Syncthing is now a Go module, so dependencies are tracked in
go.sum and managed by the usual
go get commands plus a few modules specific ones like
go mod vendor. We still have the vendor dir for non-module builds (old style GOPATH). It’s not used for production builds or when you build in module mode, though.
You’ll be in “module mode” if you use Go 1.11 and set
GO111MODULE=on or build outside of
$GOPATH (~/go). This is how I roll nowadays.
The build server has an Athens module proxy on https://build.syncthing.net/athens. This is essentially just a caching proxy, meaning the build server will download a dependency only once and then hold on to it forever. Apart from being efficient this protects against dependencies disappearing or becoming unavailable.