fixing versions of tools used by go

Question

I am looking to create reproducible builds with go. For individual projects we are using glide.

So for example I use:

glide get github.com/stretchr/testify

to fix the version of the "testify" package. This does not work for tools however. For example:

glide install github.com/tebeka/go2xunit

returns success but does not actually install go2xunit so I have to use:

go get github.com/tebeka/go2xunit

which installs go2xunit to $GOPATH/bin.

Q How can I fix the version of tools like go2xunit?

I also note that glide says use dep instead and dep says golang has diverged from its implementation and will probably end up using something based on vgo. There are a plethora of dependency management tools for go perhaps one of the less well known ones supports this?

In case its relevant I'm using go 1.7.4 as provided by Debian9.

Answer 1

The solution for go1.11 using go modules is to create a fake tools package. You create a tools.go file like the following:

// +build tools

package tools

import (
        _ "github.com/tebeka/go2xunit"
)

+build tools is a magic comment which prevents the package being built.

>go mod init tools

Will create a go.mod file for the fake tools package

>go install github.com/tebeka/go2xunit

Will install go2xunit and update go.mod as follows.

module tools

require github.com/tebeka/go2xunit v1.4.8 // indirect

Now if you run go install github.com/tebeka/go2xunit in the future (for a clean build say) its version will be fixed to v1.4 by the go.mod

---

For versions of go before 1.11 the tool to use is retool. It works like this:

bootstrap:

go get github.com/twitchtv/retool

add tool:

retool add github.com/jteeuwen/go-bindata/go-bindata origin/master

use tool:

retool do go-bindata -pkg testdata -o ./testdata/testdata.go ./testdata/data.json

Adding support for this may be on the roadmap to target go 1.12 (https://github.com/golang/go/issues/27653)