chore(vendor): Migrate to dep for fetching dependencies

[springerigor]

An official blog article about package versioning & dep

There may be some issues with the builds, but let's first agree if you are OK with moving into that direction.

[mefellows]

I haven't had a chance to read that, does it recommend dep as the path forward? I'm in principle happy to align to future Go proposals/standards, but not sure it's going to give us anything in the near term. What's the tradeoffs we'd be making from govend?

[springerigor]

Well, according to the official documentation:

dep, is an official experiment for the dependency tool. It is currently being implemented, in pre-alpha state and should be used with caution as "Lots of functionality is knowingly missing or broken".)

It's maintained by Golang team and the repo has over 8k starts, so it has becoming a standard for managing dependencies.

One huge benefit is no need for storying the whole vendor package within a repository (not sure if govend allows to do so).

It is also Docker-friendly because it allows to fetch all dependencies using Gopkg* files only e.g:

# Copy the Gopkg.toml and Gopkg.lock to WORKDIR
COPY Gopkg.toml Gopkg.lock ./

# Install the dependencies without checking the source code
RUN dep ensure -v -vendor-only

So in my opinion it's worth adopting, but if govend fulfill your needs, we can close this PR :-)

[Deseao]

I want to weigh in here both with a pro and a con.
I've been using dep on some of my projects and it's a clear improvement over the tooling we had in place (govendor). That said, there is some uncertainty over whether dep is going to be the official package manager. See https://github.com/golang/go/wiki/vgo. In my opinion, if switching is not too painful then I would suggest doing it as the Gopkg.toml and Gopkg.lock files are much easier to work with even if you end up having to switch again in the future for vgo if it ever comes out.

[mefellows]

Thanks @Deseao, I'll see about rolling it into the changes related to #74 - which will be part of the next major release.

I can't see it being a huge change for us.

[springerigor]

@Deseao thanks for the input 👍I hadn't been aware of vgo till you wrote about it. I hope one day there will be one official dependencies manager like bundler for Ruby.

@mefellows I managed to update the builds' configurations to make them green. Please let me know if I can do anything more to help delivering this PR :)

[mefellows]

Let's make this happen - thanks!

I'll roll this into #74 too.