dependency management

[mmlb]

Running go get ./... strikes me as not the greatest thing to be doing, any thoughts on using a package manager to handle the deps?

I ran dep init . and found many of the dependencies to have sane versions released.

[mehrdadrad]

@mmlb pls post more details about this.

[mmlb]

I'm not sure what else to post apart from "vflow should be managing it's dependencies", here's dep init output:

❯ dep init                                                                                                 master
  Using v2 as constraint for direct dep gopkg.in/yaml.v2
  Locking in v2 (287cf08) for direct dep gopkg.in/yaml.v2
  Using ^1.14.0 as constraint for direct dep github.com/Shopify/sarama
  Locking in v1.14.0 (240fd14) for direct dep github.com/Shopify/sarama
  Locking in master (bb955e0) for transitive dep github.com/eapache/go-xerial-snappy
  Locking in v1.1.0 (346938d) for transitive dep github.com/davecgh/go-spew
  Locking in v1.0.0 (6800482) for transitive dep github.com/eapache/go-resiliency
  Locking in v1.1.0 (44cc805) for transitive dep github.com/eapache/queue
  Using ^1.3.0 as constraint for direct dep github.com/nats-io/go-nats
  Locking in v1.3.0 (29f9728) for direct dep github.com/nats-io/go-nats
  Locking in v1.0.0 (289cccf) for transitive dep github.com/nats-io/nuid
  Using ^1.3.1 as constraint for direct dep github.com/kshvakov/clickhouse
  Locking in v1.3.1 (81a24df) for direct dep github.com/kshvakov/clickhouse
  Locking in v1.0.1 (08c2793) for transitive dep github.com/pierrec/lz4
  Using master as constraint for direct dep golang.org/x/net
  Locking in master (9dfe398) for direct dep golang.org/x/net
  Using ^1.0.7 as constraint for direct dep github.com/bitly/go-nsq
  Locking in v1.0.7 (eee57a3) for direct dep github.com/bitly/go-nsq
  Using ^2.1.10 as constraint for direct dep github.com/bsm/sarama-cluster
  Locking in v2.1.10 (abf0394) for direct dep github.com/bsm/sarama-cluster
  Locking in master (1f30fe9) for transitive dep github.com/rcrowley/go-metrics
  Locking in v0.1.1 (f051bb7) for transitive dep github.com/pierrec/xxHash
  Locking in master (553a641) for transitive dep github.com/golang/snappy

I'd be happy to sumbit a PR to add dep metadata files and make use of it in the makefile/dockerfile, I wanted to gauge if this was something that would be wanted.

[mehrdadrad]

@mmlb it's not necessary, thanks!

[mmlb]

@mehrdadrad can you expand on why you think it is not necessary? If I build vflow today I have no guarantees that when I go to build it next month that it will build again. Both sarama-cluster and gopkg.in/yaml are at major version 2 which is evidence of this happening once before and possible in the future.