Manifest and lock file location

[pkieltyka]

Hello,

Im just trying dep for the first time - thanks very much for the work and efforts.

I noticed that dep init produces ./lock.json and ./manifest.json in the project root. Would the committee consider moving those files to ./vendor/lock.json and ./vendor/manifest.json? I believe they are better suited there to stay in their own domain and also keep the file structure much cleaner.

[sdboyer]

Sorry, we're set on them being in the root. #207 and/or #168 have more information.

[pkieltyka]

@sdboyer ah I see. Thats unfortunate to hear the lack of confidence in keeping vendor/ around.

[sdboyer]

Oh, hopefully that's not too big a worry. I sorta doubt vendor/ will ever actually go away, but I am confident that anything supplanting it will be demonstrably better.

[jusmarks]

@sdboyer I don't follow. Let's say vendor does go away, wouldn't this tool need to be updated to target the new directory? In other words, if you chose to put the manifest/lock inside vendor, and in the future vendor is deprecated, then this tool would need to be updated to target the new directory. If you chose to put the manifest/lock outside vendor, and in the future vendor is deprecated, then this tool would still need to be updated to target the new directory. How does putting the manifest/lock outside solve the problem?

[sdboyer]

@Justin-Marks yes, if we evolve beyond vendor, then this tool will certainly need to be updated.

The problem is, what happens with all of those already-released versions of code out there in the wild which use the old structure? Do they become invalid, because we moved the location of the files?

Creating incompatibilities with the structures generated by old tool versions entails creating upgrade paths - ones that need to be executed on the fly, without user intervention. That's a huge risk. Moving files around isn't the worst in this class of problem, but there's no sense in inviting Cthulhu if we can avoid it.

If There Is No Now in distributed systems, then Every Time Is Now in package managers.