I have been converting existing projects from using vendored dependencies via Glide, to using the Go 1.11.x module support. But I am hitting a particular case in one project using modules that I cannot solve.
Internal project 'foo' has its dependencies vendored via "go mod vendor":
projects/src/foo/
main.go
vendor/
...
This works great when building that project internally since a non-go developer can clone the project to any location and build it, with no external proxy access needed to download dependencies.
Now I am trying to allow project 'bar' to build a tool using library 'foo'.
package bar
import "internal.com/project/foo"
The "go.mod" file only contains:
module internal.com/project/bar
require internal.com/project/foo v0.0.0-...
I would vendor via:
go module vendor
And I build via:
go build -mod=vendor
What I am seeing is that 'foo' will be cloned from the internal git repo, and all of its dependencies will be downloaded from their remote git origins, and my 'go.sum' file is updated with all of the transient dependencies. But what I really want is to only fetch 'foo' from my internal network and to have it flatten the vendored dependencies. Ideally, there should be no external http requests.
Is this even possible? The "-mod=vendor" flag was very useful when building project "foo" directly. But it doesn't seem to apply here because project "bar" doesn't want to vendor. It wants to get the one primary dependency and that is it. It would seem that Go module support doesn't care about flattening vendored transient dependencies.
Previous when using glide as the package manager, it would fetch 'foo' from the internal git repo and then flatten all of its dependencies into my vendor directory.
Originally posted as a question to golang-nuts, without reply.