Wrong versions when installing depencencies-of-dependencies with Glide.yaml

[migueleliasweb]

Context

Hey guys, I'm trying to use dep to setup helm as a dependency for one of my projects.

Helm currently relies on Glide for dependency management and they have very specific versions defined in their Glide.yaml some as specific as a single commit. For example: grpc

I tried use dep to install it hoping that it would read Helm's Glide.yaml and install those specific version for me but I couldn't make it to do so. It looks like it is installing the latest version of all Helm's dependencies and that breaks the compatibility.

Here is what I have so far:

$ ls
main.go
Gopkg.lock
Gopkg.lock

Gopkg.toml

[[constraint]]
  name = "k8s.io/helm"
  version = "=2.6.2"

$ dep ensure -v
Root project is "github.com/migueleliasweb/scythe"
 1 transitively valid internal packages
 1 external packages imported from 1 projects
(0)   ✓ select (root)
(1)	? attempt k8s.io/helm with 1 pkgs; 47 versions to try
(1)	    try k8s.io/helm@v2.7.0
(2)	✗   k8s.io/helm@v2.7.0 not allowed by constraint 2.6.2:
(2)	    2.6.2 from (root)
(1)	    try k8s.io/helm@v2.6.2
(1)	✓ select k8s.io/helm@v2.6.2 w/8 pkgs
(2)	? attempt github.com/golang/protobuf with 3 pkgs; 1 versions to try
(2)	    try github.com/golang/protobuf@master
(2)	✓ select github.com/golang/protobuf@master w/3 pkgs
(3)	? attempt github.com/ghodss/yaml with 1 pkgs; 2 versions to try
(3)	    try github.com/ghodss/yaml@v1.0.0
(3)	✓ select github.com/ghodss/yaml@v1.0.0 w/1 pkgs
(4)	? attempt gopkg.in/yaml.v2 with 1 pkgs; 1 versions to try
(4)	    try gopkg.in/yaml.v2@v2
(4)	✓ select gopkg.in/yaml.v2@v2 w/1 pkgs
(5)	? attempt github.com/gobwas/glob with 1 pkgs; 7 versions to try
(5)	    try github.com/gobwas/glob@v0.2.2
(5)	✓ select github.com/gobwas/glob@v0.2.2 w/8 pkgs
(6)	? attempt golang.org/x/net with 1 pkgs; 5 versions to try
(6)	    try golang.org/x/net@master
(6)	✓ select golang.org/x/net@master w/1 pkgs
(7)	? attempt github.com/BurntSushi/toml with 1 pkgs; 7 versions to try
(7)	    try github.com/BurntSushi/toml@v0.3.0
(7)	✓ select github.com/BurntSushi/toml@v0.3.0 w/1 pkgs
(8)	? attempt github.com/Masterminds/semver with 1 pkgs; 14 versions to try
(8)	    try github.com/Masterminds/semver@v1.4.0
(8)	✓ select github.com/Masterminds/semver@v1.4.0 w/1 pkgs
(9)	? attempt google.golang.org/grpc with 3 pkgs; 25 versions to try
(9)	    try google.golang.org/grpc@v1.7.1
(9)	✓ select google.golang.org/grpc@v1.7.1 w/17 pkgs
(10)  ? revisit github.com/golang/protobuf to add 1 pkgs
(10)    ✓ include 5 more pkgs from github.com/golang/protobuf@master
(10)  ? attempt google.golang.org/genproto with 1 pkgs; 1 versions to try
(11)      try google.golang.org/genproto@master
(11)  ✓ select google.golang.org/genproto@master w/1 pkgs
(11)  ? revisit golang.org/x/net to add 3 pkgs
(12)    ✓ include 7 more pkgs from golang.org/x/net@master
(11)  ? attempt golang.org/x/text with 3 pkgs; 1 versions to try
(13)      try golang.org/x/text@master
(13)  ✓ select golang.org/x/text@master w/14 pkgs
(12)  ? attempt k8s.io/apimachinery with 1 pkgs; 11 versions to try
(14)      try k8s.io/apimachinery@master
(14)  ✓ select k8s.io/apimachinery@master w/1 pkgs
  ✓ found solution with 65 packages from 12 projects

Solver wall times by segment:
     b-list-versions: 12.61373735s
         b-list-pkgs: 4.976944097s
     b-source-exists: 4.251149309s
  b-deduce-proj-root: 1.690517956s
              b-gmal: 558.769749ms
         select-atom:  17.993129ms
             satisfy:  15.365522ms
            new-atom:      439.5µs
         select-root:     95.995µs
               other:     60.008µs
            add-atom:     25.154µs
          b-pair-rev:     17.244µs
           b-matches:      4.007µs
      b-pair-version:        786ns

  TOTAL: 24.125119806s

(1/12) Wrote github.com/ghodss/yaml@v1.0.0
(2/12) Wrote github.com/gobwas/glob@v0.2.2
(3/12) Wrote gopkg.in/yaml.v2@v2
(4/12) Wrote github.com/BurntSushi/toml@v0.3.0
(5/12) Wrote github.com/Masterminds/semver@v1.4.0
(6/12) Wrote github.com/golang/protobuf@master
(7/12) Wrote google.golang.org/grpc@v1.7.1
(8/12) Wrote golang.org/x/net@master
(9/12) Wrote k8s.io/helm@v2.6.2
(10/12) Wrote google.golang.org/genproto@master
(11/12) Wrote k8s.io/apimachinery@master
(12/12) Wrote golang.org/x/text@master

What did you expect to see?

Installed versions match the dependency's Glide.yaml.

What did you see instead? Dep basically installed the latest versions of all dependencies.

As you can see dep installed grpc version 1.7.1:

(9)	? attempt google.golang.org/grpc with 3 pkgs; 25 versions to try
(9)	    try google.golang.org/grpc@v1.7.1
(9)	✓ select google.golang.org/grpc@v1.7.1 w/17 pkgs

...but at Helm's Glide.yaml, GRpc is set for version 1.2.1

[migueleliasweb]

The workaround would be setting an override to google.golang.org/grpc for version 1.2.1 but I don't think this should be needed since the depenency requested on Glide.yaml an specific version.

[sdboyer]

hiya! yeah, we're working on this, and we have a switch to flip to turn on "on the fly importing" - it's just a very big, risky switch to flip. we know it can make dep massively more useful, especially for folks trying to convert complex project ecosystems (see e.g. #821, which is the same idea) - but there's also a lot of ways things can go wrong.

we're planning to flip this switch in the not-too-distant future, though i think we may keep it behind an env var for a little while, certainly at least until shortly before a release.

(closing as dup)

[migueleliasweb]

Thanks @sdboyer ! I will keep an eye on #821 !