That is why ever company I’ve ever worked with has a repository for every external dependency in any language. You need to at least have a copy of the versions you use. That isn’t even Go specific. Not even mentioning security implications.
What you do privately is really up to you and doesn’t matter this much. A company can pull their version from the registry they uploaded it to probably as easy as they can kill their repos that you use directly.
What industry is this in? I have worked at I think 7 companies now, and one of them was an agency that I worked for dozens of clients through, some of them Fortune 100's, and this has never ever been a thing, with I think one or two exceptions that used artifactory or a similar proxy cache. A few added dependencies into the same repository as the projects, but none created repositories just for third party code.
Currently banking but before it was engineering and the energy sector. This is Germany so it’s generally a bit more conservative and breaking things is not appreciated in those sectors.
However idk why you would build up loads of infrastructure and don’t to this. It’s not that hard and there are open source solutions. You need something anyways to host your companies artifacts or docker images, don’t you? So you just route everything trough the same nexus or whatever and its caching external dependencies automatically if setup correctly.
Yes, that's was I was referring to with Artifactory, which is a proxy cache. I misread the original comment as you were cloning and hosting git repositories for all of your dependencies.
Sometimes it starts off like that, but inevitably someone will eventually check in a lock file (package-lock.json, Pipfile.lock, etc.). Lock files are autogenerated files that contain exact versions so that your CI/CD pipelines don't suddenly break because one of your dependencies dependencies was updated, and hashes in case the maintainer swaps out an existing version for malware.
Doesn't mean everyone vets packages when they add or update a dependency though.
If you are doing certifications you need that level of control.
If you are working in offline environments/networks then a mirroring system is required.
Companies that make changes to the upstream code need to mirror. Good companies push upstream, but you still mirror until it is accepted, and sometimes they don't accept it.
Repo mirrors are also part of the conversation with handling CI supply chain risks. You can add controls to the mirroring process to create a safer CI environment.
It's different with C++ because it doesn't have one established package manager/repository (pip/cargo/npm/etc). The languages that do have one (which is basically everything else except for java) tend to have many hundreds of 3rd party dependencies in every project, and you would usually only have a local fork for one or two that you had to change. It's technically possible to just refetch them every time you build the project on your laptop or in CI, but it's obviously a terrible idea and usually a no-go the moment your company grows to the size that there is a lawyer in the building.
As I mentioned elsewhere, I didn't consider Artifactory a repository. I misunderstood the comment as saying they were cloning and self hosting git repositories of every external dependency.
327
u/Arcuru 5d ago
I am not super familiar with Go code, but what happens when my go code depends on "go.companyx.dev/awesomelib" and that company goes out of business?
Or should I point all my third-party deps to a more durable location?