Syncthing is now a Go module, so dependencies are tracked in go.mod
& go.sum
and managed by the usual go get
commands plus a few modules specific ones like go mod vendor
. We still have the vendor dir for non-module builds (old style GOPATH). It’s not used for production builds or when you build in module mode, though.
You’ll be in “module mode” if you use Go 1.11 and set GO111MODULE=on
or build outside of $GOPATH
(~/go). This is how I roll nowadays.
The build server has an Athens module proxy on https://build.syncthing.net/athens. This is essentially just a caching proxy, meaning the build server will download a dependency only once and then hold on to it forever. Apart from being efficient this protects against dependencies disappearing or becoming unavailable.