Errors when a dependency tries to override a stdlib path

[krish7919]

Workflow:

• Ran this from a location where main.go is present: dep init

• Committed the Gopkg.toml and Gopkg.lock (not the vendor directory to version control)

• In another directory, updated the project and ran dep ensure to make sure that the dependencies are maintained/updated.

• Maybe I am missing something basic here, any help will be appreciated. EDIT: This is what will be the perfect way to get up and running immediately with dep.

What happens:

• Cannot run go build or go install. Error message:

go build main.go 
# vendor/github.com/cloudflare/cfssl/scan
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:53:71: undefined: "crypto/tls".CipherSuites
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:64:74: undefined: "crypto/tls".Curves
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:68:101: undefined: "crypto/tls".SignatureAndHash
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:87:13: undefined: "crypto/tls".AllSignatureAndHashAlgorithms
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:91:86: conn.SayHello undefined (type *"crypto/tls".Conn has no field or method SayHello)
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:100:77: undefined: "crypto/tls".Versions
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:106:5: undefined: "crypto/tls".CipherSuites
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:121:35: undefined: "crypto/tls".CipherSuites
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:122:24: undefined: "crypto/tls".CipherSuites
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:129:32: undefined: "crypto/tls".CipherSuite
vendor/github.com/cloudflare/cfssl/scan/tls_handshake.go:129:32: too many errors

Expectation:

• That all the dependency management will happen in the background once I ran dep ensure.
• Teams just need a dep ensure to update their state locally and can then issue a build, run, install command.

What version of dep are you using (dep version)?

 dep-linux-amd64  version
dep:
 version     : v0.3.2
 build date  : 2017-10-19
 git hash    : 8ddfc8a
 go version  : go1.9
 go compiler : gc
 platform    : linux/amd64

[darkowlzz]

@krish7919 hi, thanks for opening an issue.

I think the issue is because of difference in the way dependencies are vendored in github.com/cloudflare/cfssl. I see that they have a vendor/ directory at the root of the project, but then there's another vendor directory inside package scan, which is unusual. dep performs static analysis of projects and downloads all the dependencies if the import paths are correct. But in this case, I see "crypto/tls" package, which has the import path format of a standard library package, but the vendored package is different from what's there in the standard library.

Since dep removes any existing vendor directories and tries to download the dependencies itself, "crypto/tls" in scan package's vendor would have been removed by dep and while compiling it fails because the standard library "crypto/tls" has no methods that are used in tls_handshake.go.

I've never seen such setups. Not sure how to fix it. Vendoring in github.com/cloudflare/cfssl should be fixed/improved to fix this issue.

• That all the dependency management will happen in the background once I ran dep ensure.
• Teams just need a dep ensure to update their state locally and can then issue a build, run, install command.

Your expectations are right, just dep ensure is all that's required.

[darkowlzz]

Just a thought, maybe if you ignore github.com/cloudflare/cfssl/scan, you could make it work. Because I see the code in scan package don't have any other external dependencies, other than the custom vendored dependencies.

Here is a document about how to use ignored in Gopkg.toml https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md#ignored. Give it a try?