Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: try https before git/svn/hg protocol? #6489

Closed
msiebuhr opened this issue Sep 26, 2013 · 10 comments
Closed

cmd/go: try https before git/svn/hg protocol? #6489

msiebuhr opened this issue Sep 26, 2013 · 10 comments

Comments

@msiebuhr
Copy link
Contributor

What steps will reproduce the problem?
1. Start a local HTTP server on a non-standard port, ex via python: `python -m
SimpleHTTPServer 8080`
2. Pretend it is a HTTP git server and 'go get' a package: `go get -x
127.0.0.1:8080/something.git`
3. go get hangs

What is the expected output?
- The server should check out the git repository on the HTTP server

What do you see instead?
Go get will tries to clone the repository over the plain-text git protocol, but will get
a HTTP error response back - which doesn't make git back out immediately.

Instead it hangs for a very long time (presumably till the TCP connection times out).

(The interaction can be seen from git's point of view with `GIT_TRACE_PACKET=1 git
ls-remote git://127.0.0.1:8080/foo.git`)

Which version are you using?  (run 'go version')

> go version
go version go1.1.2 darwin/amd64

(The relevant source hasn't been touched in TIP)

Please provide any additional information below.

The error seem to be in go trying out git:// first. But as git is apparently very
tolerant with unexpected server responses, it results on odd overall behaviour. I
suspect a solution could be to re-order the protocols in
https://code.google.com/p/go/source/browse/src/cmd/go/vcs.go#107 so git:// comes last.
@msiebuhr
Copy link
Contributor Author

Comment 1:

After digging around and trying various combinations out with combinations of servers,
https / http / git / git+ssh seem to be the only combination that works when thrown
after a http, git and git+ssh-server, respectively.
I have submitted a patch to that effect at https://golang.org/cl/14026043/

@adg
Copy link
Contributor

adg commented Sep 27, 2013

Comment 2:

I'm not sure we *want* to support this. On Windows,":" is a special character that
cannot appear in file names[1]. And on Unix machines it has a different meaning as a
path list separator. I don't want to see import paths with ":port" in them.
If you do need to serve content on a non-standard port, you should use the go-import
META tag trick[2].
1. http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx
2. http://golang.org/cmd/go/#hdr-Remote_import_path_syntax

Status changed to Thinking.

@msiebuhr
Copy link
Contributor Author

Comment 3:

Hadn't thought of the resulting path validity issues. Bugger.
I ran into this bug while experimenting with a 'go get' proxy with some
git-versioning-trickery, so I can get consistent builds. Using standard ports means
running my test-code as root, which I don't particularly fancy.
Secondly, it might be considered a security-issue that it tries out non-secure options
(that even defaults to a non-privileged port) before at least attempting over a secure
protocol.

@adg
Copy link
Contributor

adg commented Sep 30, 2013

Comment 4:

"go get" doesn't have to be the be-all end-all here. Just write a tool that produces the
tree you need.
That's true about the insecurity angle. We should probably try https first.

@rsc
Copy link
Contributor

rsc commented Nov 27, 2013

Comment 5:

Labels changed: added go1.3maybe.

@rsc
Copy link
Contributor

rsc commented Dec 4, 2013

Comment 6:

Labels changed: added release-none, removed go1.3maybe.

@rsc
Copy link
Contributor

rsc commented Dec 4, 2013

Comment 7:

Labels changed: added repo-main.

@gopherbot
Copy link

Comment 8:

CL https://golang.org/cl/14026043 references this issue.

@gopherbot
Copy link

Comment 9:

CL https://golang.org/cl/14026043 references this issue.

@msiebuhr
Copy link
Contributor Author

msiebuhr commented Dec 4, 2016

Seem to be irrelevant now go get -insecure is a thing.

(Haven't looked much at the code or docs; just figured this might be cleanup-worthy now.)

Edit: From the discussion over at #9637, this definitely looks obsolete.

@msiebuhr msiebuhr closed this as completed Dec 4, 2016
@golang golang locked and limited conversation to collaborators Dec 4, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants