migrate to go modules from vndr

[tariq1890]

This PR should migrate docker/distribution to go modules.

[codecov]

Codecov Report

Merging #2941 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #2941   +/-   ##
=======================================
  Coverage   60.47%   60.47%           
=======================================
  Files         102      102           
  Lines        7999     7999           
=======================================
  Hits         4837     4837           
  Misses       2515     2515           
  Partials      647      647

Flag	Coverage Δ
#linux	60.47% <ø> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update dcfe05c...5223c27. Read the comment docs.

[tariq1890]

This should close #2768 and hopefully unblock #2906.

[tariq1890]

@thaJeztah Thanks for the review. As suggested by you, I can do this in a follow-up PR. I wanted to scope this PR to just migration from vndr or go mod. If others feel strongly about scoping the dep updates to this PR, I'm happy to oblige.

[thaJeztah]

No, definitely should try to do those in follow-ups and keep the diff in this one as minimal as possible (same version of dependencies)

[SuperQ]

LGTM

[SuperQ]

The real question is how do we get people at Docker to look at these PRs. ☹️

[thaJeztah]

It's been created a day ago; it will be looked at

[SuperQ]

I created a simple PR months ago, it's not been looked at. My confidence is low.

[tariq1890]

@caervs requesting your review on this.

[tariq1890]

@caervs I've addressed the review comments.

[thaJeztah]

/cc @ehazlett for review (as you were working on something similar for containerd 🤗 )

[tariq1890]

Friendly ping for review.

[caervs]

@tariq1890 sorry I should've made this a separate comment for easier visibility. Please address #2941 (comment)

[ehazlett]

Overall LGTM

[tariq1890]

@caervs I tried this locally, but I don't see how this is diffing and erroring out. It is possible that I may have missed some steps.

Also, the steps I have written was taken from kube-state-metrics (a repository I maintain) and it does work .

You can see go mod validate script we use - https://github.com/kubernetes/kube-state-metrics/blob/master/Makefile#L22

See this for details - https://travis-ci.org/kubernetes/kube-state-metrics/jobs/547266596. It is a build that was kicked off a couple of hours back.

[caervs]

@tariq1890 the case that we care about here is that someone submits a PR that adds a new dependency, but forgets to vendor in the code for that library.

The vendoring script here would pull in the new dep but would exit cleanly, so from the PR CI job we won't know that the vendor directory is actually out of sync.

To verify this you can remove an existing library, commit, and then run the vendoring script

$ rm -r ./vendor/github.com/gorilla/
$ git commit -am 'Missing library'
...
$ ./script/validate/vendor
- Checking for any unused/missing packages in go.mod...
- Checking for unused packages in vendor...
$ echo $?
0
$ git status
...
Untracked files:
  (use "git add <file>..." to include in what will be committed)

        vendor/github.com/gorilla/

However if you add in

untracked=$(git ls-files --others vendor | wc -l | awk '{ print $1 }')
[ "$untracked" == "0" ]

The last command will exit status 1

[tariq1890]

Makes sense. Thanks for the clarification @caervs .

[SuperQ]

You can also see examples of how we do vendor checking in the Prometheus common Makefile.

[caervs]

Awesome. LGTM.

It's a petty go modules pulls in so much more than vndr did. Hopefully it's on the go team's agenda to reduce to just dependencies.