Need to version dependencies

[aaslamin]

Problem

Presently, this library cannot deal with any breaking changes that may be introduced by dependencies (e.g. most notably opentracing & opencensus). If you were to clone the project and fetch the latest deps go get -u ./..., you will not be able to build:

opencensus/opencensus.go:38:30: s.parent.StartSpan undefined (type *trace.Span has no field or method StartSpan)
opencensus/opencensus.go:42:10: s.parent.SetAttributes undefined (type *trace.Span has no field or method SetAttributes)
opencensus/opencensus.go:42:46: trace.StringAttribute is not a type
opencensus/opencensus.go:50:10: s.parent.SetAttributes undefined (type *trace.Span has no field or method SetAttributes)
opencensus/opencensus.go:50:46: trace.StringAttribute is not a type

The above output indicates a breaking change to the opencensus library was made at some point. Ths is one of them - census-instrumentation/opencensus-go#595 - another exists as StartSpan(name string) is no longer a valid method.

This is problematic for contributors and those using the library with a newer/older version of a dependency. How are they supposed to know which one to use?

Proposal

• Start versioning dependencies using a dep manager like dep or go modules.
• Fix existing breakages
• Breaking changes introduced by dependencies may impact interfaces defined by this library (as shown above), therefore we must also start tagging releases as per discussed in #6 (comment)

Easiest solution will be add a dep manager, start using the latest & greatest versions of the dependencies, and moving forward follow proper practices by tagging releases. I can help with this.

Cc: @luna-duclos

[luna-duclos]

Fully agreed on starting to use dep, indeed. Ideally, we also want to fix our code to work with the latest version, too.

[luna-duclos]

Compile issues fixed by #12 , though we should still add a Gopkg.lock most likely, so leaving this open.

[dolmen]

So what about doing that now?

I can of course do "go mod init" myself and submit that as a PR, but that will mark the latest tagged version of each package as required and that may not be what is wanted. And #12 doesn't even mention what was the opencensus version at the time. This seems to be a task that only the maintainer of the project can do properly.

[luna-duclos]

go.mod and go.sum files have been added and the latest master has been tagged v1. Let me know if this causes any issues! My knowledge of go modules isn't quite there yet.