kardianos/govendorArchived
Govendor
govendor is a toolset for Go dependency management that enables the replication of external packages into a local directory to ensure reproducible builds without requiring active network access. It functions as a dependency vendor tool and version manager, fetching specific git revisions, tags, or branches of remote packages.
The project includes a dependency auditor to identify missing, modified, or outdated packages compared to their remote sources. It also provides a license extraction utility that discovers and lists the legal licenses associated with project import paths and dependencies.
The system supports configuration-driven synchronization and build-tag aware filtering to exclude specific files or packages based on build constraints. It manages remote-to-local source mirroring and tracks specific revisions to maintain consistent package versions across environments.
Features
- Vendor Directories - Replicates external Go package source code into a local vendor directory to enable offline builds.
- Dependency Vendors - Archives external dependency source code locally to support reproducible builds without network access.
- Lock File Vendors - Pulls packages from remote repositories using specific revisions recorded in a configuration file.
- Go Module Dependencies - Manages Go project dependencies by vendoring remote modules into a local directory.
- Manifest-Driven Dependency Managers - Uses a project manifest to automatically download and arrange remote packages for reproducible builds.
- Vendoring Automations - Automates the copying and updating of external packages into a local folder to ensure reproducible builds.
- Source Version Fetching - Retrieves specific git revisions, tags, or branches of remote packages into a local directory.
- Versioned Package Managers - Manages specific versions of Go packages by fetching git revisions, tags, or branches.
- Version Pinning - Ensures consistent package versions across environments by pinning dependencies to specific git hashes or tags.
- Remote-to-Local Path Mapping - Fetches content from remote version control systems and maps it to a local filesystem hierarchy.
- Go Dependency Managers - Provides specialized dependency management for Go projects by downloading specific versions into a local directory.
- Dependency Integrity Auditing - Provides a dependency auditor to identify missing, modified, or outdated packages compared to their remote sources.
- Build Artifact Exclusions - Prevents specific packages or files restricted by build tags from being copied into the local vendor directory.
- Dependency Integrity Audits - Identifies missing, modified, or outdated local packages relative to their remote source versions.
- Source Integrity Auditors - Identifies missing, modified, or outdated Go packages compared to their remote source versions.
- Build Source Filters - Provides mechanisms to exclude specific files or packages from the local vendor directory based on Go build tags.
- Go License Scanners - Scans Go dependencies to discover and list legal licenses for compliance.
- License Compliance Reports - Generates reports identifying all open-source licenses and copyright statements within project dependencies.
- Dependency License Extractors - Automatically extracts and aggregates legal license files from all project dependencies.
- Dependency Management - Dependency management using vendor files.
- Package Management - Vendor-based dependency management tool.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
