156 Imports, Zero Elsewhere: What It Actually Takes to Prove a Go Program Has No Dependencies

说明与用途

Bareport 通过两阶段构建时快照和运行时自审，证明其无第三方依赖，满足零依赖挑战赛要求。

问题

Claiming a Go program has zero third‑party runtime dependencies is easy to state but hard to prove; many projects rely only on a short go.mod and never verify the import graph on other machines.

结果

Bareport now reliably proves it has no third‑party runtime dependencies on any machine, satisfying the zero‑dependency claim and passing all integration tests.

工作流

• 1. Run make selfaudit-manifest to generate selfaudit/manifest_generated.go containing the import graph and stdlib list.
• 2. Build the binary; the generated file is embedded via //go:embed.
• 3. Execute the binary with --verify-zero-dep to trigger the self‑audit function.
• 4. The function iterates over ownImports, checks against the embedded stdlib set, and reports any external imports.
• 5. If the report shows zero outside stdlib imports, the binary is verified as zero‑dependency.

证据

go list -m all bareport returns exactly one line

来源

bareport --verify-zero-dep outputs imports walked: 156 outside stdlib: 0 VERIFIED

来源