higher complexity
30. Private code Private code
31. Private code Private code You must overwrite defaults
32. More Reading More Reading
33. More Reading More Reading GONOPROXY, GONOSUMDB, GOPRIVATE
34. More Reading More Reading GONOPROXY, GONOSUMDB, GOPRIVATE go help module-private
35. More Reading More Reading GONOPROXY, GONOSUMDB, GOPRIVATE go help module-private github.com/golang/go/wiki/Modules
36. @arschles bit.ly/godaysmodules2020 docs.gomods.io