Review dependencies and remove the ones without concrete tag

[masih]

There are quite a few "wild" dependencies in Lotus go module; ones that:

• have no concrete tag.
• have unclear cost/benefit.

• Review the dependencies without concrete tag.
• Remove them if possible in cases where the usage is minimal and better alternatives exist.
• Cut a tag or upgrade anything else that's hard to get rid of.

This issue is done when there are no wild dependencies in Lotus go mod, or there is a comment above the ones we can't get rid of explaining why.

[BigLep]

@masih : I agree this would be done. To ensure we don't backslide or make the problem worse, I think we need to do #7131

[rjan90]

Posting here since it came up in a review/comment: Check if we can get rid of the filecoin-ffi dependency in the require section in the go.mod file:

lotus/go.mod

Lines 40 to 41 in d017c15

	github.com/filecoin-project/filecoin-ffi v1.28.0-rc2
	github.com/filecoin-project/go-address v1.1.0

Since we already ask it to use the local directory

lotus/go.mod

Lines 13 to 14 in d017c15

	replace github.com/filecoin-project/filecoin-ffi => ./extern/filecoin-ffi // provided via a git submodule

Edit

Got my answer here: #12524 (comment)

[rjan90]

Idea is to get all dependencies to be on a tag, and clean up the dependency tree. I will put this up on the Hacking Topic Item Proposals for Bangkok.