cc @bcmills @matloob

has your GOPROXY been explicitly set? it's non default and I believe that overrides GOPRIVATE (to allow you to use private proxies).

Oh, good catch. Though I think you meant GONOPROXY.

Oh yeah, good catch. I do that to mitigate VCS vulnerabilities. However, I would expect using GONOPROXY without direct in GOPROXY to be an error at most, not to silently ignore GONOPROXY.

https://go.dev/ref/mod#private-module-privacy explicitly says (emphasis mine)

The GOPRIVATE or GONOPROXY environment variables may be set to lists of glob patterns matching module prefixes that are private and should not be requested from any proxy.

and then it goes on to explain not to set GONOPROXY if you're using a private proxy.

I think heschi is correct in saying it's your GONOPROXY setting that's overriding it.

https://go.dev/ref/mod#private-modules :

GOPRIVATE — list of glob patterns of module path prefixes that should be considered private. Acts as a default value for GONOPROXY and GONOSUMDB.

with an explicit GONOPROXY="github.com/FiloSottile/*,filippo.io/*", the default value from GOPRIVATE isn't used.

@FiloSottile

https://go.dev/ref/mod#private-module-privacy explicitly says (emphasis mine)

You left out the very next sentence, which is key to the behaviors you observe here:

GOPRIVATE simply acts as a default for GONOPROXY and GONOSUMDB, so it’s not necessary to set GONOPROXY unless GONOSUMDB should have a different value.

That also matches https://go.dev/ref/mod#environment-variables:

Variable	Description
GOPRIVATE	Comma-separated list of glob patterns (in the syntax of Go's path.Match) of module path prefixes that should be considered private. GOPRIVATE is a default value for GONOPROXY and GONOSUMDB. See Privacy. GOPRIVATE also determines whether a module is considered private for GOVCS.

Because you have set GONOPROXY explicitly in the environment, that overrides the default set by GOPRIVATE.
Because c2sp.org does not match a pattern in GONOPROXY, it is fetched using your GOPROXY setting.

(The GOPRIVATE setting still affects GONOSUMDB and the interpretation of private: in GOVCS.)

As far as I can tell this is working as documented. It's unfortunate that the environment variables are this complex, but on the other hand I don't think most users are setting GONOPROXY at all.

@FiloSottile, do you want to file a proposal for a behavior change here? Is there something we could do to clarify the documentation? (I'd be happy to review a CL to clean up the docs.)

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)