{"id":22912029,"url":"https://github.com/opencoff/dep.sh","last_synced_at":"2026-04-11T08:06:40.869Z","repository":{"id":75756900,"uuid":"80061330","full_name":"opencoff/dep.sh","owner":"opencoff","description":"Simple Golang dependency manager","archived":false,"fork":false,"pushed_at":"2018-05-04T00:42:15.000Z","size":27,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-01T11:08:59.974Z","etag":null,"topics":["golang","vendoring"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/opencoff.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-01-25T21:49:20.000Z","updated_at":"2020-09-24T23:44:49.000Z","dependencies_parsed_at":"2023-05-21T11:15:07.519Z","dependency_job_id":null,"html_url":"https://github.com/opencoff/dep.sh","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/opencoff/dep.sh","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/opencoff%2Fdep.sh","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/opencoff%2Fdep.sh/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/opencoff%2Fdep.sh/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/opencoff%2Fdep.sh/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/opencoff","download_url":"https://codeload.github.com/opencoff/dep.sh/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/opencoff%2Fdep.sh/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31673083,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-10T17:19:37.612Z","status":"online","status_checked_at":"2026-04-11T02:00:05.776Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","vendoring"],"created_at":"2024-12-14T04:19:36.498Z","updated_at":"2026-04-11T08:06:40.852Z","avatar_url":"https://github.com/opencoff.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"=================\nREADME for dep.sh\n=================\n\n:Date: Nov 07, 2016\n\nWhat is ``dep.sh``\n==================\n``dep.sh`` is a simple vendor management tool for go. It does **NOT** checkin\nthe vendor code into your repository. This keeps your repository small \u0026 clean.\n\nWhen run from a top project directory, it implicitly sets ``GOPATH``\nto the project directory and its vendor path.\n\n``dep.sh`` uses the following code organization pattern:\n\n- All vendored code goes in ``./vendor/src``\n- All local code goes in sub directories of ``./src``\n\n\nInstallation \u0026 Usage\n--------------------\n``dep.sh`` is a simple bash shell script. It needs a modern (4.x) bash\nand ``git``.\n\nYou can install it in one of two places (or both):\n\n#. Your personal bin or scripts directory (usually ``$HOME/bin``)\n\n#. Top level directory of your golang project.\n\nGeneral usage help::\n\n    dep.sh --help\n\n\n``dep.sh`` adds the following commands to the tool-chain vocabulary:\n\n* ``init`` -- initialize the current directory for vendor dependency\n  management. It does NOT commit anything to git.\n\n* ``fetch``, ``get`` -- fetch and record a new vendor dependency.\n\n* ``update`` -- update one repository (optionally to a specific version or\n  commit-hash) from upstream or *all* repositories from\n  upstream and update the manifest.\n\n* ``ensure`` -- prepare the local directory with the correct checked out version of\n  the vendor dependency. This must be run _once_ when a new directory is setup for\n  building the entire daemon.\n\n* ``rebuild`` -- Forcibly rebuild the manifest from the contents in\n  the ``vendor/src`` directory. This is useful when you have\n  carefully pinned the vendor repo versions after diligent\n  test/debugging.\n\n* ``status`` -- Show a list of vendored and pinned repositories.\n\nRecipe for a New Project\n------------------------\nIf you are a new project and want to use ``dep.sh`` for your vendor\nmanagement, the steps are:\n\nMake sure ``dep.sh`` is accessible either in the current directory or\nfrom ``$PATH``. For this example, we will assume that ``dep.sh`` is\ninstalled in the top level directory of your project. Furthermore,\nlet us call the new project ``projX``.\n\nThen,::\n\n    mkdir -p projx\n    cd projx\n    git init\n\nNow, copy ``dep.sh`` to the top level of ``projx`` directory. The\nfollowing commands assume you have already done that.\n\nNow, we initialize the directory::\n\n    dep.sh init\n    git commit -m \"Initial commit\"\n\n\nLet's now add a new vendor repo to your project. Usually, one does\nthat by invoking ``go get /path/to/module``. In our case, we do\nsomething similar. e.g., lets add ``go-lib/logger`` as a vendor\ndependency::\n\n    # Run dep.sh in verbose mode\n    dep.sh -v get github.com/opencoff/go-lib/lodep.sher\n\n    # Lets see what's in the manifest\n    cat vendor/manifest.txt\n\n    # Alright. lets commit this into git\n    git commit -m \"Added new vendor code: opencoff/go-lib\"\n\nThe \"-v\" flag to ``dep.sh`` tells it to run in verbose mode.\n\nUpdating vendor modules\n-----------------------\nAfter working on your tool ``projx`` for a while, you decide that\nyou need newer versions of all your vendored modules. To get that::\n\n    dep.sh update --all\n\nNote that in practice, this is **NOT** a good idea at all. You should always\ntry each dependency carefully and then commit.\n\nIf you only wanted to update *one* vendor repository to its latest\nversion, then::\n\n    dep.sh update REPO\n\nWhere ``REPO`` is the name you would use in your golang program.\ne.g.,::\n\n    dep.sh update github.com/opencoff/go-lib\n\nIf your project needs to update *and* pin one specific vendor lib to a\nspecific version or tag, do::\n\n    dep.sh update REPO TAG\n\nWhere ``TAG``  is the git version number (short or long) or a git\ntag. e.g.,::\n\n    dep.sh update github.com/opencoff/go-lib a645eefad878dfce2638e110d2f6e08f61b9faa6\n\n\nWorking on a project as a new contributor\n-----------------------------------------\nLet's say that you are joining an existing project as a new\ncontributor. In this case, the repository you are working on\nlikely has vendor code pinned by other developers. But, you need to\nget your workspace ready for building your golang program; i.e.,\ncheckout the vendor repositories so ``go build`` can find it::\n\n    git clone /path/to/your/repo/projx\n    cd projx\n    dep.sh ensure\n\n\nThis command clones the remote (3rd party) repositories in the\n``vendor/src`` directory and pins them to the version in the manifest.\nOnce complete, you build your golang program.\n\n\nVendor Management Internals\n===========================\nVendor dependencies are recorded in the file ``vendor/manifest.txt``. Each line is\neither a comment (starts with '#') or is a dependency record. Each record is a\n3-tuple of import-path, pinned-version, upstream-URL.\n\n* ``dep.sh get`` and ``dep.sh update`` update the manifest.\n\n* ``dep.sh ensure`` consults the manifest to checkout the correct version.\n\nThe checked out vendor code follows the Golang vendor conventions: the code is put\nin ``vendor/src``.\n\nExtras\n======\nThe *extras* folder has a small shell script called ``build``. I use this\nscript for building my go programs. This tool does a few important\nthings for me:\n\n    * it can build one or more binaries and sets some variables from the\n      environment:\n\n        - main.RepoVersion is set to git repository hash\n        - main.ProductVersion is set from build command line option (``--version=``)\n        - main.Buildtime is set to UTC build timestamp\n    * it can cross-compile one or more binaries\n    * it can statically link binaries - as long as CGO is not needed for that\n      HOST/OS combination.\n    * it can invoke protobuf compiler for generating go source before building\n      the programs [only invokes if .proto file is newer than the generated\n      file]\n\nThe script is written to build multiple artifacts in the *src/* directory.\nThe artifacts are set in the ``progs`` variable at the top of the script. You\ngenerally do not have to modify anything else after that line.\n\n.. vim: ft=rst:sw=4:ts=4:expandtab:tw=78:\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopencoff%2Fdep.sh","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopencoff%2Fdep.sh","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopencoff%2Fdep.sh/lists"}