Possible dep issue: package revision in Gopkg.lock doesn't match constraint in Gopkg.toml

[Justin Lovero]

Hi everyone,

I'm migrating a project from glide to dep and I'm running into an issue with dep pulling down the wrong revision of a dependency.

I've got the following constraint set in my Gopkg.lock file:

[[constraint]]
  name = "github.com/ugorji/go"
  revision = "ded73eae5db7e7a0ef6f55aace87a2873c5d2b74"

But my Gopkg.lock file specifies a completely different revision:

[[projects]]
  branch = "master"
  name = "github.com/ugorji/go"
  packages = ["codec"]
  revision = "50189f05eaf5a0c17e5084eb8f7fb91e23699840"

dep status confirms that there is a constraint, yet it is not being followed:

PROJECT                     CONSTRAINT  VERSION         REVISION  LATEST   PKGS USED

github.com/ugorji/go        ded73ea     branch master   50189f0            1

I have confirmed that the revision hash I've specified is valid by checking it out in the repo. Why might this be happening?

I should note that I only had to add the constraint because dep does not get transitive dependencies specified by the Godeps.json files in my dependencies.  I am using the k8s/client-go package which relies on specific revisions of k8s.io/apimachinery and github.com/ugorji/go to be able to build.  I set both of those revisions as constraints in my Gopkg.toml file, and k8s.io/apimachinery has the correct revision, but github.com/ugorji/go does not.

Any ideas?

[David Anderson]

You could file a bug against dep, that's probably the quickest way to get your issue looked at.

With that said, dep is not expected to work with the Kubernetes client library right now. I filed https://github.com/kubernetes/client-go/issues/318 a couple days ago, and the install instructions just got updated strongly recommending the use of glide until various issues with dep are addressed. So, assuming you're trying to get stuff done with client-go, you probably should stick to glide for now.

(What are you making with Kubernetes? I'm curious)

- Dave

--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Dave Cheney]

I hit the same bug

https://github.com/golang/dep/issues/1231

TLDR, you have to use [[override]] when the package is not directly imported by code in your project.

Protist: github.com/heptio/contour has a working Gopkg.toml, I suggest copying that into your project and running dep ensure

[Justin Lovero]

Thanks, Dave! Using [[override]] fixed the problem

[[override]]

  name = "github.com/ugorji/go"

  revision = "ded73eae5db7e7a0ef6f55aace87a2873c5d2b74"

That's all I needed.

dep seems to have problems resolving the correct transitive dependency versions at the moment. Hope they get that fixed soon.