[FAB-9167] builds check for stale deps

Change-Id: I4cab5a8843612e831ee0f9f89dbd1a4129979a35
Signed-off-by: Matthew Sykes <[email protected]>

Gopkg.toml

@@ -1,8 +1,19 @@
+# Copyright IBM Corp All Rights Reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
 required = [
-	"github.com/onsi/ginkgo",
-	"github.com/onsi/gomega",
-  "github.com/tedsuo/ifrit",
-	"github.com/golang/protobuf/protoc-gen-go"
+    "github.com/onsi/ginkgo",
+    "github.com/onsi/gomega",
+    "github.com/golang/protobuf/protoc-gen-go"
+]
+
+# Need to ignore directories that are not ignored by default
+ignored = [
+    "github.com/hyperledger/fabric/build",
+    "github.com/hyperledger/fabric/build/*",
+    "github.com/hyperledger/fabric/gotools",
+    "github.com/hyperledger/fabric/gotools/*",
 ]
 
 [[constraint]]
@@ -137,7 +148,3 @@ required = [
   [[prune.project]]
       name = "github.com/onsi/gomega"
       unused-packages = false
-
-  [[prune.project]]
-      name = "github.com/tedsuo/ifrit"
-      unused-packages = false

Makefile

@@ -24,6 +24,7 @@
 #   - behave-deps - ensures pre-requisites are available for running behave manually
 #   - gotools - installs go tools like golint
 #   - linter - runs all code checks
+#   - check-deps - check for vendored dependencies that are no longer used
 #   - license - checks go source files for Apache license header
 #   - native - ensures all native binaries are available
 #   - docker[-clean] - ensures all docker images are available[/cleaned]
@@ -116,11 +117,11 @@ include docker-env.mk
 
 all: native docker checks
 
-checks: license spelling linter unit-test
+checks: basic-checks unit-test
 
 basic-checks: license spelling linter
 
-desk-check: license spelling linter verify
+desk-check: checks verify
 
 # Pull thirdparty docker images based on the latest baseimage release version
 .PHONY: docker-thirdparty
@@ -197,7 +198,7 @@ profile: unit-test-clean peer-docker testenv
 
 # Generates a string to the terminal suitable for manual augmentation / re-issue, useful for running tests by hand
 test-cmd:
-	@echo "go test -tags \"$(GO_TAGS)\"
+	@echo "go test -tags \"$(GO_TAGS)\""
 
 docker: docker-thirdparty $(patsubst %,build/image/%/$(DUMMY), $(IMAGES))
 
@@ -211,10 +212,14 @@ behave: behave-deps
 behave-peer-chaincode: build/bin/peer peer-docker orderer-docker
 	@cd peer/chaincode && behave
 
-linter: buildenv
+linter: check-deps buildenv
 	@echo "LINT: Running code checks.."
 	@$(DRUN) $(DOCKER_NS)/fabric-buildenv:$(DOCKER_TAG) ./scripts/golinter.sh
 
+check-deps: buildenv
+	@echo "DEP: Checking for dependency issues.."
+	@$(DRUN) $(DOCKER_NS)/fabric-buildenv:$(DOCKER_TAG) ./scripts/check_deps.sh
+
 %/chaintool: Makefile
 	@echo "Installing chaintool"
 	@mkdir -p $(@D)

gotools/Makefile

@@ -48,6 +48,15 @@ gotool.ginkgo:
 	@cp -R $(GOPATH)/src/github.com/hyperledger/fabric/vendor/github.com/onsi/ginkgo/* $(TMP_GOPATH)/src/github.com/onsi/ginkgo
 	@GOPATH=$(abspath $(TMP_GOPATH)) go install github.com/onsi/ginkgo/ginkgo
 
+# Lock to a versioned dep
+gotool.dep: DEP_VERSION ?= "0.4.1"
+gotool.dep:
+	@echo "Getting dep $(DEP_VERSION)"
+	@GOPATH=$(abspath $(TMP_GOPATH)) go get -d github.com/golang/dep
+	@cd $(abspath $(TMP_GOPATH)) git checkout $(DEP_VERSION)
+	@echo "Building github.com/golang/dep -> dep"
+	@GOPATH=$(abspath $(TMP_GOPATH)) go install -ldflags="-X main.version=$(DEP_VERSION) -X main.buildDate=$$(date '+%Y-%m-%d')" github.com/golang/dep/cmd/dep
+
 # Default rule for gotools uses the name->path map for a generic 'go get' style build
 gotool.%:
 	$(eval TOOL = ${subst gotool.,,${@}})

images/buildenv/Dockerfile.in

@@ -1,7 +1,7 @@
 # Copyright Greg Haskins All Rights Reserved
 #
 # SPDX-License-Identifier: Apache-2.0
-#
+
 FROM _BASE_NS_/fabric-baseimage:_BASE_TAG_
 COPY payload/protoc-gen-go /usr/local/bin/
 ADD payload/gotools.tar.bz2 /usr/local/bin/

scripts/check_deps.sh

@@ -0,0 +1,8 @@
+#!/bin/bash -e
+
+# Copyright IBM Corp All Rights Reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+dep version
+dep ensure --no-vendor --dry-run