Unable to update dependency from private GitHub repository

[osunac]

What version of dep are you using (dep version)?

dep:
 version     : v0.3.2
 build date  : 2017-10-19
 git hash    : 8ddfc8a
 go version  : go1.9
 go compiler : gc
 platform    : linux/amd64

What dep command did you run?

dep ensure -v --vendor-only

What did you expect to see?

Success

What did you see instead?

(1/5) Wrote github.com/jolestar/go-commons-pool@v1.1.2
(2/5) Wrote gopkg.in/yaml.v2@v2
(3/5) Wrote github.com/satori/go.uuid@v1.1.0
(4/5) Wrote github.com/<user>/<projectA>@<version>
(5/5) Failed to write github.com/<user>/<projectB>@master
grouped write of manifest, lock and vendor: error while writing out vendor tree: failed to write dep tree: failed to export github.com/<user>/<projectB>: : exit status 128

Description

Because projectB is a private repository, a SSH key is required and without additional configuration tools such as go get and dep fail. The additional configuration is:

# ~/.gitconfig
[url "git@github.com:"]
        insteadOf = https://github.com/

Initially dep ensure seems to work, but if projectB is updated I face the issue described in this ticket.

Workaround

Removing the directory pkg/dep/sources/https---github.com-user-projectB forces dep ensure to clone again the repository with the latest source code.

Alternatively (and more cleanly) running git fetch in the aforementioned directory makes all the SHA1 available to dep ensure.

[sdboyer]

hi! thanks for the detailed report, and especially for reaching into the cache dir and noticing that the local repo wasn't getting updated.

at the same time, i've not seen a report like this in some time - could you possibly try reproducing this issue with the latest from master?

[osunac]

Hi.

Same thing with a recent version of the tool obtained with go get -u.

dep:
 version     : devel
 build date  :
 git hash    :
 go version  : go1.8.3
 go compiler : gc
 platform    : linux/amd64

The source code is actually at revision ef6a28f

On another computer that also exhibits the problem, the directory name is ssh---git@github.com-user-projectB. This makes me wonder how git and dep interact. The former knows about the URL rewrite, but not the later.

[omarkohl]

After updating dep several colleagues and myself (on several different machines) ran into this issue today. But we don't use any private GitHub repositories so it might be a different issue!

The error message is almost the same and every execution of dep ensure fails on a different repositories.

grouped write of manifest, lock and vendor: error while writing out vendor tree: failed to write dep tree: failed to export gopkg.in/yaml.v2: : exit status 128

grouped write of manifest, lock and vendor: error while writing out vendor tree: failed to write dep tree: failed to export golang.org/x/sys: : exit status 128

What is also curious is that when executing dep ensure we were asked to unlock our SSH key (even though all repositories are available over https) and add github.com to known_hosts.

After cleaning up the dep cache dir everything works fine.

[hiromaily]

+1

[thomascriley]

+1

reproduce:

• dep ensure --update runs locally.
• remote CI runs dep ensure only to make sure vendor dir matches Gopkg.lock
• error occurs when head has been updated in Gopkg.lock after dep cache dir has been populated on CI

potential cause:

• dep ensure does not fetch new dependency head refs / branches listed in Gopkg.lock when not found in dep cache dir repo.

Thank you!