go-getter: Alternative to "go get" that fixes packages to a version for consistent and repeatable builds.

go-getter

#!/bin/bash

# Alternative to "go get" that grabs Go packages based on a fixed version.
# Use this to ensure consistent and repeatable builds.
#
# While there are other tools out there that do this, this is really just
# a very small shell script so painless to work into your existing workflow.
#
# Usage:
#
# 1. Create a file (e.g. go-deps) that contains space delimited package and hash.
#    The file may contain whitespace and # comments that are ignored.
# e.g.
#   github.com/lib/pq                                8910d1c3a4bda5c97c50bc38543953f1f1e1f8bb
#   github.com/julienschmidt/httprouter              b59a38004596b696aca7aa2adccfa68760864d86
#   github.com/hashicorp/golang-lru                  d85392d6bc30546d352f52f2632814cde4201d44
#
# 2. Run: ./go-getter go-deps
#    This will ensure your GOPATH contains the correct version of these deps.
#
# By https://github.com/joewalnes

set -e
: ${GOPATH?"GOPATH not set"}
: ${1?"Usage: $0 [path-to-go-deps]"}
sed -e 's/#.*//' $1 | grep -v -e '^[[:space:]]*$' | while read PKG HASH; do
  echo "--- Updating package $PKG ---"
  DEST=$GOPATH/src/$PKG
  echo "* Local path: $DEST"
  mkdir -p $DEST
  if [ -d $DEST/.git ]; then
    echo "* git pull..."
    (cd $DEST && git pull -q origin master)
  else
    echo "* git clone..."
    git clone -q https://$PKG.git $DEST
  fi
  echo "* updating to $HASH..."
  (cd $DEST && git checkout -q $HASH)
done