0018 vendor gauge dependencies

18. Vendor gauge dependencies

Date: 2017-08-16

Status

Accepted

Context

Gauge uses Godep to manage dependencies. Godep checks out a particular version of the dependency in GOPATH. However, this limits us to get and build gauge using go get github.com/getgauge/gauge as the dependencies will be checked out with proper versions. To enable gauge to be fetched using go get we need to remove Godep dependency.
By removing Godep dependency, we have to fetch all dependencies using go get ./.... This will fetch all dependencies from the tip of their upstream repositories. By doing this, reproducible builds of gauge cannot be created.

Decision

Use golang's vendoring support to manage all dependencies. This will work with go get builds as well as lets us have a particular version of the dependency to be checked out enabling reproducible builds to be created.

Consequences

• Vendoring will check out dependencies in vendor directory of gauge. If two or more projects use the same dependency, they will be checked out for each project.