How to vendor our dependencies?

[mbertschler]

@spf13 What process should we use to vendor our dependencies?

Now that Go 1.6 is released and vendoring is enabled by default we should use something that uses the /vendor subdirectory approach. Should we use a tool for that or just make a subtree merge with squashed commits?

The reason why we should vendor is for example this issue: #59

[xor-gate]

This option is also available for Go 1.5 when enable manually. I don't know which version we should support as minimal ? I tried myself on Go 1.6 and it seems to work perfectly without the need for external tools.

[victpork]

Hi when trying to pass the PR #154 found out that CI could not compile for Go 1.7.5, and found that the guys at sftp package already dropped support for versions below 1.8. We should start using dependency management tool ASAP. I suggest we should use dep and check in the vendor directory.

[0xmichalis]

go modules are used now