gpm should detect duplicated lines with different sha1 in Godeps file

[mikosik]

Currently when I specify some dependency twice in Godeps file (each time with different version) then gpm chooses only one and doesn't report any error. This can cause a lot of trouble to unwary developer.

gpm should fail in such case, listing dependencies that are duplicated. I'm opting for failing even when both lines are exactly the same (specify the same dependency version).

[pote]

Just realised I've never replied to this!

I'm not sure we should add this kind of error-checking code, the error condition in this case involves human error and expecting users to check their Godeps file before adding a new line to it shouldn't be too big of a stretch.

I'm open to reconsider but will close the issue for now, feel free to reopen and generate a discussion about it!

Thanks for your contribution :D

[mikosik]

expecting users to check their Godeps file before adding a new line to it shouldn't be too big of a stretch

I disagree. Do not reporting errors from configuration file is a worst thing a tool can do.

Just to give you one concrete example - image one developer added dependency to Godeps file at the beginning of the file and second developer added the same dependency at the end of the file. Third developer git-merged their branches (which can be done without any errors) and ended up with Godeps file with dependency being added twice.

[pote]

That could happen, but it would involve human error on the side of either the committer or the merger. Fighting off human error is a slippery slope: it's really easy to just add more and more babysitting for users and before you know it there's a whole lot of complexity added that isn't really needed to resolve the main problem, only to go around avoidable corner cases.

This is the kind of functionality that I would write in a plugin, this way we can test the waters and see how necessary the feature really is before adding it to core.