Skip to content

cmd/go/internal/get: add GOINSECURE support #38628

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

cmd/go/internal/get: add GOINSECURE support #38628

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c17a1a7
cmd/go/internal/get: add GOINSECURE support
witchard Apr 22, 2020
08657ed
Make logic in security check more robust, make tests more realistic.
witchard Apr 24, 2020
e298c00
Modified to use extracted MatchPrefixPatterns function.
witchard Aug 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion src/cmd/go/alldocs.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 11 additions & 7 deletions src/cmd/go/internal/get/get.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ import (
"cmd/go/internal/str"
"cmd/go/internal/web"
"cmd/go/internal/work"

"golang.org/x/mod/module"
)

var CmdGet = &base.Command{
Expand All @@ -41,7 +43,10 @@ The -fix flag instructs get to run the fix tool on the downloaded packages
before resolving dependencies or building the code.

The -insecure flag permits fetching from repositories and resolving
custom domains using insecure schemes such as HTTP. Use with caution.
custom domains using insecure schemes such as HTTP. Use with caution. The
GOINSECURE environment variable is usually a better alternative, since it
provides control over which modules may be retrieved using an insecure scheme.
See 'go help environment' for details.

The -t flag instructs get to also download the packages required to build
the tests for the specified packages.
Expand Down Expand Up @@ -409,11 +414,6 @@ func downloadPackage(p *load.Package) error {
blindRepo bool // set if the repo has unusual configuration
)

security := web.SecureOnly
if Insecure {
security = web.Insecure
}

// p can be either a real package, or a pseudo-package whose “import path” is
// actually a wildcard pattern.
// Trim the path at the element containing the first wildcard,
Expand All @@ -430,6 +430,10 @@ func downloadPackage(p *load.Package) error {
if err := CheckImportPath(importPrefix); err != nil {
return fmt.Errorf("%s: invalid import path: %v", p.ImportPath, err)
}
security := web.SecureOnly
if Insecure || module.MatchPrefixPatterns(cfg.GOINSECURE, importPrefix) {
security = web.Insecure
}

if p.Internal.Build.SrcRoot != "" {
// Directory exists. Look for checkout along path to src.
Expand Down Expand Up @@ -473,7 +477,7 @@ func downloadPackage(p *load.Package) error {
}
vcs, repo, rootPath = rr.vcs, rr.Repo, rr.Root
}
if !blindRepo && !vcs.isSecure(repo) && !Insecure {
if !blindRepo && !vcs.isSecure(repo) && security != web.Insecure {
return fmt.Errorf("cannot download, %v uses insecure protocol", repo)
}

Expand Down
29 changes: 29 additions & 0 deletions src/cmd/go/testdata/script/get_insecure_env.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
[!net] skip
[!exec:git] skip

# GOPATH: Set up
env GO111MODULE=off

# GOPATH: Try go get -d of HTTP-only repo (should fail).
! go get -d insecure.go-get-issue-15410.appspot.com/pkg/p

# GOPATH: Try again with invalid GOINSECURE (should fail).
env GOINSECURE=insecure.go-get-issue-15410.appspot.com/pkg/q
! go get -d insecure.go-get-issue-15410.appspot.com/pkg/p

# GOPATH: Try with correct GOINSECURE (should succeed).
env GOINSECURE=insecure.go-get-issue-15410.appspot.com/pkg/p
go get -d insecure.go-get-issue-15410.appspot.com/pkg/p

# GOPATH: Try updating without GOINSECURE (should fail).
env GOINSECURE=
! go get -d -u -f insecure.go-get-issue-15410.appspot.com/pkg/p

# GOPATH: Try updating with GOINSECURE glob (should succeed).
env GOINSECURE=*.go-get-*.appspot.com
go get -d -u -f insecure.go-get-issue-15410.appspot.com/pkg/p

# GOPATH: Try updating with GOINSECURE base URL (should succeed).
env GOINSECURE=insecure.go-get-issue-15410.appspot.com
go get -d -u -f insecure.go-get-issue-15410.appspot.com/pkg/p