Re: Go & bundling

[Alex Griffin]

I realized my previous message was probably confusing. Here are some
missing details that you may need to make sense of it.

* Go embeds its dependency information right into the source code.

* The command I gave gets its list of dependencies by parsing source
code, not that manifest file. Also, it lists packages, not repositories.
There may be several packages coming from a single repository.

* Those manifest files, then, are just lists of bundled libraries. This
might be a litte confusing coming from other languages, because it is
not directly analogous to the package manager manifests that other
languages use. They are not written manually, nor does the tooling
necessarily make it easy to keep up-to-date (it may take 2-3 separately
maintained, non-standard tools to keep a vendor/ directory in good
working order). The packages in them may not even be dependencies any
more if the maintainer has not been vigilant.

Ultimately I think a Go importer will be tricky to get right. In some
cases it may even make the most sense to just use what's bundled,
unfortunately...
-- 
Alex Griffin