The New Era of Go Package Management

Slide 1

Slide 1 text

@sdboyer The New Era of Go Package Management sam boyer

Slide 2

Slide 2 text

@sdboyer 1. We write code

Slide 3

Slide 3 text

@sdboyer 2. We use others’ code

Slide 4

Slide 4 text

@sdboyer 3. ow

Slide 5

Slide 5 text

@sdboyer Package (dependency) management matters

Slide 6

Slide 6 text

@sdboyer No, like…more than that

Slide 7

Slide 7 text

@sdboyer Tools -> Social Systems

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

No content

Slide 11

Slide 11 text

No content

Slide 12

Slide 12 text

No content

Slide 13

Slide 13 text

No content

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

@sdboyer Roots of the problem • GOPATH allows only one version • No reproducibility • Releases, ~pointless • Updates, a crapshoot

Slide 16

Slide 16 text

No content

Slide 17

Slide 17 text

@sdboyer Rise of the tools • 2013: Godep, gom, et al. - 2013 • 2014: glide, gopkg.in, et al. - 2014 • 2015: gb, govendor, et al. - 2015

Slide 18

Slide 18 text

@sdboyer vendor/ on the scene • Go 1.5: vendor/ added, oﬀ by default (Aug, 2015) • Go 1.6: vendor/ on by default (Feb, 2016) • Go 1.7: vendor/ always on (Aug, 2016)

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

@sdboyer godep glide gb govendor (et al.)

Slide 21

Slide 21 text

@sdboyer github.com/golang/dep

Slide 22

Slide 22 text

@sdboyer

Slide 23

Slide 23 text

@sdboyer dep fundamentals • Borrows from others, but is tailored to Go • Imports are queen • Two-ﬁle system: Gopkg.toml, Gopkg.lock • Project-oriented • Semver tagging • vendor/-centric - (almost) no GOPATH

Slide 24

Slide 24 text

@sdboyer dep status dep init dep ensure

Slide 25

Slide 25 text

@sdboyer godep glide gb govendor (et al.) GOPATH dep

Slide 26

Slide 26 text

@sdboyer dep status dep init dep ensure

Slide 27

Slide 27 text

@sdboyer ensure keeps states in sync Project Code (imports) Gopkg.toml Gopkg.lock Deps (vendor)

Slide 28

Slide 28 text

@sdboyer “Sync-based” tool

Slide 29

Slide 29 text

No content

Slide 30

Slide 30 text

@sdboyer “Hey dep, ensure everything’s shipshape, kthx”

Slide 31

Slide 31 text

@sdboyer

Slide 32

Slide 32 text

@sdboyer

Slide 33

Slide 33 text

@sdboyer ) dep dep go

Slide 34

Slide 34 text

@sdboyer ) dep go

Slide 35

Slide 35 text

No content

Slide 36

Slide 36 text

@sdboyer Key insights from dep • Two-ﬁle system • Imports are queen • Still sync-based • Semver tagging • vendor/, sorta

Slide 37

Slide 37 text

@sdboyer TODOs • Multi-project workﬂow • Semver suggestion tool • Registries • Editor integration patterns • Security model • Performance! • Better failure feedback • Private/enterprise patterns

Slide 38

Slide 38 text

@sdboyer TODOs…for YOU • Tag your projects with semver • Convert projects to dep (yes, it’s ready!) • Maybe jump in and contribute to dep - word is, we’re super friendly! • Hackathon, tomorrow! • Updates: sdboyer.io/dep-status

Slide 39

Slide 39 text

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND… The MIT License

Slide 40

Slide 40 text

No content