Use dep to manage dependencies

.gitignore

@@ -1,4 +1,5 @@
-/_output
-image-inspector
 *.a
 *.swp
+/_output
+/vendor
+image-inspector

Dockerfile

@@ -7,10 +7,13 @@ RUN yum update -y && \
 
 COPY .  /go/src/github.com/openshift/image-inspector
 
-RUN GOBIN=/usr/bin \
-    GOPATH=/go \
-    CGO_ENABLED=0 \
-    go install -a -installsuffix cgo /go/src/github.com/openshift/image-inspector/cmd/image-inspector.go && \
+RUN export GOBIN=/usr/bin && \
+    export GOPATH=/go && \
+    export CGO_ENABLED=0 && \
+    cd /go/src/github.com/openshift/image-inspector && \
+    go get -v github.com/golang/dep/cmd/dep && \
+    dep ensure -vendor-only -v && \
+    go install -a -installsuffix cgo cmd/image-inspector.go && \
     mkdir -p /var/lib/image-inspector
 
 EXPOSE 8080

Gopkg.toml

@@ -0,0 +1,23 @@
+[[constraint]]
+  name = "golang.org/x/net"
+  revision = "570fa1c91359c1869590e9cedf3b53162a51a167"
+
+[[constraint]]
+  name = "github.com/fsouza/go-dockerclient"
+  revision = "bf97c77db7c945cbcdbf09d56c6f87a66f54537b"
+
+[[constraint]]
+  name = "github.com/openshift/clam-scanner"
+  revision = "10301190ffc03e918609f280458bd6bb26e779e2"
+
+[[constraint]]
+  name = "github.com/subchen/go-xmldom"
+  revision = "93fb82989feca2cc04221f1483c8fe1dc98ed503"
+
+[[constraint]]
+  name = "github.com/antchfx/xpath"
+  revision = "0851b60062c5ccde520ce15765695b8525d4a034"
+
+[[constraint]]
+  name = "github.com/golang/glog"
+  revision = "23def4e6c14b4da8ac2ed8007337bc5eb5007998"

Makefile

@@ -3,6 +3,7 @@
 # Targets (see each target for more information):
 #   all: Build code.
 #   build: Build code.
+#   vendor: Create and populate the `vendor` directory.
 #   test-unit: Run unit tests.
 #   clean: Clean up.
 
@@ -13,16 +14,23 @@ OUT_DIR = _output
 # Example:
 #   make
 #   make all
-all build:
+all build: vendor
 	hack/build-go.sh
 .PHONY: all build
 
+# Create and populate the `vendor` directory, using the `dep` tool.
+#
+# Example:
+#   make vendor
+vendor: Gopkg.toml Gopkg.lock
+	dep ensure -vendor-only -v
+
 # Remove all build artifacts.
 #
 # Example:
 #   make clean
 clean:
-	rm -rf $(OUT_DIR)
+	rm -rf $(OUT_DIR) vendor
 .PHONY: clean
 
 # Verify code conventions are properly setup.

README.md

@@ -57,6 +57,10 @@ provide the `-post-results-token-file` option and point it to a file with shared
 
 # Building
 
+The dependencies of the project are managed using the [dep](https://github.com/golang/dep)
+tool, so make sure you have it installed in in your `$PATH` before trying to build. The
+`make` command will automatically create and populate the `vendor` directory.
+
 To build the image-inspector you can run this command:
 
     $ make

hack/install-tools.sh

@@ -7,7 +7,7 @@ CODE_ROOT=$(dirname "${BASH_SOURCE}")/..
 source "${CODE_ROOT}/hack/common.sh"
 echo "Detected go version: $(go version)"
 
-go get github.com/tools/godep
+go get github.com/golang/dep/cmd/dep  # installs the `dep` tool
 go get github.com/onsi/ginkgo/ginkgo  # installs the ginkgo CLI
 go get github.com/onsi/gomega         # fetches the matcher library