golang 依赖管理

by Ying Kit Yuen

英杰苑

简介：如何管理Golang项目依赖项 (An intro to dep: How to manage your Golang project dependencies)

Update @ 2018–11–26: Technology is not just moving at a breakneck speed but also changing rapidly. Within a year, this article is OUTDATED!

@ 2018–11–26更新：技术不仅以惊人的速度发展，而且也在Swift变化。 一年之内，这篇文章已经过时了！

And according to the dep project page:

并根据dep项目页面 ：

dep was the “official experiment.” The Go toolchain, as of 1.11, has (experimentally) adopted an approach that sharply diverges from dep. As a result, we are continuing development of dep, but gearing work primarily towards the development of an alternative prototype for versioning behavior in the toolchain.

dep是“官方实验”。 从1.11版本开始，Go工具链(实验性地)采用了一种与dep截然不同的方法。 因此，我们正在继续开发dep，但主要致力于开发用于工具链中版本控制行为的替代原型。

For more information about the new Go build-in management, please refer to the official GitHub Wiki — Go 1.11 Modules.

有关新的Go内置管理的更多信息，请参考官方GitHub Wiki — Go 1.11模块 。

Thanks John Arundel @bitfield and Erhan Yakut @yakuter for revealing the problem. ?

感谢John Arundel @bitfield和Erhan Yakut @yakuter揭示了问题。 ？

—

-

Update @ 2018–02–03: Sam Boyer from the godep team has clarified some incorrect information in this article. I apologize to Sam Boyer and the readers for any inconvenience. ?

@ 2018-02-02更新：Godep团队的Sam Boyer在本文中澄清了一些错误信息。 我道歉， 萨姆·博耶和不便之处，以飨读者。 ？

—

-

Previously, I posted an article about dependency management in Go using Glide. I got a feedback that Glide will become obsolete. The Glide team is suggesting users move to another dependency management tool called dep written by the Golang team.

之前，我发表了一篇有关使用Glide在Go中进行依赖管理的文章 。 我收到了Glide将会过时的反馈。 Glide团队建议用户转到由Golang团队编写的另一种依赖管理工具dep 。

The Go community now has the dep project to manage dependencies. Please consider trying to migrate from Glide to dep. Glide will continue to be supported for some time but is considered to be in a state of support rather than active feature development.

Go社区现在有了dep项目来管理依赖项。 请考虑尝试从Glide迁移到dep。 Glide将继续获得支持一段时间，但被认为处于支持状态，而不是主动功能开发。

There is a plan about integrating dep into the toolchain in Go 1.10 release, but seems it still has a way to go.

在Go 1.10版本中有一个计划将dep集成到工具链中，但是似乎还有一段路要走 。

Update @ 2018–02–03:

@ 2018-02-02更新：

• dep is officially released.

  dep 正式发布。

• dep is not moving into the toolchain with 1.10. please refer to the roadmap for the latest information.

  dep 不会从1.10版本进入工具链。 请参阅路线图以获取最新信息。

在$ GOPATH内创建项目 (Create the project inside $GOPATH)

The project folder has to be inside $GOPATH in order to resolve the Gopackage paths. Let’s create a new project at $GOPATH/src/gitlab.com/ykyuen/dep-example and add the following file.

项目文件夹必须位于$ GOPATH内才能解析Go软件包路径。 让我们在$ GOPATH / src / gitlab.com / ykyuen / dep-example中创建一个新项目，然后添加以下文件。

main.go

main.go

深度方式 (The dep way)

Gopkg.toml和Gopkg.lock (Gopkg.toml and Gopkg.lock)

dep reads two files called Gopkg.toml and the Gopkg.lock. Let’s initialize these 2 files using the dep init command.

dep读取两个名为Gopkg.toml和Gopkg.lock的文件。 让我们使用dep init命令初始化这两个文件。

[ykyuen@camus dep-example]$ dep init  Using master as constraint for direct dep github.com/dustin/go-humanize  Locking in master (bb3d318) for direct dep github.com/dustin/go-humanize

As you can see, the dep init command scans the source codes and downloads all the packages needed for the project into the vendor folder.

如您所见， dep init命令扫描源代码并将项目所需的所有软件包下载到供应商文件夹中。

The Gopkg.lock serves exactly the same function as the glide.lock file. It locks the version of the packages EXCEPT the version should be maintained in the Gopkg.toml. In short, the Gopkg.lock file is auto-generated and it depends on the import statements in the source version controlled by Gopkg.toml.

Gopkg.lock的功能与glide.lock文件完全相同。 它锁定的软件包除了版本的版本应该在Gopkg.toml进行维护。 简而言之， Gopkg.lock文件是自动生成的，并且取决于Gopkg.toml控制的源版本中的import语句。

更新依赖项的版本 (Update dependency’s version)

Let’s edit the Gopkg.toml and use a slightly older version of the go-humanize package instead of the latest master branch.

让我们编辑Gopkg.toml并使用稍旧版本的go- humanize软件包，而不是最新的master分支。

Then run dep ensure to update the package to the desired version. The following is the diff of the updated Gopkg.lock.

然后运行dep确保将软件包更新为所需版本。 以下是更新的Gopkg.lock的差异。

添加一个新的依赖 (Add a new dependency)

New package could be added using the dep ensure -add command.

可以使用dep sure -add命令添加新软件包。

[ykyuen@camus dep-example]$ dep ensure -add github.com/leekchan/accountingFetching sources...

"github.com/leekchan/accounting" is not imported by your project, and has been temporarily added to Gopkg.lock and vendor/.If you run "dep ensure" again before actually importing it, it will disappear from Gopkg.lock and vendor/.

Now we have the new accounting package ready in the vendor folder with new constraints written to Gopkg.toml and locked in Gopkg.lock. Let’s update the main.go as follow.

现在，我们已经在供应商文件夹中准备好了新的计费程序包，并将新的约束条件写入Gopkg.toml并锁定在Gopkg.lock中 。 让我们如下更新main.go。

main.go

main.go

And run it.

并运行它。

[ykyuen@camus dep-example]$ go run main.gohello worldThat file is 83 MB.You're my 193rd best friend.You owe $6,582,491.$123,456,789.21$12,345,678.00$25,925,925.67-$25,925,925.67$123,456,789.21

git子模块的问题 (The issue with git submodule)

One major difference of dep compared to Glide is the package’s submodule is ignored. For example, after adding the go-goracle/goracle package by dep, the odpi submodule inside is empty and leads to error. The reason for dropping the submodule could be found at the following link.

与Glide相比， dep的一个主要区别是软件包的子模块被忽略了。 例如，通过dep添加go-goracle / goracle软件包后，内部的odpi子模块为空，并导致错误。 可以在以下链接中找到删除子模块的原因。

• Are there any plans to add Git submodules support?

  是否有计划添加Git子模块支持？

Update @ 2018–02–03:

@ 2018-02-02更新：

The paragraph about Git submodules is incorrect.

有关Git子模块的段落不正确。

Sam Boyer wrote:

山姆·博伊尔 写道：

dep should be perfectly fine at pulling in git submodules in the case you describe. I just replicated what you describe here locally, and the problem isn’t submodules — it’s that there’s no Go code in github.com/go-goracle/goracle/odpi, so it can’t be imported directly.

在您描述的情况下，dep应该非常适合拉入git子模块。 我只是在本地复制了您在此处描述的内容，问题不在于子模块-github.com/go-goracle/goracle/odpi中没有Go代码，因此无法直接导入。

You likely need to turn off unused-packages pruning in Gopkg.toml for that project specifically, as otherwise dep ensure will automatically remove what appears to be an unused directly (but it seems it’s actually used by cgo).

您可能需要专门在该项目的Gopkg.toml中关闭未使用的软件包修剪，否则，dep确保将自动直接删除看似未使用的内容(但cgo似乎已在使用它)。

Update @ 2018–03–04:

@ 2018–03–04更新：

It is found that the go-goracle/goracle package doesn’t work with dep. You could follow the issue below and check the latest update from the dep team.

发现go-goracle / goracle软件包不适用于dep 。 您可以按照以下问题进行操作，并查看Dep团队的最新更新。

• Fail to get git submodule of a package after the dep ensure command

  使用dep sure命令后无法获取软件包的git子模块

摘要 (Summary)

• d̶̵̶e̶̵̶p̶̵̶ ̶̵̶i̶̵̶s̶̵̶ ̶̵̶q̶̵̶u̶̵̶i̶̵̶t̶̵̶e̶̵̶ ̶̵̶l̶̵̶i̶̵̶k̶̵̶e̶̵̶l̶̵̶y̶̵̶ ̶̵̶t̶̵̶o̶̵̶ ̶̵̶b̶̵̶e̶̵̶ ̶̵̶t̶̵̶h̶̵̶e̶̵̶ ̶̵̶o̶̵̶f̶̵̶f̶̵̶i̶̵̶c̶̵̶i̶̵̶a̶̵̶l̶̵̶ ̶̵̶d̶̵̶e̶̵̶p̶̵̶e̶̵̶n̶̵̶d̶̵̶e̶̵̶n̶̵̶c̶̵̶y̶̵̶ ̶̵̶m̶̵̶a̶̵̶n̶̵̶a̶̵̶g̶̵̶e̶̵̶m̶̵̶e̶̵̶n̶̵̶t̶̵̶ ̶̵̶t̶̵̶o̶̵̶o̶̵̶l̶̵̶ ̶̵̶i̶̵̶n̶̵̶ ̶̵̶t̶̵̶h̶̵̶e̶̵̶ ̶̵̶G̶̵̶o̶̵̶l̶̵̶a̶̵̶n̶̵̶g̶̵̶ ̶̵̶c̶̵̶o̶̵̶m̶̵̶m̶̵̶u̶̵̶n̶̵̶i̶̵̶t̶̵̶y̶̵̶.̶̵̶DEP很可能是官方的依赖管理工具在̶̵̶G̶̵̶o̶̵̶l̶̵̶a̶̵̶n̶̵̶g̶̵̶̶̵̶c̶̵̶o̶̵̶m̶̵̶m̶̵̶u̶̵̶n̶̵̶i̶̵̶t̶̵̶y̶̵̶.̶̵̶
• I̶̵̶f̶̵̶ ̶̵̶y̶̵̶o̶̵̶u̶̵̶ ̶̵̶a̶̵̶r̶̵̶e̶̵̶ ̶̵̶s̶̵̶t̶̵̶a̶̵̶r̶̵̶t̶̵̶i̶̵̶n̶̵̶g̶̵̶ ̶̵̶a̶̵̶ ̶̵̶n̶̵̶e̶̵̶w̶̵̶ ̶̵̶G̶̵̶o̶̵̶l̶̵̶a̶̵̶n̶̵̶g̶̵̶ ̶̵̶p̶̵̶r̶̵̶o̶̵̶j̶̵̶e̶̵̶c̶̵̶t̶̵̶,̶̵̶ ̶̵̶d̶̵̶e̶̵̶p̶̵̶ ̶̵̶i̶̵̶s̶̵̶ ̶̵̶g̶̵̶o̶̵̶o̶̵̶d̶̵̶ ̶̵̶t̶̵̶o̶̵̶ ̶̵̶g̶̵̶o̶̵̶.̶̵̶I̶̵̶f̶̵̶̶̵̶y̶̵̶o̶̵̶u̶̵̶̶̵̶a̶̵̶r̶̵̶e̶̵̶̶̵̶s̶̵̶t̶̵̶a̶̵̶r̶̵̶t̶̵̶i̶̵̶n̶̵̶g̶̵̶̶̵̶a̶̵̶̶̵̶n̶̵̶e̶̵̶w̶̵̶̶̵̶G̶̵̶o̶̵̶l̶̵̶a̶̵̶n̶̵̶g̶̵̶̶̵̶p̶̵̶r̶̵̶o̶̵̶j̶̵̶e̶̵̶c̶̵̶t̶̵̶，̶̵̶̶̵̶d̶̵̶e̶̵̶p̶̵̶̶̵̶i̶̵̶s̶̵̶s̶̵̶t̶̵̶
• I̶f̶ ̶y̶o̶u̶ ̶a̶r̶e̶ ̶u̶s̶i̶n̶g̶ ̶G̶l̶i̶d̶e̶ ̶i̶n̶ ̶a̶ ̶l̶e̶g̶a̶c̶y̶ ̶p̶r̶o̶j̶e̶c̶t̶.̶ ̶Y̶o̶u̶ ̶c̶o̶u̶l̶d̶ ̶c̶o̶n̶s̶i̶d̶e̶r̶ ̶m̶i̶g̶r̶a̶t̶i̶n̶g̶ ̶t̶o̶ ̶d̶e̶p̶ ̶b̶u̶t̶ ̶i̶ ̶t̶h̶i̶n̶k̶ ̶t̶h̶e̶r̶e̶ ̶i̶s̶ ̶n̶o̶ ̶h̶a̶r̶m̶ ̶t̶o̶ ̶k̶e̶e̶p̶ ̶u̶s̶i̶n̶g̶ ̶G̶l̶i̶d̶e̶ ̶f̶o̶r̶ ̶a̶ ̶w̶h̶i̶l̶e̶ ̶u̶n̶t̶i̶l̶ ̶d̶e̶p̶ ̶i̶s̶ ̶o̶f̶f̶i̶c̶i̶a̶l̶l̶y̶ ̶r̶e̶l̶e̶a̶s̶e̶d̶.̶如果您使用的滑行遗留̶p̶r̶o̶j̶e̶c̶t̶.̶你可以考虑迁移到DEP，但我认为没有什么坏处继续使用滑行一段时间，直到DEP正式̶r̶e̶l̶e̶a̶s̶e̶d̶.̶
• I̶n̶ ̶a̶d̶d̶i̶t̶i̶o̶n̶,̶ ̶m̶i̶s̶s̶i̶n̶g̶ ̶p̶a̶c̶k̶a̶g̶e̶’̶s̶ ̶s̶u̶b̶m̶o̶d̶u̶l̶e̶ ̶m̶a̶y̶ ̶r̶e̶s̶u̶l̶t̶ ̶i̶n̶ ̶m̶a̶l̶f̶u̶n̶c̶t̶i̶o̶n̶ ̶o̶f̶ ̶y̶o̶u̶r̶ ̶c̶o̶d̶e̶.̶此外，缺少̶子模块̶p̶a̶c̶k̶a̶g̶e̶'̶s̶可能导致故障您̶c̶o̶d̶e̶.̶

• dep is officially released.

  dep 正式发布。

• dep works well on pulling git submodule.

  dep 在拉git子模块时效果很好。

• Use standard library wherever possible. (Suggested by philoserf)

  尽可能使用标准库。 (由philoserf建议)

• You can checkout this example on gitlab.com.

  您可以在gitlab.com上查看此示例。

— Originally posted on Boatswain Blog.

—最初发布在Boatswain博客上 。

翻译自: https://www.freecodecamp.org/news/an-intro-to-dep-how-to-manage-your-golang-project-dependencies-7b07d84e7ba5/

golang 依赖管理