package management: Plans to migrate to dep?

[VoR0220]

Any chance of migrating go-ethereum to using dep? Seeing as it's aiming to be the package manager to end all golang package management problems, seems it would be useful to begin utilizing it.

Any objections to using it? Seems it's basically ready to rock...although the secp256k1 issues might create some issues in the short run.

https://github.com/golang/dep

[karalabe]

We've switched dependency management quite a lot until we arrived at the current govendor setup that works for all corner cases. What would be the added value of dep to warrant yet another switch? Given that it's still considered experimental, I don't really see why we should move.

[VoR0220]

couple reasons:

a) It's going to be in the official golang toolkit.
b) It has the efforts of the folks from all the various package managers across the golang space
c) Better handling of foreign repos (it has an algorithm that checks all available versions in it's "range" to make sure things don't break as it updates before settling on one "branch"). Could be slower but also very useful in terms of making sure external dependencies don't break the codebase.
d) It's safe for production use...so they say. Am skeptical about how this would work with secp256k1 specifically.

If those are not enough then perhaps it would be better to wait until it's more solidified.

[karalabe]

I don't mind switching to a "standard" tool once it's accepted as such. But we don't really have the capacity to experiment in this direction, and to debug any issues, hence why for the current moment I'd stick with our working system. But we should definitely revisit this once dep gets more mainstream adoption.

[VoR0220]

Sure. It makes sense to play conservatively here. Should we keep this open for a revisiting at a later date or close for now?

[fjl]

We will migrate to anything else if

• it's strictly better
• it's strictly more 'standard' and it can handle our use case

When this happens, the transition will be a no-brainer and we don't need to have an issue for it now.