pokstad/vsaur

vsaur = vendorsaurus : tools for working with Go modules (AKA vgo) and vendoring

About Me

Howdy 👋, I'm Paul Okstad. I'm a software engineer based in Southern California.

Work History

I have been writing code in exchange for money since 2006. I started off my career at a defense contractor (Boeing), then left to produce a best selling iOS app (You Are Your Own Gym). I then worked at a small startup (SmartEdge) and then a larger one (GitLab). Today I work on ecommerce related work for a cybersecurity company (CrowdStrike).

🏡 WFH History & Philosophy

I have been working from home in some capacity since 2014. I have worked both for hybrid teams split between remote workers 🏡 and office workers 🏢 and on a totally geographically distributed 🌎 open source team.

I love working from home because of the work life balance it provides me. WFH also provides a more distraction free environment for heads down work. I commute less, spend less time and fuel on freeway, work more, and see my family more.

Many companies tried WFH during COVID, but many of them did not have it in their DNA. WFH was simply a bandaid they applied when they needed to. Too many companies relied on face-to-face collaboration to drive productivity. Collaborating from home behind a computer doesn't come naturally. You need lots of training and support to work effective from home. Most companies simply did not invest properly into an effective WFH plan.

When COVID started, I was working at a totally remote company, GitLab. GitLab was a leader in the WFH-mindspace for software companies by publishing an open source handbook on remote work. GitLab's remote strategy flowed down from the CEO level and was a critical aspect of all hiring. Eventually, a dedicated head of remote was hired to drive remote philosophy further. While working there, I became indoctrinated into the async-philosophy of working on a distributed team. Some key take aways:

• Treat all requests like a queue of messages.
• Process each message in order.
• Don't mark messages as read until after you have resolved them.
• Push messages that require additional time back to the end of the queue.
• Prioritize messages pushed to the end of the queue by reordering them.

vsaur's Issues

Flag mod file replace statements including local paths

When working on local forks, the mod file will sometimes be modified to replace an import to an external repo to a local directory. These are fine during development, but should never be allowed in an SCM system since the builds are not reproducible. VSaur should flag this undesired usage.

Flag when go.sum has excessive or insufficient package listings

The go.sum file is used to track the crypto hashes of the packages used by a project. This gives confidence to the consumer of a module that they are using the same dependencies the author intended. During the course of development, the go.sum may balloon in size since Go v1.11 adds to the file. Also, it may be possible that the go.sum isn't updated and there are missing package hashes. Two flags should be developed for both cases.

Flag when vendor folder does not match go.mod and go.sum

Some projects may elect to commit the vendor folder to avoid requiring network access to compile a project. This VSaur check will verify the vendor folder matches the hash recorded in go.sum, and this correlates with a version listed in go.mod.

Get VSaur added to community tooling list

Once there is something to demo, get VSaur added to the Go wiki section for module community tools: https://github.com/golang/go/wiki/Modules#what-community-tooling-exists-for-working-with-modules

Scan dependencies for license issues

The ability to scan dependencies for license issues (e.g. missing license/copying file) or tally up the types of licenses (e.g. BSD, MIT, GPL, unknown).