156 Imports, Zero Elsewhere: What It Actually Takes to Prove a Go Program Has No Dependencies

Description and use

Bareport proved zero third‑party dependencies with a two‑phase build‑time snapshot and runtime self‑audit, satisfying the hackathon’s zero‑dependency requirement.

Problem

Claiming a Go program has zero third‑party runtime dependencies is easy to state but hard to prove; many projects rely only on a short go.mod and never verify the import graph on other machines.

Outcome

Bareport now reliably proves it has no third‑party runtime dependencies on any machine, satisfying the zero‑dependency claim and passing all integration tests.

Workflow

• 1. Run make selfaudit-manifest to generate selfaudit/manifest_generated.go containing the import graph and stdlib list.
• 2. Build the binary; the generated file is embedded via //go:embed.
• 3. Execute the binary with --verify-zero-dep to trigger the self‑audit function.
• 4. The function iterates over ownImports, checks against the embedded stdlib set, and reports any external imports.
• 5. If the report shows zero outside stdlib imports, the binary is verified as zero‑dependency.

Evidence

go list -m all bareport returns exactly one line

Source

bareport --verify-zero-dep outputs imports walked: 156 outside stdlib: 0 VERIFIED

Source