The go compiler supports "go get" to download dependencies, but
it will download the latest version of dependencies from the git
repository of the dependency. This could lead to non-reproducable
builds, or the potential of dependency API changes (including
deprecated features) to break the build of packages.
The "dep" tool allows for a lockfile to be created, which captures
the git commit ID of dependencies, and can restore dependencies to
the captured state.
Since no binary package containing "dep" is currently available for
CentOS, we need to build it from source. This change adds the
source tarball download to the list of source tarballs to be
downloaded.
Change-Id: I0ff821d780326212a3fc4408a6225752c0e9a9f4
Story: 2004617
Task: 28525
Signed-off-by: Jason McKenna <jason.mckenna@windriver.com>
bb9b2dbb07