Remove go.sum option about nancy HOT 8 CLOSED

so, it would be great if nancy can do it automatically, I mean we don't need to run it like go list -m all | nancy

from nancy.

@DarthHater maybe pull the trigger on removing this in v1.0??

from nancy.

Why the go.sum should be removed? Why we cannot use both options?

from nancy.

go list -m all | nancy works great

from nancy.

@SVilgelm it's more or less just because go.sum files are more like a ledger of what libraries you have used, not what you are currently using. It keeps track of the sha1 of the library, so that if for some reason someone changed a tag upstream etc.... go would be able to tell you, yeah, that's not what you were using before. It provides the mechanism for golang to have deterministic builds, but since it can have old versions of libraries in it, it doesn't provide an accurate look at what you are currently using, which is what go list -m all does. What we'd be removing is just the ability to scan the go.sum file itself, because people could be confused and think they are using something they aren't.

from nancy.

but it can really break the current CI scripts. I would recommend to add a deprecation message for a couple of months, then remove

from nancy.

@SVilgelm this is why we are targeting this for v1.0.0 and not in the current v0.x.y series. It's functionality will stick around for v0.x.y releases, which will be mostly patch and no new functionality, but removed from the v1.0.0 forward, so that people can gradually migrate :)

from nancy.

go.sum is gone. Fixed by #161

from nancy.