{"action":"created","issue":{"url":"https://api.github.com/repos/constabulary/gb/issues/29","labels_url":"https://api.github.com/repos/constabulary/gb/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/constabulary/gb/issues/29/comments","events_url":"https://api.github.com/repos/constabulary/gb/issues/29/events","html_url":"https://github.com/constabulary/gb/issues/29","id":72709120,"number":29,"title":"gb vendor updating dependencies","user":{"login":"Supermighty","id":183077,"avatar_url":"https://avatars.githubusercontent.com/u/183077?v=3","gravatar_id":"","url":"https://api.github.com/users/Supermighty","html_url":"https://github.com/Supermighty","followers_url":"https://api.github.com/users/Supermighty/followers","following_url":"https://api.github.com/users/Supermighty/following{/other_user}","gists_url":"https://api.github.com/users/Supermighty/gists{/gist_id}","starred_url":"https://api.github.com/users/Supermighty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Supermighty/subscriptions","organizations_url":"https://api.github.com/users/Supermighty/orgs","repos_url":"https://api.github.com/users/Supermighty/repos","events_url":"https://api.github.com/users/Supermighty/events{/privacy}","received_events_url":"https://api.github.com/users/Supermighty/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/constabulary/gb/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":14,"created_at":"2015-05-02T22:30:44Z","updated_at":"2015-05-05T17:10:43Z","closed_at":null,"body":"Do you see `gb vendor` as a one time operation to grab dependencies; then use that libs DVCS native update function for the infrequent times when the library needs changes from upstream?\r\n\r\nCould `gb vendor` receive add functionality similar to what `go get` has? Does it need them?"},"comment":{"url":"https://api.github.com/repos/constabulary/gb/issues/comments/99143840","html_url":"https://github.com/constabulary/gb/issues/29#issuecomment-99143840","issue_url":"https://api.github.com/repos/constabulary/gb/issues/29","id":99143840,"user":{"login":"ngrilly","id":594688,"avatar_url":"https://avatars.githubusercontent.com/u/594688?v=3","gravatar_id":"","url":"https://api.github.com/users/ngrilly","html_url":"https://github.com/ngrilly","followers_url":"https://api.github.com/users/ngrilly/followers","following_url":"https://api.github.com/users/ngrilly/following{/other_user}","gists_url":"https://api.github.com/users/ngrilly/gists{/gist_id}","starred_url":"https://api.github.com/users/ngrilly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ngrilly/subscriptions","organizations_url":"https://api.github.com/users/ngrilly/orgs","repos_url":"https://api.github.com/users/ngrilly/repos","events_url":"https://api.github.com/users/ngrilly/events{/privacy}","received_events_url":"https://api.github.com/users/ngrilly/received_events","type":"User","site_admin":false},"created_at":"2015-05-05T17:10:43Z","updated_at":"2015-05-05T17:10:43Z","body":"@jbuberel I haven't found any tool that really solves the issue either. This is why I was intrigued ;-)\r\n\r\nThat said, I use the same structure as `gb` for my internal projects (a src directory for the app and a src directory for the dependencies, both committed at the root of our project source code) and it happens `go get` is quite good at doing the initial fetching of dependencies. The issue I had with `go get` is manually getting rid of the DVCS directories (`.git`, `.hg`, etc.) before committing the vendor directory, which can be an error prone process. [1] This is a place where godep (for example) shines. The good way to solve this to invoke `go get` in a temporary GOPATH and then copy the relevant stuff to `vendor/src`, without the DVCS dirs.\r\n\r\nBut I agree with Dave that there is the issue of where to draw the line. For example, should the vendoring plugin be able to report the status of each dependency compared to the last available version? Should it be able to upgrade dependencies? Should it be able to pin versions?…\r\n\r\n[1] https://www.digitalocean.com/company/blog/taming-your-go-dependencies/"}}