status should not show ineffectual constraints

[edevil]

What version of dep are you using (dep version)?

Latest from homebrew and tip.

What dep command did you run?

dep ensure -v

Gopkg.lock was already in sync with imports and Gopkg.toml
(1/33) Wrote github.com/qor/session@master
(2/33) Wrote github.com/gorilla/[email protected]
(3/33) Wrote github.com/gorilla/[email protected]
(4/33) Wrote github.com/microcosm-cc/bluemonday@master
(5/33) Wrote github.com/qor/assetfs@master
(6/33) Wrote github.com/kr/text@master
(7/33) Wrote github.com/jinzhu/now@master
(8/33) Wrote github.com/kr/pretty@master
(9/33) Wrote github.com/jinzhu/inflection@master
(10/33) Wrote github.com/jinzhu/copier@master
(11/33) Wrote github.com/gosimple/[email protected]
(12/33) Wrote gopkg.in/yaml.v2@v2
(13/33) Wrote github.com/gorilla/[email protected]
(14/33) Wrote github.com/jinzhu/[email protected]
(15/33) Wrote go4.org@master
(16/33) Wrote github.com/mattn/[email protected]
(17/33) Wrote github.com/dgrijalva/[email protected]
(18/33) Wrote github.com/rainycape/unidecode@master
(19/33) Wrote github.com/qor/[email protected]
(20/33) Wrote github.com/qor/redirect_back@master
(21/33) Wrote github.com/qor/middlewares@master
(22/33) Wrote github.com/qor/[email protected]
(23/33) Wrote gopkg.in/alexcesaro/quotedprintable.v3@v3
(24/33) Wrote github.com/qor/auth@master
(25/33) Wrote github.com/qor/[email protected]
(26/33) Wrote github.com/qor/qor@1c17696527773fa844a809b0ff06f79559f4d336
(27/33) Wrote github.com/qor/mailer@master
(28/33) Wrote github.com/qor/[email protected]
(29/33) Wrote gopkg.in/[email protected]
(30/33) Wrote github.com/qor/admin@009cc1290581761ac6fe8c837681c03891c27368
(31/33) Wrote golang.org/x/net@master
(32/33) Wrote golang.org/x/text@master
(33/33) Wrote github.com/theplant/cldr@master

Both my main.go and Gopkg.toml can be found here: https://gist.github.com/edevil/8a47d4cf8f34bf2f64f2520db5bcd986

What did you expect to see?

github.com/qor/render and github.com/qor/roles (at least) should not be stuck at v1.0.

What did you see instead?

Both of those libraries were stuck at v1.0, "dep status" shows:

PROJECT                                 CONSTRAINT     VERSION        REVISION  LATEST   PKGS USED
...
github.com/qor/roles                    d637560        v1.0           f1e0569   d637560  1
github.com/qor/render                   63566e4        v1.0           ab08a9c   63566e4  1

[darkowlzz]

Hi, thanks for opening this issue. Two things:

1. This seems to be an issue due to ineffectual constraints. qor/roles and qor/render are transitive dependencies of your main project. constraints for transitive dependencies are ignored by dep without any warnings. We have WIP for issuing warnings for this in [WIP] Report Ineffectual Rules #1494 . As per our spec doc CONSTRAINT field shows what you set in the manifest. I feel we can change it to show the effectual constraints, and that would make it more apparent that the constraint in manifest isn't applied at all. @sdboyer should we change it?
2. The example above helped me to reproduce a scenario where VERSION and LATEST are empty. I knew I've seen this before but couldn't reproduce it to debug and find the actual issue underneath.

[darkowlzz]

Also, to set constraints for transitive dependencies, you can use override.

[darkowlzz]

For the 2nd point:

The example above helped me to reproduce a scenario where VERSION and LATEST are empty. I knew I've seen this before but couldn't reproduce it to debug and find the actual issue underneath.

I thought gps would figure out a version for a given revision, but that's not the case. I got confused with that behavior in init importers where we try to figure out version for a given revision. So, since we don't know VERSION, because we only have a revision, we can't check for LATEST without knowing the version.

Removing the bug label. But we can still discuss about the CONSTRAINT field. Should it be what's in manifest or the effectual constraint?

[edevil]

Well, I think that "CONSTRAINT" should be as it is. The fact that "REVISION" differs from "CONSTRAINT" already tells me that's an ineffectual constraint, right?

The problem here was that I was not aware that constraints were not applied to transitive dependencies. That should be signalled in the output, that PR will help.

[sdboyer]

@darkowlzz yes, status should not show ineffectual constraints.

[darkowlzz]

I just realized that this issue has been addressed in #893 with a rough idea of the solution, which would required a lot of changes in how status works now. We have some but not all the necessary parts to implement it now.

Removing help wanted label.

[edevil]

Should I close this?

[darkowlzz]

No, this is a real example of the problem we have. Let's keep this as a reminder to fix this issue.

[mvdan]

Dep was officially deprecated earlier this year, and the proposal to archive this repository was accepted. As such, I'm closing outstanding issues before archiving the repository. For any further comments, please use the proposal thread on the Go issue tracker. Thanks!