Dep: status shows incorrect reason for lock mismatch

[ptman]

What version of dep are you using (dep version)?

v0.3.1-16-g5e004f4

I tried updating with go get -u github.com/golang/dep/cmd/dep

What dep command did you run?

dep status

What did you expect to see?

normal dep status output

What did you see instead?

Lock inputs-digest mismatch due to the following packages missing from the lock:

PROJECT                   MISSING PACKAGES
golang.org/x/net          [golang.org/x/net/websocket]                             
github.com/revel/revel    [github.com/revel/revel github.com/revel/revel/testing]  
github.com/revel/modules  [github.com/revel/modules/jobs/app/jobs]                 

This happens when a new import is added. Run `dep ensure` to install the missing packages.

In my Gopkg.toml I have:

ignored = [
  ...
  "github.com/revel/modules/jobs/app/jobs",
  "github.com/revel/revel",
  "github.com/revel/revel/testing",
  "golang.org/x/net/websocket",
  ...
]

[darkowlzz]

@ptman thanks for reporting this issue.

In this case, it looks like the lock mismatch is happening due to a change in Gopkg.toml's ignored. Maybe you edited Gopkg.toml to add the new ignores and never ran dep status. ignores are also considered while generating the input-digest.

So, the issue here is not dep not ignoring, but status assuming the wrong reason for the mismatch. When there are missing packages found, we are not checking if those packages already exist in ignore. We should check and if all of them exist, then tell the user that the mismatch is due to a change in Gopkg.toml.

But if you run ensure, it would just update the input-digest and those packages would still be ignored.

[ptman]

@darkowlzz thank you for your reply. Indeed, dep ensure did not add those packages to vendor/, as I had feared.