In the meantime, replace directive is being of great help indeed for end-projects.

replace git.apache.org/thrift.git => github.com/apache/thrift v0.12.0

to avoid such issues on this end

What's this end?

We're not seeing any problems, but our build system is using https://proxy.golang.org/ which has the data:

https://proxy.golang.org/go.opencensus.io/@v/v0.12.0.zip
https://proxy.golang.org/git.apache.org/thrift.git/@v/v0.0.0-20180902110319-2566ecd5d999.zip

And I don't even see it as a dependency of ours:

bradfitz@go:~/src/golang.org/x/build$ go mod why git.apache.org/thrift.git
# git.apache.org/thrift.git
(main module does not need package git.apache.org/thrift.git)

/cc @jayconrod @dmitshur

No, x/build is not directly dependant on git.apache.org/thrift.git, it is dependant on go.opencensus.io v0.18.0 (from https://github.com/golang/build/blob/master/go.mod) which in turn is dependant on git.apache.org/thrift.git (and more recent opencensus versions are not using that host, rather github directly).

Problems are not always present, but sometimes they do manifest themselves and it is perfectly noticable in CI history, when git.apache.org failing to provide working proxy to github repo.

As for go mod why, here is graph In master x/build repo:

$ go mod graph | grep ' git.apache.org'      
go.opencensus.io@v0.18.0 git.apache.org/thrift.git@v0.0.0-20180902110319-2566ecd5d999
$ go mod graph | grep ' go.opencensus.io@v0.18.0'
golang.org/x/build go.opencensus.io@v0.18.0

But only go.opencensus.io/exporter/jaeger uses thrift, and we don't use that part of opencensus.

So what's the problem?

How is this affecting you?

It's not affecting us (yay caching module proxy), so what's the bug?

Updating to go.opencensus.io@v0.21.0 module sounds reasonable.

It's an indirect module requirement, so it'll be a larger change and we should review the end result to make sure it doesn't introduce any problems.

It is affecting me in my CI builds, when I am building my grpc projects in CI pipeline (no caches there).
And it goes as this:

google.golang.org/grpc depends on cloud.google.com/go, which depends on golang.org/x/build, which depends on go.opencensus.io which (in <v0.20.0) depends on git.apache.org/thrift.git which causes CI builds to fail from time to time because git.apache.org/thrift.git could not be fetched by go get/go build/go install.

google.golang.org/grpc depends on cloud.google.com/go, which depends on golang.org/x/build, [...]

Which version of grpc? I know that versions v0.37.4 and newer of cloud.google.com/go no longer require golang.org/x/build at all, so if you update to a version of grpc that requires cloud.google.com/go@v0.37.4 or later, your problem will be resolved.

It sounds like doing anything on master branch of x/build will not help your situation directly, since you're requiring a specific version of grpc which in turn will continue to require the same old version of x/build. You'll need to update your dependencies.

google.golang.org/grpc@v1.20.1 still depends on cloud.google.com/go@v0.26.0.

It is good to know that recent cloud.google.com/go versions are not importing x/build, I could go to grpc project already indeed, not having to work all my way up before that, however I think updating opencensus dependency here would not harm too.

FYI: updating grpc dependencies also wasn't required.

grpc depends on cloud.google.com/go@v0.26.0 which is non-go module, so it has no listed dependencies outside of that packages use directly.

My actual offending chain was github.com/golang-migrate/migrate/v4 v4.3.0 -> github.com/fsouza/fake-gcs-server v1.5.0 -> cloud.google.com/go v0.36.0

Updating github.com/golang-migrate/migrate/v4 to v4.3.1 seem to solve my underlying issue.

Still, having transitive dependencies featuring no longer officially used domain names, might be considered problematic (should any present or future project actually depend on x/build knowing what they are doing).

Change https://golang.org/cl/175139 mentions this issue: go.mod: update cloud.google.com/go dep, run go mod tidy