Dep Deployment and Usage Guide

Deprecation Notice: dep is deprecated and archived as of 2020. Go modules (introduced in Go 1.11) are the official dependency management solution. This guide is preserved for legacy maintenance only. New projects should use go mod.

Prerequisites

Go: Version 1.9 or newer (required to compile from source)
Git: Required for fetching dependencies from source repositories
GOPATH: Working directory must be within $GOPATH/src (pre-modules Go workspace requirement)
Network access: For fetching dependencies from remote repositories

Installation

Option 1: Official Binary Releases (Recommended)

Download pre-compiled binaries from the GitHub Releases page.

macOS (Homebrew):

brew install dep
brew upgrade dep

Debian/Ubuntu:

sudo apt-get install go-dep

Windows: Download the tarball from go.equinox.io and extract to your PATH.

Linux/Other (Install Script):

curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh

Specify custom installation directory:

curl https://raw.githubusercontent.com/golang/dep/master/install.sh | INSTALL_DIRECTORY=$HOME/bin sh

Option 2: Install from Source

go get -u github.com/golang/dep/cmd/dep

This installs the dep binary to $GOPATH/bin/dep.

Verify Installation

dep version

Configuration

Project Structure

Dep uses two primary configuration files in your project root:

Gopkg.toml - Manifest file defining dependency constraints:

[[constraint]]
  name = "github.com/pkg/errors"
  version = "0.8.0"

[[constraint]]
  name = "github.com/sirupsen/logrus"
  version = ">= 1.0.0, < 2.0.0"

[prune]
  unused-packages = true
  go-tests = true

Gopkg.lock - Generated lock file pinning exact versions (do not edit manually).

Environment Variables

GOPATH: Must be set; project must reside within $GOPATH/src
DEP_PROJECT_ROOT: Override the import path detection (rarely needed)
DEP_NO_PROXY: Comma-separated list of hosts to bypass proxy
HTTPS_PROXY/HTTP_PROXY: Standard proxy settings respected

Build & Run

Initialize a New Project

cd $GOPATH/src/github.com/yourusername/project
dep init

This analyzes your imports and creates Gopkg.toml and Gopkg.lock, populating the vendor/ directory.

Daily Development Workflow

Add a dependency:

# Import in your Go code, then run:
dep ensure -add github.com/gorilla/mux

Update dependencies:

# Update all dependencies to latest allowed by constraints
dep ensure -update

# Update specific package
dep ensure -update github.com/pkg/errors

Sync vendor directory:

dep ensure

Check status:

dep status

Validate setup:

dep check

Building from Source (Development)

git clone https://github.com/golang/dep.git $GOPATH/src/github.com/golang/dep
cd $GOPATH/src/github.com/golang/dep
go build ./cmd/dep
go install ./cmd/dep

Run tests:

go test ./...

Deployment

CI/CD Integration

GitHub Actions / Travis CI / CircleCI:

# Install dep
- curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
- export PATH=$PATH:$HOME/bin

# Download dependencies
- dep ensure -vendor-only

# Build
- go build -v ./...

Docker Multi-stage Build:

# Build stage
FROM golang:1.13-alpine AS builder
RUN apk add --no-cache git curl
RUN curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
WORKDIR /go/src/github.com/yourorg/app
COPY Gopkg.toml Gopkg.lock ./
RUN dep ensure -vendor-only
COPY . .
RUN go build -o /bin/app

# Runtime stage
FROM alpine:latest
COPY --from=builder /bin/app /bin/app
ENTRYPOINT ["/bin/app"]

Production Considerations

Vendor Directory: Commit vendor/ to version control for reproducible builds, or use dep ensure -vendor-only in CI
Caching: Cache vendor/ between builds to avoid redundant network calls
Migration Path: Since dep is deprecated, plan migration to Go modules:
```
go mod init
go mod tidy
```

Troubleshooting

"project not in GOPATH"

Error: dep init fails with "project not in GOPATH/src" Solution: Ensure your project is within $GOPATH/src (e.g., $GOPATH/src/github.com/user/project). Dep requires GOPATH mode.

Network/Proxy Issues

Error: Failed to fetch dependencies behind corporate firewall Solution:

export HTTPS_PROXY=http://proxy.company.com:8080
dep ensure -v  # Verbose output for debugging

Or configure Git to use SSH instead of HTTPS:

git config --global url."git@github.com:".insteadOf "https://github.com/"

Version Resolution Conflicts

Error: Constraint conflicts between dependencies Solution: Edit Gopkg.toml to add overrides:

[[override]]
  name = "github.com/conflicting/package"
  version = "1.2.3"

Then run dep ensure.

Build Tags Not Respected

Error: Dependencies with build tags (e.g., // +build linux) not vendored correctly Solution: Dep analyzes all Go files including build-tagged ones. Ensure your development environment includes the target platforms or manually add constraints in Gopkg.toml.

Migrating to Go Modules

Issue: Need to migrate legacy dep-managed project Solution:

# Ensure dep is up to date
dep ensure

# Convert to modules (Go 1.11+)
export GO111MODULE=on
go mod init
go mod tidy

# Remove dep files
rm Gopkg.toml Gopkg.lock
rm -rf vendor/

Platform-Specific Syscalls

Note: The vendor directory includes platform-specific syscall implementations (e.g., zsyscall_linux_arm64.go, zsyscall_freebsd_arm.go). These are auto-generated and should not be manually edited. If building on unsupported architectures, ensure the golang.org/x/sys package supports your target platform.

How to Deploy & Use golang/dep