New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposal: cmd/go: detect use of code outside current directory tree #22440

Open
dotaheor opened this Issue Oct 25, 2017 · 9 comments

Comments

Projects
None yet
4 participants
@dotaheor

dotaheor commented Oct 25, 2017

The Problem

For many times, my project dependency packages are not placed in the vendor folder of my project.
But these dependencies are under other paths which are under GOPATH/src.
So "go build" an "go install" both succeed on my local machine development env.
But when the two commands both fail on machines of my teamworkers and server env, for some dependency packages are not vendered.

The Proposal

So I proposal an option for these commands, to exclude all custom packages except the ones under pwd in building, so that I can find the missed vendor packages as early as possible. Currently, I must build my project in a docker container to achieve the goal. It is not very convenient.

@gopherbot gopherbot added this to the Proposal milestone Oct 25, 2017

@gopherbot gopherbot added the Proposal label Oct 25, 2017

@ianlancetaylor

This comment has been minimized.

Contributor

ianlancetaylor commented Oct 25, 2017

Can't that new option simply be:

GOPATH=`pwd` go build
@dotaheor

This comment has been minimized.

dotaheor commented Oct 25, 2017

"GOPATH=pwd go build" doesn't work, except all my project code is placed under a "src" subfolder in my project folder. But I don't like to put a "src" subfolder in my project.

@ianlancetaylor

This comment has been minimized.

Contributor

ianlancetaylor commented Oct 25, 2017

The point is, set GOPATH to the set of directories you want to search.

Or maybe I don't understand what you are asking for. Can you show a tiny complete example?

@dotaheor

This comment has been minimized.

dotaheor commented Oct 25, 2017

For example, this is a file under my project root:

// a.go
package main

import "b"

func main() {
  b.F()
}

And here is another package "b" in the vendor folder which is directly under the project root folder.

// vendor/b/b.go
package b

func F() {}

Then

$ GOPATH=`pwd` go build
a.go:3:8: cannot find package "b" in any of:
	/sdk//go/src/b (from $GOROOT)
	/myproject/src/b (from $GOPATH)

A bare "go build" will succeed, even if the package "b" is not vendored, but it is under GOPATH/src.
What I hope is if package "b" is not vendored, "go build -excludeExternalPackages" will fail, even if package "b" is under GOPATH/src.

@dotaheor

This comment has been minimized.

dotaheor commented Oct 25, 2017

It would be also ok if go tools support a "GOPATHSRC" env variable, so that I can use "GOPATHSRC=pwd go build" to build my project.

@dotaheor

This comment has been minimized.

dotaheor commented Oct 25, 2017

Damn it. It looks the "GOPATHSRC" env variable has really been supported.
Cool!

@dotaheor dotaheor closed this Oct 25, 2017

@dotaheor

This comment has been minimized.

dotaheor commented Oct 25, 2017

But it doesn't solve my problem. If package "b" is under GOPATH/src but not vendored, "GOPATHSRC=pwd go build" still will succeed.

@dotaheor dotaheor reopened this Oct 25, 2017

@dotaheor

This comment has been minimized.

dotaheor commented Oct 25, 2017

my mistake, "GOPATHSRC=pwd" is a nonsense in my experiments. "GOPATHSRC" env variable is not supported yet.

@rsc rsc changed the title from Proposal: add a new option for go tools, to exclude all custom packages except the ones under pwd to proposal: cmd/go: detect use of code outside current directory tree Dec 4, 2017

@rsc rsc added the Proposal-Hold label Dec 4, 2017

@rsc

This comment has been minimized.

Contributor

rsc commented Dec 4, 2017

Leaving on hold for package management.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment