Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upcmd/go: allow verifying vendored code #27348
Milestone
Comments
FiloSottile
changed the title
This was referenced Feb 15, 2019
This comment has been minimized.
This comment has been minimized.
|
This is still on our radar, but probably not happening for 1.13. (We have a lot to do this cycle!) I'm hoping to get to it in 1.14, but we don't have a 1.14 milestone defined yet. |
stp-ip
added a commit
to stp-ip/caddy
that referenced
this issue
Mar 5, 2019
Tracking issue: golang/go#27348
amshinde
added a commit
to kata-containers/tests
that referenced
this issue
Jul 31, 2019
While we move to go modules, perform the dep check for repos that still use dep. Run `go mod verify` instead for go modules. Note, this just verifies the integrity of modules in the local cache. We would have instead wanted to verify the vendored code here, but that is still not supported. golang/go#27348 Fixes #1879 Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
stevendanna
added a commit
to chef/automate
that referenced
this issue
Nov 4, 2019
`go mod verify` does not verify the vendored copies of dependencies: golang/go#27348 As such, it seems that this change snuck in. This commit is the result of commit the all changes produced by `make revendor` on master. Signed-off-by: Steven Danna <steve@chef.io>
stevendanna
added a commit
to chef/automate
that referenced
this issue
Nov 4, 2019
`go mod verify` does not verify the vendored copies of dependencies: golang/go#27348 As such, it seems that this change snuck in. This commit is the result of commit the all changes produced by `make revendor` on master. Signed-off-by: Steven Danna <steve@chef.io>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
go mod verifyis extremely useful for validating the integrity of modules in the local cache.It would be great if projects that choose to vendor their modules (then presumably building with
go build -mod vendor ...) had a similar command to verify the integrity of modules in that directory.This would satisfy a major requirement that many projects need to account for in their CI process-- ensuring that vendored code hasn't been tampered with.