syzkaller: switch to -mod=mod?

[a-nogikh]

Our vendor/ folder keeps growing: now it contains ~5.6k files out of the ~10k we have in total. Once merged, #5620 would add many more.

Is it time to switch from -mod=vendor to -mod=mod and remove the vendor folder?

Starting from Go 1.13, GOPROXY is set to https://proxy.golang.org/ by default. With that proxy, we would no longer need to worry that some of our dependencies might become unavailable (or compromised) over time. Also, we'd be less affected by the temporary inaccessibility of the hosts, from which we would otherwise have to download the modules directly - the official mirror would be the only vital dependency.

As I understand, the modules are cached locally anyway, so not having the vendor folder should not cause any problems during local development (provided that syz-env persists the Go cache between invocations).

A more concerning issue is what will be happening on our GitHub CI - it's best to avoid having to download all the dependencies for each ci / * test after each git push.

• Is there a way to share the cache between our self-hosted runners?
• We could run go mod download in syz-env's Dockerfile. They will eventually be out of sync, but that'd still prevent the majority of module downloads.