Re:Vulnerability Management for Go
by preseinger on Tuesday September 06, 2022 @07:16PM
(#32744395)
Prior to 1.17, go.mod was not a complete representation of the dep graph. More broadly, the problem is that programmers expect dependency management tooling to have a lock file, see go.sum, and assume it's a lock file. This isn't a problem with those programmers, it's a problem with Go modules.
[ Parent
| on HN ]
> This isn't a problem with those programmers, it's a problem with Go modules.
That seems like a bit of a jump! Maybe there's a better way of building dependency management tooling that doesn't use lock files, it seems strange to tie yourself to this approach just because it's how other tools work.
go.mod is the lock file.
Re:Vulnerability Management for Go
by preseinger on Thursday September 08, 2022 @03:43PM
(#32770997)
It isn't in the traditional sense. There isn't anything in its specification that guarantees the things that most people expect lock files to guarantee.