Flatten vendored transitive dependencies of primary dependency

Question

I have been converting existing projects from using vendored dependencies via Glide, to using the Go 1.11.x module support. But I am hitting a particular case in one project using modules that I cannot solve.

Internal project 'foo' has its dependencies vendored via "go mod vendor":

projects/src/foo/
    main.go
    vendor/
        ...

This works great when building that project internally since a non-go developer can clone the project to any location and build it, with no external proxy access needed to download dependencies.

Now I am trying to allow project 'bar' to build a tool using library 'foo'.

package bar

import "internal.com/project/foo"

The "go.mod" file only contains:

module internal.com/project/bar

require internal.com/project/foo v0.0.0-...

I would vendor via:

go module vendor

And I build via:

go build -mod=vendor

What I am seeing is that 'foo' will be cloned from the internal git repo, and all of its dependencies will be downloaded from their remote git origins, and my 'go.sum' file is updated with all of the transient dependencies. But what I really want is to only fetch 'foo' from my internal network and to have it flatten the vendored dependencies. Ideally, there should be no external http requests.

Is this even possible? The "-mod=vendor" flag was very useful when building project "foo" directly. But it doesn't seem to apply here because project "bar" doesn't want to vendor. It wants to get the one primary dependency and that is it. It would seem that Go module support doesn't care about flattening vendored transient dependencies.

Previous when using glide as the package manager, it would fetch 'foo' from the internal git repo and then flatten all of its dependencies into my vendor directory.

Originally posted as a question to golang-nuts, without reply.

Answer 1

It just currently doesn't work that way, only the top level vendor directory is used. From the modules help:

To build using the main module's top-level vendor directory to satisfy dependencies (disabling use of the usual network sources and local caches), use 'go build -mod=vendor'. Note that only the main module's top-level vendor directory is used; vendor directories in other locations are still ignored.

For this specific use case I would recommend waiting until go modules matures.