modules: Using vendored transitive dependencies of primary dependency

[Justin Israel]

I've been having some great results converting some of my internal projects from glide to go modules, but I am looking at a specific workflow right now that is confusing me. Hoping to get some clarification...

Project 'foo' has its dependencies vendored via "go mod vendor". This works great when building that project internally since a non-go developer can clone the project and build it, with no external proxy access needed to download dependencies. 

Now I am trying to allow project 'bar' to build a tool provided by 'foo'. The go.mod file only contains:

    module internal.com/project/bar

    require internal.com/project/foo v0.0.0-...

What I am seeing is that foo and all of its dependencies will be clones from their origins, and my go.sum file is updated with all of the transient dependencies. But what I really want is to only fetch 'foo' from my internal network and to have it use the vendored dependencies. 

Is this even possible? The "-mod=vendor" flag was very useful when building project "foo" directly. But it doesn't seem to apply here because project "bar" doesn't want to vendor. It wants to get the one primary dependency and that is it.

Justin

[Justin Israel]

I tried to solve this temporarily with a combination of using glide to pull just the primary dependency, and then to use "go build -mod=vendor" to pick up the vendored dependencies. But glide won't flatten the vendor directory properly, to bring the nested vendor to the top level. So I have had to resort to a hack where I manually clone the primary dependency, move its nested vendor to the root, and the move that primary dependency into vendor/ as well. 

Would love to cleanly solve this through the module system.

[Justin Israel]

Since I never found an answer to this, and I am still stumped, I have cross-posted here.

Justin