Vendor deps with dep

[hairyhenderson]

As suggested in #29, this vendors in the dependencies.

I did this with:

$ go get -u github.com/golang/dep/cmd/dep
$ dep init

Updates are done with:

$ dep ensure

/cc @BTBurke

[BTBurke]

Thanks for the contribution. One change that needs to be made is to manually edit the Godep.toml and ignore caddy dependencies. Otherwise this is going to break the Caddy build server.

What we want is just to vendor the core dependency of jwt-go and let the others be managed by the build server.

[hairyhenderson]

@BTBurke ah, ok - I understand... I'll see if I can figure out how to get dep to do that...

[BTBurke]

No worries.  This is actually hard to do because you have to know a bit about how the build server works. I'm not sure that the build server and dep are compatible because of the way it fetches and caches dependencies.  If you look in godep.toml there is a way to specify packages to ignore but I've never tried it.  If that works, I can push a test build to the build server and just see if it will actually​ accept vendored dependencies. If you don't want to get that far into it, don't worry about it. I left this on the to-do list for a while because I knew it could be a bit complicated.

…

On Oct 28, 2017, 4:27 PM, at 4:27 PM, Dave Henderson ***@***.***> wrote: @BTBurke ah, ok - I understand... I'll see if I can figure out how to get `dep` to do that... -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #32 (comment)

[hairyhenderson]

@BTBurke ok, I've updated the PR.

The dep status output is now:

$ dep status
PROJECT                      CONSTRAINT  VERSION  REVISION  LATEST   PKGS USED
github.com/dgrijalva/jwt-go  ^3.1.0      v3.1.0   dbeaa93   dbeaa93  1  

[BTBurke]

@hairyhenderson I gave this a shot but unfortunately dep isn't supported by the build server. Caddy won't build as long as the vendored dependencies exist. I may create an issue on the Caddy repo, but it's not a huge deal in the short term as long as the API for the jwt-go dependency is stable.

Thanks for your help on this.