v0.12.1 blows away all transitive dependencies when "glide rm" is run

[a13xb]

I've noticed this trying to remove an unused package from glide.yaml. When you run glide rm X, it will not only remove package X from glide.lock, but also all transitive dependencies of any other packages unrelated to X, that are not listed in glide.yaml.

(Tangentially related, I think it should be possible to edit the glide.yaml file manually and regenerate lock file without running update.)

[mattfarina]

Glide manages your dependencies for you like package managers from other languages. It uses metadata from your project plus the dependencies to do this. For example, if two dependencies of your project have a shared transitive dependency but need different through overlapping version constraints Glide works that out.

You can manually edit the glide.yaml file and then run glide update. It will scan the code and use the information contained in the `glide.yaml' file plus the metadata found in dependencies to fetch all the needed dependencies and try to set them to the right version.

A lot of people want to tools that will manage their dependencies for them. That's what Glide is there to do.

[a13xb]

OK, two different issues here. (I should have probably created a separate issue for the second one.)

1. Is it fair to say that glide rm should not remove all unrelated transitive dependencies from the lock file, and what it's doing now is not expected behaviour?
2. Regarding the second part about manually editing the glide.yaml, what I mean is, I want to edit the file and update the lock file but without touching the pinned versions already in the lock file. That is, I don't actually want to update any packages, just sync yaml and lock files. Incidentally, glide update works the way I want by coincidence right now (because of the bug in Glide update does not update packages to the latest version unless git cache is cleared #592), it'd be great to be able to rewrite the lock file without relying on this bug being there.

[a13xb]

I've made an example project for the rm issue (0.12.2).

When running

glide rm github.com/gorilla/mux

Both glide.lock and glide.yaml will be empty.

[a13xb]

Update: actually I've had a typo in glide.yaml file. With a fixed version, it behaves as described in the original issue:

1. github.com/gorilla/mux with its dependencies is removed,
2. but so are all the dependencies of github.com/influxdata/influxdb, which was not being removed.

[sdboyer]

I want to edit the file and update the lock file but without touching the pinned versions already in the lock file. That is, I don't actually want to update any packages, just sync yaml and lock files.

What are you imagining would be synced between the manifest and lock file, if not the pinned versions? Just the hash digest?

[a13xb]

What are you imagining would be synced between the manifest and lock file, if not the pinned versions? Just the hash digest?

Mainly addition and removal of packages. For example:

1. I removed a package from glide.yaml manually, or removed references to some packages from my code and want to prune the lock file (remove all unused packages and all their dependencies).
2. I added a package to glide.yaml manually, or started using a non-vendored version, and now want it reflected in the lock file.

In either case, there is a loss of sync between the set of packages in glide.yaml and glide.lock. I want to sync the changes (so they contain the same set of packages) but without updating the pins of the packages that are not touched.

[sdboyer]

@a13xb ah, ok. that, then, is a generally known issue; see #252 and #328.

it's also something that will be solved by gps, which is tentatively slated for v0.13.0.