Add go.mod, and vendor wincred v1.1.0

[thaJeztah]

Committing the result of

go mod init
go mod vendor

However, trying to write code to validate the vendored files, I get some weird results; when running

go mod tidy

go mod adds various test-dependencies to go.mod, and I cannot find where they're referenced (not even in the vendored dependency ?); diff below

diff --git a/go.mod b/go.mod
index d24aa62..ec58726 100644
--- a/go.mod
+++ b/go.mod
@@ -2,4 +2,7 @@ module github.com/docker/docker-credential-helpers

 go 1.13

-require github.com/danieljoos/wincred v1.0.2
+require (
+       github.com/danieljoos/wincred v1.0.2
+       github.com/stretchr/testify v1.4.0 // indirect
+)
diff --git a/go.sum b/go.sum
index c531bc4..9724c6d 100644
--- a/go.sum
+++ b/go.sum
@@ -1,2 +1,14 @@
 github.com/danieljoos/wincred v1.0.2 h1:zf4bhty2iLuwgjgpraD2E9UbvO+fe54XXGJbOwe23fU=
 github.com/danieljoos/wincred v1.0.2/go.mod h1:SnuYRW9lp1oJrZX/dXJqr0cPK5gYXqx3EJbmjhLdK9U=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0 h1:4G4v2dO3VZwixGIRoQ5Lfboy6nUhCyYzaqnIAPPhYs4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

Trying to find out why those are added, but no idea;

go mod why github.com/stretchr/testify
# github.com/stretchr/testify
(main module does not need package github.com/stretchr/testify)

git reset --hard HEAD

grep -r "testify" .

grep -r "github.com/" --include "*.go" .
./secretservice/cmd/main_linux.go:	"github.com/docker/docker-credential-helpers/credentials"
./secretservice/cmd/main_linux.go:	"github.com/docker/docker-credential-helpers/secretservice"
./secretservice/secretservice_linux.go:	"github.com/docker/docker-credential-helpers/credentials"
./secretservice/secretservice_linux_test.go:	"github.com/docker/docker-credential-helpers/credentials"
./pass/cmd/main_linux.go:	"github.com/docker/docker-credential-helpers/credentials"
./pass/cmd/main_linux.go:	"github.com/docker/docker-credential-helpers/pass"
./pass/pass_linux.go:	"github.com/docker/docker-credential-helpers/credentials"
./pass/pass_linux_test.go:	"github.com/docker/docker-credential-helpers/credentials"
./osxkeychain/cmd/main_darwin.go:	"github.com/docker/docker-credential-helpers/credentials"
./osxkeychain/cmd/main_darwin.go:	"github.com/docker/docker-credential-helpers/osxkeychain"
./osxkeychain/osxkeychain_darwin.go:	"github.com/docker/docker-credential-helpers/credentials"
./osxkeychain/osxkeychain_darwin.go:	"github.com/docker/docker-credential-helpers/registryurl"
./osxkeychain/osxkeychain_darwin_test.go:	"github.com/docker/docker-credential-helpers/credentials"
./wincred/cmd/main_windows.go:	"github.com/docker/docker-credential-helpers/credentials"
./wincred/cmd/main_windows.go:	"github.com/docker/docker-credential-helpers/wincred"
./wincred/wincred_windows.go:	winc "github.com/danieljoos/wincred"
./wincred/wincred_windows.go:	"github.com/docker/docker-credential-helpers/credentials"
./wincred/wincred_windows.go:	"github.com/docker/docker-credential-helpers/registryurl"
./wincred/wincred_windows_test.go:	"github.com/docker/docker-credential-helpers/credentials"
./client/client.go:	"github.com/docker/docker-credential-helpers/credentials"
./client/client_test.go:	"github.com/docker/docker-credential-helpers/credentials"


grep -r "gopkg.in/" --include "*.go" .

[thaJeztah]

@SamWhited you perhaps any ideas? scratching my head where it got that dependency from

[SamWhited]

@thaJeztah looks like github.com/danieljoos/wincred pulls it in through its tests:

$ go mod why -m github.com/stretchr/testify
# github.com/stretchr/testify
github.com/docker/docker-credential-helpers/wincred
github.com/danieljoos/wincred
github.com/danieljoos/wincred.test
github.com/stretchr/testify/assert

Test files are never vendored, IIRC, though I can't find a list of what is and is not vendored to link you to.

EDIT: go help mod vendor mentions that it skips test code, but doesn't seem to mention anything else. Maybe everything else is vendored now because I see README's and what not in here and those used to be excluded. The IRC channel wasn't sure either, so doesn't appear to be documented or have a strict contract other than "no tests".

[thaJeztah]

oh! I see I didn't use the -m option on go mod why, perhaps that made the difference 🤔
Still confusing, because it doesn't vendor the _test.go file, but it does add it to go.mod 🤷‍♂

[SamWhited]

Yup, the -m tells it to check what module is being used where, without it it checks for packages. This is partially why it doesn't appear in vendor too, vendor selects packages that are used to build, not modules. It does appear in the module cache (probably in ~/go/pkg/mod), which is what Go uses to select the initial dependencies (hence it appears in go.mod). After dependencies are resolved, go build uses packages to actually do the build (so test dependencies are excluded).

TL;DR — resolving dependencies uses modules, building and vendoring use packages.

[thaJeztah]

LGTM