fixing versions of tools used by go

I am looking to create reproducible builds with go. For individual projects we are using glide.

So for example I use:

glide get github.com/stretchr/testify

to fix the version of the "testify" package. This does not work for tools however. For example:

glide install github.com/tebeka/go2xunit

returns success but does not actually install go2xunit so I have to use:

go get github.com/tebeka/go2xunit

which installs go2xunit to $GOPATH/bin.

Q How can I fix the version of tools like go2xunit?

I also note that glide says use dep instead and dep says golang has diverged from its implementation and will probably end up using something based on vgo. There are a plethora of dependency management tools for go perhaps one of the less well known ones supports this?

In case its relevant I'm using go 1.7.4 as provided by Debian9.

The solution for go1.11 using go modules is to create a fake tools package. You create a tools.go file like the following:

// +build tools

package tools

import (
        _ "github.com/tebeka/go2xunit"
)

+build tools is a magic comment which prevents the package being built.

>go mod init tools

Will create a go.mod file for the fake tools package

>go install github.com/tebeka/go2xunit

Will install go2xunit and update go.mod as follows.

module tools

require github.com/tebeka/go2xunit v1.4.8 // indirect

Now if you run go install github.com/tebeka/go2xunit in the future (for a clean build say) its version will be fixed to v1.4 by the go.mod

For versions of go before 1.11 the tool to use is retool. It works like this:

bootstrap:

go get github.com/twitchtv/retool

add tool:

retool add github.com/jteeuwen/go-bindata/go-bindata origin/master

use tool:

retool do go-bindata -pkg testdata -o ./testdata/testdata.go ./testdata/data.json

Adding support for this may be on the roadmap to target go 1.12 (https://github.com/golang/go/issues/27653)

来源：https://stackoverflow.com/questions/53086136/fixing-versions-of-tools-used-by-go

标签