Review the golang packages we use

[krnowak]

Related to #70 and #34.

The "nothing fancy" or "quick wins" packages:

• github.com/blang/semver

  • Semver parser.
  • We should update it to github.com/blang/semver/v4, it's the release that's compatible with go modules.

• gopkg.in/fatih/set.v0

  • Just a set library. It's an archived and unmaintained project.
  • Just write our own set difference function.

• github.com/satori/go.uuid

  • Uuid generator and stuff.
  • Using latest release already.
  • Unmaintained and buggy, needs replacing.

The database packages:

• github.com/jmoiron/sqlx

  • Extended golang's database/sql.
  • Already updated to latest release. We will see if we need it when
    we decide on new ORM.
  • The goqu package also provides some wrappers around database/sql,
    which we don't currently use. We could see if goqu could replace this
    package.

• github.com/lib/pq

  • Postgresql driver.
  • Already at latest release.
  • Replaced with https://github.com/jackc/pgx

• github.com/rubenv/sql-migrate

  • Schema migration thingy.
  • Could be updated, there are no releases, though.

• gopkg.in/mgutz/dat.v1

  • That's an ORM, basically.
  • Alternatives:
    • https://github.com/jinzhu/gorm
    • https://github.com/go-pg/pg
  • We went with https://github.com/doug-martin/goqu

The web framework packages:

• github.com/ymichael/sessions

  • Related to the goji framework, so see below

• github.com/zenazn/goji

  • A web framework.
  • So. Many. Web. Frameworks.
  • https://github.com/mingrammer/go-web-framework-stars

Other packages:

• github.com/aquam8/go-omaha

  • Should use github.com/coreos/go-omaha or our own fork.

• github.com/facebookgo/grace

  • Used only in the demo.
  • Consider making the demo a separate module maybe.

• github.com/google/go-github

  • Library for talking to github.
  • Needs updating.

• github.com/mgutz/logxi

  • A logging solution.
  • Use logrus or glog.

• github.com/stretchr/testify

  • Some testing helpers.
  • Already using the latest release.
  • Do we want to use something else?

• golang.org/x/oauth2

  • Client for oauth2.
  • There are no releases, could bump it to latest revision.

[krnowak]

Currently github.com/blang/semver can't be updated, because it is broken wrt go modules. We use v3.5.1, newest version is v3.6.1. v3.5.1 is the last version that does not specify the go.mod file. Once a project applies to become a go module and has version like v3.6.1, it should have a v3 package. So something like github.com/blang/semver/v3. There is already an issue about it: blang/semver#63.

[krnowak]

The https://github.com/google/go-github package provides support for v3 REST API, while github also supports a v4 GraphQL API, which can be used with https://github.com/shurcooL/githubv4. For now just updating the package. We can think about migrating to github v4 API later.

[krnowak]

The uuid library we use needs to be replaced too. It's unmaintained and has bugs - satori/go.uuid#103. There seem to be a replacement - https://github.com/gofrs/uuid (or we can use something else - https://github.com/google/uuid).

[krnowak]

I updated the list - we replaced dat with goqu, and pq with pgx. We could update github.com/blang/semver to github.com/blang/semver/v4, so it's go modules compatible. sqlx could likely be replaced with goqu.