Implicit runtime dependencies (with examples from core/go)



I am putting together a patch for our core/go plan and have stubled into a problem that is part practical and part philosophical. Here is the problem:

The go standard library has hard-coded paths to zoneinfo data. Those paths are incorrect on our minimal Habitat hosts:

This is easy enough to fix via a small patch, and the core/go plan already has examples where we patch in paths to files contained in habitat packages:

However, both my proposed fix for zoneinfo and the existing patch for cacerts have a problem. Namely, any app that is built with core/go now, technically, has an undeclared runtime dependency on core/cacerts (or core/zoneinfo or core/iana-etc). Any go application that fails to explicitly declare this dependency may fail at runtime.

Declaring the dependency is straightforward once you know it is there, but right now we don’t have anything that alerts the user to this situation. Thoughts?




Can we not just declare these dependencies in core/go to fix this?

Edit: No, because core/go is a build dep, not a runtime dep. Got it… Hmm!


This smells like a missing type of dependency. Like we need a way for core/go to say it needs zoneinfo and cacerts at runtime if it was used at build time.


The tricky thing is that a given use of core/go may not use those libraries. It would be a bummer to have to consume a runtime dependency for something you don’t need.