search

google / deps.dev

Resources for the deps.dev API
https://deps.dev
Apache License 2.0
256 stars 20 forks source link

Unresolved dependency tree in go #67

Closed runner02 closed 8 months ago

runner02 commented 8 months ago

While checking the dependencies of github.com/ProtonMail/go-crypto, I get an unresolved list. E.g the dependencies of golang.org/x/crypto (direct dependency) are not shown.

adg commented 8 months ago

This is actually the correct behavior, although we could definitely do a better job of explaining why.

It's because of Module Graph Pruning, where only the modules required to build or test the packages in the main module (ProtonMail/go-crypto) are considered part of the final module graph. So even though there are other module dependencies of golang.org/x/crypto, the go-crypto module doesn't use them and therefore doesn't depend on them.

If you clone the go-crypto repository and use the go list command to show the transitive dependencies of all the packages in the module, you can see that they don't transitively import packages from any modules other than golang.org/x/crypto and github.com/cloudflare/circl.

~/src/go-crypto $ go list -f '{{range .Deps}}{{printf "%s\n" .}}{{end}}' ./...  | sort -u | grep '\.'
github.com/ProtonMail/go-crypto/bitcurves
github.com/ProtonMail/go-crypto/brainpool
github.com/ProtonMail/go-crypto/eax
github.com/ProtonMail/go-crypto/internal/byteutil
github.com/ProtonMail/go-crypto/ocb
github.com/ProtonMail/go-crypto/openpgp
github.com/ProtonMail/go-crypto/openpgp/aes/keywrap
github.com/ProtonMail/go-crypto/openpgp/armor
github.com/ProtonMail/go-crypto/openpgp/ecdh
github.com/ProtonMail/go-crypto/openpgp/ecdsa
github.com/ProtonMail/go-crypto/openpgp/ed25519
github.com/ProtonMail/go-crypto/openpgp/ed448
github.com/ProtonMail/go-crypto/openpgp/eddsa
github.com/ProtonMail/go-crypto/openpgp/elgamal
github.com/ProtonMail/go-crypto/openpgp/errors
github.com/ProtonMail/go-crypto/openpgp/internal/algorithm
github.com/ProtonMail/go-crypto/openpgp/internal/ecc
github.com/ProtonMail/go-crypto/openpgp/internal/encoding
github.com/ProtonMail/go-crypto/openpgp/packet
github.com/ProtonMail/go-crypto/openpgp/s2k
github.com/ProtonMail/go-crypto/openpgp/x25519
github.com/ProtonMail/go-crypto/openpgp/x448
github.com/cloudflare/circl/dh/x25519
github.com/cloudflare/circl/dh/x448
github.com/cloudflare/circl/ecc/goldilocks
github.com/cloudflare/circl/internal/conv
github.com/cloudflare/circl/internal/sha3
github.com/cloudflare/circl/math
github.com/cloudflare/circl/math/fp25519
github.com/cloudflare/circl/math/fp448
github.com/cloudflare/circl/math/mlsbset
github.com/cloudflare/circl/sign
github.com/cloudflare/circl/sign/ed25519
github.com/cloudflare/circl/sign/ed448
golang.org/x/crypto/argon2
golang.org/x/crypto/blake2b
golang.org/x/crypto/cast5
golang.org/x/crypto/hkdf
golang.org/x/crypto/sha3
vendor/golang.org/x/crypto/cryptobyte
vendor/golang.org/x/crypto/cryptobyte/asn1
vendor/golang.org/x/net/dns/dnsmessage
vendor/golang.org/x/net/route

I'll need to investigate why golang.org/x/sys appears in our dependency set for go-crypto - I suspect it's related to test dependencies, or maybe it's a bug somewhere (either in deps.dev code or the go tool itself).

Let me know if there is anything about this that doesn't make sense to you. Thanks for the report.