git history rewritten in github.com/minio/go-homedir

[jessesuen]

We use the minio-go library and vendor lock our dependencies dependencies using dep. dep had locked in a revision of github.com/minio/go-homedir at 21304a94172ae3a09dee2cd86a12fb6f842138c7. Today, our builds suddenly started breaking because this revision no longer exists in the git tree. The issue manifests itself in the following way:

root@395ba1642a61: # dep ensure -vendor-only -v
(1/55) Wrote github.com/hashicorp/go-version@master
...
(14/55) Failed to write github.com/minio/go-homedir@master
...
grouped write of manifest, lock and vendor: error while writing out vendor tree: failed to write dep tree: failed to export github.com/minio/go-homedir: : exit status 128

Github still remembers the commit and can be seen here:
https://github.com/minio/go-homedir/commit/21304a94172ae3a09dee2cd86a12fb6f842138c7

Instead, we now have a very similar commit (from today) at:
https://github.com/minio/go-homedir/commit/4d76aabb80b22bad8695d3904e943f1fb5e6199f

We are able to resolve the issue by rewrite our lockfile to use the 4d76aab changeset, but please refrain from rewriting the git history since this will break anyone using tools like glide or dep to manage their dependencies.

[harshavardhana]

You should vendorize it locally @jessesuen we don't know why they would reach out to upstream again once you have it locally. Rewriting history is some times necessary since we are trying to get the changes merged upstream and we will be removing the dependency as well.

[harshavardhana]

So we are expecting a breaking change. Even we have minio-go vendorized. I guess the problem is that dep or glide always reaching out to upstream though.

[jessesuen]

@harshavardhana one of the primary purposes of tools like dep and glide is that it enables projects to not have to vendor other projects and and add bloat to their own project repo. I strongly disagree that rewriting git history is a necessity to get changes merged upstream since is typically handled by branching and keeping the master branch of the fork, pristine with the upstream.

Additionally, the current behavior of dep according to their docs is: "dep ensure unconditionally regenerates all of vendor/ to be safe". So anyone who has vendored github.com/minio/minio-go using dep, and needs to recreate or update their dependencies via dep ensure will experience this issue.

[harshavardhana]

@harshavardhana one of the primary purposes of tools like dep and glide is that it enables projects to not have to vendor other projects and and add bloat to their own project repo. I strongly disagree that rewriting git history is a necessity to get changes merged upstream since is typically handled by branching and keeping the master branch of the fork, pristine with the upstream.

Well the problem is dep is making it a quite odd solution - node, python and all have solved this problem properly. Reaching out to internet always is bad idea to build your sources.

FWIW better option is we remove the dependency from minio/go-homedir and directly point to mitchellh/go-homedir - there is nothing that minio-go needs for now from minio/go-homedir.