Hacker News Reader

go.sum is not imports. It's a checksums file, it's used in determining which versions of things to pin to. It doesn't necessarily mean all of those things end up in the final binary. See https://go.dev/ref/mod#go-sum-files. You can run `caddy build-info` to see everything that is a dependency in the build. From my count, a vanilla build of Caddy v2.8.0 has 122 packages as dependencies (many of which are indirect).

View on HN

> You can run `caddy build-info`

Or just go version -m

> 122 packages

That's still a lot

> many of which are indirect)

That means literally nothing. Indirect still gets built, indirect still in the exe.

I think you underestimate how much a general purpose webserver needs to be able to do. Do you have any specific criticism about the list of dependencies? What do you think is actually unnecessary?

Not the original poster, but at a glance, oauth, sso, and a whole bunch of PostgreSQL(?!) packages stand out as surprising things to see in a web server.

If you actually run `caddy build-info`, you'll see that none of those are actually in the build. You can't just look at go.sum, like I explained above.

Reply on news.ycombinator.com