How I cut reproducible builds in Go projects. The nice part about this method is that it allows devs to work on a project in a standard Go development environment while also allowing someone who ONLY HAS GO INSTALLED to clone an application anywhere they want and compile it from source. No deps need to be committed to the project repo and no rel…

Makefile

# A Makefile for Go projects
# This "makes" it easy to cut reproducible builds using an ignored _vendor
# directory and built in Go tooling. When this runs, it first executes the 
# vendor.sh shell script. It then temporarily "blesses" your GOPATH with
# the _vendor directory. This ensures all modules will first be looked for 
# in _vendor and anything else will get picked up from your standard Go workspace.

GO_CMD=$(shell which go 2>/dev/null)
GO_TEST=$(GO_CMD) test
GO_BUILD=$(GO_CMD) build
GOPATH := $(CURDIR)/_vendor:$(GOPATH)

default: prereq build

prereq:
ifeq ($(GO_CMD),)
	$(error "ERROR: Go is not installed, check out the Golang site: https://golang.org/doc/install or your OS's package manager for information on how to install it.")
endif

build:
	./vendor.sh
	cd $(CURDIR) && $(GO_TEST) ./... && $(GO_BUILD)

vendor.sh

#!/usr/bin/env bash
# A vendoring script for Go projects which puts deps into a _vendor directory
# This is shell script is meant to be added to your project, but the _vendor 
# directory should be ignored by your version control system. The optional last 
# param is for supporting packages that have a vanity import path.

set -e

# Downloads dependencies into the _vendor/ directory
mkdir -p _vendor
cd _vendor

clone() {
	vcs=$1
	pkg=$2
	rev=$3
	dest=$4

	pkg_url=https://$pkg
	target_dir=src/$pkg

	if [ -n "$dest" ]; then
	    echo "EMPTY"
		target_dir=src/$dest
	fi

	echo -n "Getting dependency -> $pkg @ $rev: "

	if [ -d $target_dir ]; then
		echo -n 'removing old version, '
		rm -fr $target_dir
	fi

	echo -n 'cloning, '
	case $vcs in
		git)
			git clone --quiet --no-checkout $pkg_url $target_dir
			( cd $target_dir && git reset --quiet --hard $rev )
			;;
		hg)
			hg clone --quiet --updaterev $rev $pkg_url $target_dir
			;;
	esac

	echo -n 'removing VCS hidden files, '
	( cd $target_dir && rm -rf .{git} )

	echo done
}

# List Project Dependencies

clone git some.vcs.path/module 12345678901234567890 some.vanity.import/path
clone git some.import.path/module 12345678901234567890

clone hg some.other.path/module 12345678901234567890