Hands-On Software Engineering with Golang

The Gopkg.lock file

The second file that gets generated by the dep tool when running either dep init or dep ensure is called Gopkg.lock. As you can probably tell by its extension, it is something that is not meant to be modified by end users.

The Gopkg.lock file stores a textual representation of the dep tool's constraint solver output. More specifically, it includes the complete list of dependencies, both direct and transient, that are required for compiling the project source code. Each dependency is pinned down to the particular commit identifier (for example, a Git SHA) that, according to the solver, satisfies all constraints that were supplied to it by the dep tool.

By committing the Gopkg.lock file to the VCS, the dep support in Go ...