"Getting started" guide leads people to check in vendor/src directory

[ymattw]

In the FAQ (content/faq/externals.md) you clearly mentioned you disagree managing a copy of dependencies in project code base.

The Go authors agree that vendoring, taking a copy of your dependencies, is the path to repeatable builds – we just disagree on the method.

The Go authors are recommending vendoring by copying the source of your dependencies into a folder inside your package, then rewriting the source of those vendored depdendencies to accomodate.

Then please do NOT lead people to do that in the "getting started" guide (content/examples/getting-started.md) (the "Wrapping up" section):

you should check your $PROJECT directory into a source control repository. This includes any source you have copied from other projects into your $PROJECT/vendor/src/ directory.

I just started learning golang and got here when trying to pick the best dependency management tool out of the ~20 tools (!). Turns out a lot of tools recommend to copy dependencies and check into project source tree. I personally strongly disagree with that, I'd rather manage links to dependencies in project source tree, either using git submodule/subtree or tools like gom. If your opinions remain the same as mentioned in the FAQ, giving some more detailed examples would be very helpful.

Thanks for the great tool!

[davecheney]

Thank you for raising this issue. I believe the problem is I have not made it clear the difference between vendoring inside a package

$GOPATH/src/github/com/someuser/someproject/vendor

And vendoring inside a project

$PROJECT/vendor

The key difference is the source inside a gb project is all transitive dependencies controlled by the project, not individual libraries, so you should check it in, if you want reproducible builds.

You can use submodules if you like, it is the responsibility of the project owner to manage the contents of their entire gb project. gb doesn't care how you do it, all you as the owner have to do is make sure the project contains the full source code, including dependencies, when you want to build or test.

[ymattw]

Thanks for the swift reply. Yes making the statement clear would be better.