[go-nuts] [ANN] GLock - Dependency management w/out vendoring

Announcing a vendor-less dependency management tool.

https://github.com/robfig/glock

## Overview

This one is very simple. It provides 2 commands and a version control hook:

    - "glock save project" writes the transitive root package[1]
    dependencies of all packages under "project/..." to a GLOCKFILE
    - "glock sync project" updates all packages listed in project/GLOCKFILE
    to the listed version.
    - "glock install project" installs a version control hook that watches
    for changes to project/GLOCKFILE and incrementally applies them.

Glock is similar to "godep -copy=false"

GLOCKFILEs are simple text files that record a root package's version, e.g.

bitbucket.org/tebeka/selenium 02df1758050f
code.google.com/p/cascadia 4f03c71bc42b
code.google.com/p/go-uuid 7dda39b2e7d5
...

## Workfow

Here's the expected flow for working with a Glock-managed repo:

    1. Clone the repo
    2. "glock sync" your GOPATH
    3. "glock install" the hook
    4. "glock save" when you add/update a dependency


## Use case

At work, we keep our Go code in one repo (rather than many small ones) and
use a single GOPATH. This tool allows us to gain reproducible builds, with
version updates automatically propagated to the team via the hook, with the
following advantages:

    - We still use the normal Go toolchain / dev process (e.g. not having to
    run everything in a godep sandbox). We can more easily contribute to 3rd
    party libraries, since they are not in a vendor sandbox or have rewritten
    import paths.
    - We avoid the repo bloat of checking in our dependencies (> 100 MB), in
    addition to the extra churn. Updating a dependency involves a change to
    one line of a text file instead of thousand-line diffs.
    - Much easier and less error-prone than manually checking in
    dependencies. Developers don't have to fight git because git wants to make
    the project a submodule instead of just checking in the files. Running
    glock on your CI server or as a pre-commit hook can ensure that any new
    dependencies have been recorded.

Hope it's useful for others as well. There is some more information in the
README <https://github.com/robfig/glock>

Questions / comments?

-Rob

[1] "root package" refers to the base package in a repository. For
example, although *code.google.com/p/go.net/websocket* is a Go package,
*code.google.com/p/go.net* is the "root package", and any dependencies on
non-root packages roll up to the root.