dep roadmap wiki page 2017-03-07

roadmap.md

dep roadmap

The goal with dep is to be merged into the go toolchain. That's the path we're on, but that outcome is not guaranteed. It's going to be up to the Go community - you! - to see it through.

Timeline

The roadmap has three basic phases:

• First, we need to get dep in shape so that it's ready to be merged into the toolchain. Ideally, this would happen at the very beginning of a Go development cycle, to provide the most time for acclimation and tire-kicking.
• Second, once it's merged, we need to finish just the essential features, update other parts of the toolchain accordingly, and generally ensure it's solid and polished by the time of the next Go release.
• The third, "future" phase is all about changes (e.g. fixing GOPATH) we can make once the tool is well-established in the ecosystem.

Our goal is that phase 1 will be wrapped by the end of the 1.9 cycle, and dep will be merged into the toolchain when 1.10 development begins.

We've created a bunch of epic issues that we believe capture the work that needs doing for each phase:

• Pre-merge phase (1.9 cycle, thru mid 2017):
  • Stable manifest and lock files - dep can be used "for real" once the manifest and lock files are stabilized. Once this point is reached, it should be possible to use dep as your primary tool with forwards-compatibility, even after dep joins the toolchain.
  • Stable command set - all dep commands specced, defined, and implemented.
  • Security model - security needs to come off the backburner, now.
  • OS/Arch and build tags - cross-compilability by default is crucial.
• Pre-toolchain release phase (1.10 cycle, thru end 2017)
  • Errors and failures - making dep's failure modes comprehensible for everyone.
  • Private/Enterprise patterns support - official tooling really needs to serve both the public and private use cases.
  • Improved performance - dep is slow right now, but there's clear paths to fixing that.
  • cgo support - we've ignored cgo so far, but that can't continue.
• Future phase (2018 and on):
  • (More to come here soon - a proposal doc for fixing GOPATH is underway)

Please remember that finishing these issues does not guarantee dep will be merged. No external code of this size or significance has ever been pulled into the Go toolchain before, so everyone's kind of playing it by ear.

We plan to keep this roadmap updated as things evolve.

What we need

A lot of work lies ahead, but the momentum since we opened up dep has been tremendous - there's every reason to believe we can pull it off! Right now, we NEED PEOPLE to help shoulder the workload of writing docs, writing code, clarifying some design issues, and kicking the tires. Also, if anyone's interested in helping out with some project management, that would be huge 😄

If you're interested in contributing, here's some ways to go about finding your way in:

• Install dep (go get -u github.com/golang/dep/cmd/dep), try it out on one of your projects, and get a feel for it.
• Look through the epic issues linked above, and follow them down into the issues they link to.
• Join #vendor channel in the Gophers slack to ask questions. We're nice, and there are no stupid questions!
• If it seems like something's missing from our plan, open an issue!