-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Drop vendoring #4903
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Drop vendoring #4903
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We plan to drop vendoring, but we still want to allow people to vendor data if they'd like to allow them to build offline. Let's ignore the vendor directory so that this doesn't make the working tree dirty.
We currently vendor all dependencies in the repository. This causes a bunch of problems, notably that sometimes these dependencies are out of date, we get security reports about them, and they needlessly bloat the repository. There are some legitimate reasons to vendor dependencies, but none of them really apply to this project. Since there are few benefits here and several downsides, let's remove the vendor directory altogether. It has already been ignored, so if users would like to use our `make vendor` target, which remains, they can do so without problems.
We're no longer including the `vendor` directory in our tarballs, so delete the entries in the `debian/copyright` file.
0eaeefe to
4505c62
Compare
chrisd8088
approved these changes
Sep 8, 2022
Member
chrisd8088
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Lovely, thank you! This will save some headaches dealing with security reports that don't actually affect Git LFS, for sure.
QuLogic
added a commit
to QuLogic/git-lfs
that referenced
this pull request
Jul 31, 2023
The `vendor` directory is `.gitignore`d, and vendoring as a process was fully removed in git-lfs#4903.
QuLogic
added a commit
to QuLogic/git-lfs
that referenced
this pull request
Aug 2, 2023
The `vendor` directory is `.gitignore`d, and vendoring as a process was fully removed in git-lfs#4903.
chrisd8088
added a commit
to chrisd8088/git-lfs
that referenced
this pull request
Sep 8, 2023
In PR git-lfs#4903 we removed use of a "vendor" directory for Go modules, so we can now drop several references to that directory from our CI build script and Makefile, and our license documentation. Note that the "lint" Makefile target was introduced in PR git-lfs#3144 (and then modified in PR git-lfs#3208 when the project adopted Go modules), and existed to check whether all dependencies outside those from the Go standard library existed in the "vendor" directory. At present, though, the command now finds no dependencies that are neither in the standard library nor are Go modules, and so is a no-op which we can simply remove.
chrisd8088
added a commit
to chrisd8088/git-lfs
that referenced
this pull request
Nov 24, 2024
We last updated our software license in commit 4da6d5f of PR git-lfs#4513 to revise the current year in our copyright statement to 2021. As this date is now several years in the past, and because we want to avoid having to update our license each year, we simply remove the current year from our license's copyright statement now. This practice is in keeping with the format we use in the license files of all our other Git LFS projects, such as in the git-lfs/gitobj and git-lfs/pktline repositories. It also aligns with the practice of other major open-source projects, like that of the source code for the Go language and standard library. As well, we add a copyright date of 2009 to the Go project's license that we include in our main LICENSE.md, alongside the existing 2010 copyright date. When we first appended the Go project's license to our license file, in commit 74d5f2397f9abe4834bf1fe1fa02fd6c141b77cea, it was specifically due to the inclusion of some code into our "subprocess" package from the Go library's "os/exec" package. Those original source files have copyright dates of 2010, which is why we used that date in our copy of the Go project's license. For reference, see: https://github.com/golang/go/blob/b68f8ca89a2fb6b33d1e78fadc33d1c35693f6b8/src/os/exec/lp_unix.go#L1 https://github.com/golang/go/blob/b68f8ca89a2fb6b33d1e78fadc33d1c35693f6b8/src/os/exec/lp_windows.go#L1 In commit a662740 of PR git-lfs#4418 we then revised our license file to note that we also include some code from the Go library's "os" package in our "tools" package. The Go source code in this case has a copyright date of 2009, but we did not update our license file to reflect this, so we do that now. For reference, see: https://github.com/golang/go/blob/b68f8ca89a2fb6b33d1e78fadc33d1c35693f6b8/src/os/file_windows.go#L1 Finally, in commit fc95175 of PR git-lfs#4903 we removed our "vendor" directory and all the associated copies of our dependencies from this project. Our license file still mentions this directory, though, so we remove that reference now.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We currently vendor all dependencies in the repository. This causes a bunch of problems, notably that sometimes these dependencies are out of date, we get security reports about them, and they needlessly bloat the repository. There are some legitimate reasons to vendor dependencies, but none of them really apply to this project.
Since there are few benefits here and several downsides, let's remove the vendor directory altogether. It has already been ignored, so if users would like to use our
make vendortarget, which remains, they can do so without problems.There are two preparatory commits here which set us up for proper behavior at the end. I should point out that this pull request removes over 358,000 more lines than it adds, which I believe is a compelling argument in favor of it.
Fixes #4827