Lock binary dependencies to specific commits

Pulling revisions was relegated to scripts/get_tools.sh
The solution there isn't that elegant, but it works.
A more elegant + clean solution would be using python, but
we probably don't want to introduce that as a dependency.

I think we can leave it right now as a shell file with redundant
code, and improve the build process #postlaunch.

The linters which gometalinters are versioned according to gometalinters
install.sh. Its not locking to commit (AFAIK), but I think this is fine
as that is purely dev tooling and doesn't affect the code.

Closes #2238

CHANGELOG_PENDING.md

@@ -36,6 +36,7 @@ IMPROVEMENTS:
 - [consensus] [\#2169](https://github.com/cosmos/cosmos-sdk/issues/2169) add additional metrics
 - [p2p] [\#2169](https://github.com/cosmos/cosmos-sdk/issues/2169) add additional metrics
 - [config] \#2232 added ValidateBasic method, which performs basic checks
+- [tools] \#2238 Binary dependencies are now locked to a specific git commit
 
 BUG FIXES:
 - [autofile] \#2428 Group.RotateFile need call Flush() before rename (@goolAdapter)

Makefile

@@ -1,7 +1,7 @@
 GOTOOLS = \
 	github.com/mitchellh/gox \
 	github.com/golang/dep/cmd/dep \
-	gopkg.in/alecthomas/gometalinter.v2 \
+	github.com/alecthomas/gometalinter \
 	github.com/gogo/protobuf/protoc-gen-gogo \
 	github.com/square/certstrap
 PACKAGES=$(shell go list ./...)
@@ -75,11 +75,12 @@ check_tools:
 
 get_tools:
 	@echo "--> Installing tools"
-	go get -u -v $(GOTOOLS)
-	@gometalinter.v2 --install
+	./scripts/get_tools.sh
+	@echo "--> Downloading linters (this may take awhile)"
+	./../../alecthomas/gometalinter/scripts/install.sh -b $(GOBIN)
 
 update_tools:
-	@echo "--> Updating tools"
+	@echo "--> Updating tools to their latest versions, not the recommended versions"
 	go get -u -v $(GOTOOLS)
 
 #Update dependencies
@@ -224,7 +225,7 @@ fmt:
 
 metalinter:
 	@echo "--> Running linter"
-	@gometalinter.v2 $(LINT_FLAGS) --disable-all  \
+	@gometalinter $(LINT_FLAGS) --disable-all  \
 		--enable=deadcode \
 		--enable=gosimple \
 	 	--enable=misspell \
@@ -253,7 +254,7 @@ metalinter:
 
 metalinter_all:
 	@echo "--> Running linter (all)"
-	gometalinter.v2 $(LINT_FLAGS) --enable-all --disable=lll ./...
+	gometalinter $(LINT_FLAGS) --enable-all --disable=lll ./...
 
 DESTINATION = ./index.html.md
 

scripts/get_tools.sh

@@ -0,0 +1,55 @@
+# This file downloads all of the binary dependencies we have,
+# and checks out a specific git hash.
+#
+# repos it installs:
+# github.com/mitchellh/gox
+# github.com/golang/dep/cmd/dep
+# gopkg.in/alecthomas/gometalinter.v2
+# github.com/gogo/protobuf/protoc-gen-gogo
+# github.com/square/certstrap
+
+cd $GOPATH/src/github.com
+
+## install gox
+mkdir -p mitchellh
+cd mitchellh
+if cd gox; then git fetch origin; else git clone https://github.com/mitchellh/gox.git; cd gox; fi
+git checkout -q 51ed453898ca5579fea9ad1f08dff6b121d9f2e8
+go build
+cd ../../
+
+## install dep
+mkdir -p golang
+cd golang
+if cd dep; then git fetch origin; else git clone https://github.com/golang/dep.git; cd dep; fi
+git checkout -q 22125cfaa6ddc71e145b1535d4b7ee9744fefff2
+cd cmd/dep
+go build
+cd ../../../../
+
+## install gometalinter
+mkdir -p alecthomas
+cd alecthomas
+if cd gometalinter; then git fetch origin; else git clone https://github.com/alecthomas/gometalinter.git; cd gometalinter; fi
+git checkout -q 8edca99e8a88355e29f550113bcba6ecfa39ae11
+go build
+cd ../../
+
+## install protoc-gen-gogo
+mkdir -p gogo
+cd gogo
+if cd protobuf; then git fetch origin; else git clone https://github.com/gogo/protobuf.git; cd protobuf; fi
+git checkout -q 61dbc136cf5d2f08d68a011382652244990a53a9
+cd protoc-gen-gogo
+go build
+cd ../../../
+
+## install certstrap
+mkdir -p square
+cd square
+if cd certstrap; then git fetch origin; else git clone https://github.com/square/certstrap.git; cd certstrap; fi
+git checkout -q e27060a3643e814151e65b9807b6b06d169580a7
+go build
+cd ../../
+
+cd $GOPATH/src/github.com/tendermint/tendermint