Change https://golang.org/cl/142678 mentions this issue: cmd/go/internal/get: fix go get for Azure DevOps Git repos

@FiloSottile, it would be nice to say what the decision is when you add the NeedsDecision label.

Note that GitHub generates the <meta> tags that the go command needs, so that GitHub-hosted code works with go get regardless of domain (e.g., GitHub Enterprise, although github.com has the tags too). At this point it would be nice if hosting sites like dev.azure.com would put the tags in and therefore own their meaning, instead of making the go project source code the source of truth. (That made sense early on when no one had heard of Go and not many sites cared.)

thanks @rsc - meta tags on the Azure side is definitely another solution route, although due to the .../_git/... in the URLs, it would be more involved than MS just adding these to the existing address. Azure could, or I could, host vanity URLs with the meta tags pointing to the existing repo URLs but this is starting to get more involved and I'd really appreciate a simpler solution.

Just adding the links to the issues on the Azure DevOps side:

• https://visualstudio.uservoice.com/forums/330519-visual-studio-team-services/suggestions/34888885-support-repos-for-golang-by-providing-a-url-alias
• https://visualstudio.uservoice.com/forums/330519-azure-devops-formerly-visual-studio-team-services/suggestions/20364613-add-golang-support-to-vsts-git

to indicate that the mismatch between Azure DevOps and Go is a real problem for developers that have no choice but to use Azure DevOps, but want to champion Go.

@FiloSottile, it would be nice to say what the decision is when you add the NeedsDecision label.

Will do. In this instance I'd like an owner of cmd/go to decide if we are still expanding the special case mappings, and if so what transformations should be applied to this one, as it seems to be the only one that magically adds a component to the path.

For the record, I do believe adding <meta> tags at the desired path would serve Azure DevOps best, providing them with more control, flexibility (no issues with adding path components at the right spot) and probably compatibility as there might be tools that extracted the mappings from an existing version of Go (although they should use the go tool instead).

@bketelsen perhaps you could add your experience, thanks.

@rsc Whilst I think it would be a good idea for dev.azure.com to add tags, even if they did, I don't think that would solve the problem. As @MrWako says, because dev.azure.com repository paths have a .../_git/... in them go get results in folders that start with an underscore. One solution to this problem would be to "fix" the go tooling like go list so that it can handle folders that start with an underscore but it seems like an easier solution is to change go get. With the added benefit of getting cleaner import paths for dev.azure.com repositories.

It might be a hard sell to convince MS to host vanity urls for dev.azure.com repositories because of the way go tooling handles folders that start with an underscore, although we are trying.

To be clear I'm not suggesting having import paths with _git in them, but serving meta tags from https://dev.azure.com/markawakefield/GoGetTest/app[/*] pointing to https://dev.azure.com/markawakefield/GoGetTest/_git/app.

@FiloSottile I doubt MS will be able to serve pages at those exact urls as they might conflict with other pages, for example there already pages like https://dev.azure.com/markawakefield/GoGetTest/_workitems, https://dev.azure.com/markawakefield/GoGetTest/_build.

If they all start with _ they shouldn't ever conflict with Go import paths. Also, the meta tag is not user visible, so it can be served on any page, even unrelated, to describe the import path to repository mapping.

Anyway, I'm not the relevant owner, I was just suggesting that meta tags would be a solution that MS can control, deploy independently, and it would be backwards compatible instead of only working with Go 1.12 and with tools that didn't hardcode the existing set.

What is the name space under (say) dev.azure.com/markawakefield/GoGetTest? What kinds of names can appear after the underscore?

Unless Go users really want to see _git in their import paths, the fix here should really be on dev.azure.com's side.

Hi @rsc names that can appear after the underscore are basically all the kinds that Azure has for its task tracking/development process, so things like _workitems (for you assigned workitems), _sprints (for sprint related views), _boards (for kanban-ish views), etc.

Thanks all, this has been a healthy discussion, how do we try and get to a decision?

• if the PR was to be accepted thats great and would be an easy way forward for Azure Go programmers
• if not, then I well understand the arguments and at least we've explored and discounted the option. Either Azure can pick up the challenge or communicate that its up to developers to address.

Coming to a decision is probably nearly as important than what the decision is so that I can make plans what to do next. Thanks,

@rsc, @FiloSottile I think perhaps for historical reasons, they also serve pages (or redirect) if you put the name of a project team after the name of the project. For example: dev.azure.com/crsdrw/GoGetTest/BackendTeam/_git/app

I'm a Program Manager for Azure DevOps. We've had this request several times over the past few years and I'd love if we could come to a solution for our Go users.

While meta tags don't exist for Azure DevOps, adding those alone will not solve the problem. As others have noted, the crux of the issue is the presence of "_git" in the URLs. We use "_git" as a marker for routing, along with other markers like "_workitems", _dashboards", etc. Our Git URLs specify organization, project, and repo, but have also historically included team name with some of those components being optional (or omitted) if they are identical. Our Git URLs also require "_git" (except for SSH, but I believe that go git doesn't support SSH?).

What is the name space under (say) dev.azure.com/markawakefield/GoGetTest? What kinds of names can appear after the underscore?

@rsc There is a fixed set of names that can come after an underscore (e.g. _git, _workitems, _builds); project names cannot start with an underscore.

To be clear I'm not suggesting having import paths with _git in them, but serving meta tags from https://dev.azure.com/markawakefield/GoGetTest/app[/*] pointing to https://dev.azure.com/markawakefield/GoGetTest/_git/app.

@FiloSottile Unfortunately, this won't work. This scheme matches https://dev.azure.com/{organization}/{project}/{team-name} and redirects to the dashboards directory page: https://dev.azure.com/{organization}/{project}/_dashboards/directory?teamId={team-name}. We've looked at other formats but we run into collisions without "_git".

It sounds like the hesitation is around adding another special case mapping to cmd/go? Is there more information that I could provide that might make a decision on this easier?

This scheme matches https://dev.azure.com/{organization}/{project}/{team-name} and redirects to the dashboards directory page: https://dev.azure.com/{organization}/{project}/_dashboards/directory?teamId={team-name}. We've looked at other formats but we run into collisions without "_git".

I'm not sure I understand. You're in control of the meta tags, can't you just not serve a tag at https://dev.azure.com/{organization}/{project}/_dashboards/...?

If there is no way to map a space without underscores to the correct repositories, then doing the mapping in cmd/go won't help, and you need underscores in import paths, which will break many things we don't have control over. If there is a way to do such a mapping, you can do it by serving meta tags just as well as we can do it in cmd/go, and it will be more backwards compatible, better serving our shared users.

Sorry but it's too late now for Go 1.12. Moving to the Go 1.13 queue and marking as a proposal.

The original report and associated blog post note that one of the blockers to using <meta> tags is that those endpoints require authentication. Note that we now have a design for HTTPS authentication for Go 1.13: #26232 (comment).

It's not clear to me why there would be an issue with redirects: why can't the server either suppress the redirect when it sees the go-get=1 query parameter, or serve the meta tags on the redirected page for all of the import paths that redirect to it?

Right, I thought the PR was to add the meta tag to the Azure DevOps git page so .git wasn't needed. Maybe I misunderstood.

Adding a go-import meta tag to AzDO should fix that.

Unfortunately private repos will always require some auth workaround since we weren't able to intercept the page before the redirect.

I see, thanks for the additional information!

No problem. We want to work on getting "_git" out of the url and merging the original PR for this issue to remove ".git" as well, but those are coming in behind some other higher priority items on the backlog. Eventually we hope to have parity with existing vanity url services.

Can you please provide us estimated timeline when it will be fixed.

If you get a 410 gone error with the PAT solution in .gitconfig:

go: finding dev.azure.com/<org>/<project>/_git/<project>.git latest
go: finding dev.azure.com/<org>/<project>/_git/<project>.git/protos latest
go: downloading dev.azure.com/<org>/<project>/_git/<project>.git v0.0.0-20191007171928-c6a8ebcd1fa5
verifying dev.azure.com/<org>/<project>/_git/<project>.git@v0.0.0-20191007171928-c6a8ebcd1fa5: dev.azure.com/<org>/<project>/_git/<project>.git@v0.0.0-20191007171928-c6a8ebcd1fa5: reading https://sum.golang.org/lookup/dev.azure.com/<org>/<project>/_git/<project>.git@v0.0.0-20191007171928-c6a8ebcd1fa5: 410 Gone

Its reading from sum.golang.org, which does not exist there obviously (it s private).

Setting GOPRIVATE (https://golang.org/cmd/go/#hdr-Module_configuration_for_non_public_modules) to dev.azure.com will download the repo in the mod folder.

Sorry, maybe probably off topic too, but if you are here due to authentification issues sync'ing with Azure DevOps repos with go get, e.g. on a build machine then you can setup a simple git credential helper in your gitconfig file: e.g:

[credential "https://dev.azure.com"]
	helper = "/bin/sh /etc/azure-devops-helper.sh"

with azure-devops-helper.sh something like

#!/bin/sh
echo username=$USERNAME
echo password=$AZURE_DEVOPS_TOKEN

where environment variables containing the username and PAT taken. This proved more reliable for us than switching to SSH for azure repos.

Reopening due to resumed discussion in #41030.

@brkerr Is there any update on the state of affairs here? I think if we can get some clarity on the reason as to why adding the <meta> tags would not be feasible on ADOs end we could justify hardcoding the entry in cmd/go/internal/get. Is the main blocker the auth redirect?

For us the last remaining issue is having to specify .git in our paths.

👋 hey folks, I'm the product manager for Azure Repos server. I got clued into this thread because users are now reporting that our documentation for using go get with Azure Repos isn't working anymore, such as MicrosoftDocs/azure-devops-docs#9250.

Brandon added the meta tags back in 2019, and we still serve them. (He's moved on from the product team so I won't bug him here.) I'm hitting our Git protocol endpoint with ?go-get=1 appended to it and see this in the resulting <head>:

<meta name="go-import"
      content="dev.azure.com/mattc-demo/Test1/_git/playground git https://dev.azure.com/mattc-demo/Test1/_git/playground">

Does that look correct for a Git URL https://mattc-demo@dev.azure.com/mattc-demo/Test1/_git/playground?

For private projects, you have to present auth before we'll serve any content other than a redirect, and I probably can't change that. It looks like there was an (abandoned) effort to support our URL formats here. Is anyone willing to resurrect that change and land it?

Alternatively, or in addition, if someone can advise me on what we can fix in that doc, I'd also be happy to make the changes.

Thanks!

@vtbassmatt Thank you.

For us, for private repos is not working.

@bcmills So based on @vtbassmatt comment - it seems as though the reason why Go is not recognising private ADO repositories as git repos is that an auth redirect is presented before other content and therefore <meta> tags on the repo itself isn't having the desired effect.

So it seems to me as though the two options are:

1. Hardcoded entry in Go as in this PR or cmd/go/internal/get: add support for go get in azure devops repos #41031
2. tag on auth (which I don't think makes as much sense)

@artbegolli, @vtbassmatt: the go command should be sending credentials from the user's .netrc file. (See https://golang.org/ref/mod#private-module-proxy-auth, but I notice that we have not yet fully documented the use of .netrc credentials for servers other than module proxies. We should fix that.)

Is that not happening, is the server serving the auth redirect (or failing to serve the go-import <meta> tags) despite valid credentials, or is there something else going on?

Over here we are not using a proxy.
Still not working.

We keep getting no go-import meta tags ()) when doing go get.

We tried all the solutions suggested in this thread with no luck.

@JoseFMP, are you using credentials from a .netrc file, as mentioned in my previous comment?

@bcmills I tried using .netrc as well as other authentication ways here and there, including the ones in https://docs.microsoft.com/en-us/azure/devops/repos/git/go-get?view=azure-devops with no luck so far for private repos. For public works fine.

In private repos I keep getting:

josem@rabbit:~$ go get dev.azure.com/myorg/myproject/pulsaradapter.git@1073
go: downloading dev.azure.com/myorg/myproject/pulsaradapter.git v0.0.0-20201211023249-f2b661c7768f
go get dev.azure.com/myorg/myproject/pulsaradapter.git@1073: dev.azure.com/myorg/myproject/pulsaradapter.git@v0.0.0-20201211023249-f2b661c7768f: verifying module: dev.azure.com/myorg/myproject/pulsaradapter.git@v0.0.0-20201211023249-f2b661c7768f: reading https://sum.golang.org/lookup/dev.azure.com/myorg/!myproject/pulsaradapter.git@v0.0.0-20201211023249-f2b661c7768f: 410 Gone
        server response:
        not found: dev.azure.com/myorg/myproject/pulsaradapter.git@v0.0.0-20201211023249-f2b661c7768f: invalid version: git fetch -f origin refs/heads/*:refs/heads/* refs/tags/*:refs/tags/* in /tmp/gopath/pkg/mod/cache/vcs/2af3f2ae10b32b5e53fd191e041fc1e3751ac7b215c92b3d0b823915f73813be: exit status 128:
                fatal: unable to connect to dev.azure.com:
                dev.azure.com[0: 13.107.42.20]: errno=Connection refused
                dev.azure.com[1: 2620:1ec:21::20]: errno=Connection refused

401 Gone ===> What is this supposed to mean?
Then exist status 128: Unable co to connect to dev.azure.com

Sorry, maybe probably off topic too, but if you are here due to authentification issues sync'ing with Azure DevOps repos with go get, e.g. on a build machine then you can setup a simple git credential helper in your gitconfig file: e.g:

[credential "https://dev.azure.com"]
	helper = "/bin/sh /etc/azure-devops-helper.sh"

with azure-devops-helper.sh something like

#!/bin/sh
echo username=$USERNAME
echo password=$AZURE_DEVOPS_TOKEN

where environment variables containing the username and PAT taken. This proved more reliable for us than switching to SSH for azure repos.

Silly question here. What's supposed to be in USERNAME var ?

Solved now... needed to tell explicitly in GOPRIVATE to not to check checksums of dev.azure.com .

It seems it was really only that.