The path returned for go-import with the query ?go-get=1 is wrong if the project is in internal visibility

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

During the build of a golang project in the CI, I have the following problem during build: (the error is about to get an internal dependency)

internal/svc/svc_windows.go:8:2: gitlab.***.local/test/libraries/libupdater@v0.0.0-20230119095336-942e37eb84c9: invalid version: git ls-remote -q origin in /go/pkg/mod/cache/vcs/c11f243fa7db94e81672200d3f43ee0abf8165017fbfc4cec7da8cb95329656f: exit status 128:
	remote: The project you were looking for could not be found or you don't have permission to view it.
	fatal: repository 'https://gitlab.***.local/test/libraries.git/' not found

We can see that the path Go is trying to get the library is wrong, that should be https://gitlab.***.local/test/libraries/libupdater.git instead of https://gitlab.***.local/test/libraries.git/.

I have looked at several issues discussed that have been closed, and I have not found any current issue reporting the problem.

After a little research, I found that, the information given by the repository URL with ?go-get=1 is wrong when the project is set to both internal or private visibility:

The bug

Informations:

  • gitlab.***.local/test/libraries is a public group
  • gitlab.***.local/test/libraries/libupdater is an internal go project (with go.mod)

Visibility Internal/Private for the project libupdater:

M:\>curl -k -n https://token:***@gitlab.***.local/test/libraries/libupdater?go-get=1

<html>
  <head>
    <meta 
      name="go-import" 
      content="gitlab.***.local/test/libraries git https://gitlab.***.local/test/libraries.git"
    >
    <meta 
      name="go-source" 
      content="gitlab.***.local/test/libraries 
               https://gitlab.***.local/test/libraries 
               https://gitlab.***.local/test/libraries/-/tree/master{/dir} 
               https://gitlab.***.local/test/libraries/-/blob/master{/dir}/{file}#L{line}"
    >
  </head>
  <body>
    go get https://gitlab.***.local/test/libraries
  </body>
</html>

The result returned when the project is internal or private is wrong in that the content elements have removed any reference to libupdater.

Internal

In the picture above, we have the same result without access an token

Visibility Public for the project libupdater:

M:\>curl -k -n https://token:***@gitlab.***.local/test/libraries/libupdater?go-get=1

<html>
  <head>
    <meta 
      name="go-import" 
      content="gitlab.***.local/test/libraries/libupdater git https://gitlab.***.local/test/libraries/libupdater.git"
    >
    <meta 
      name="go-source" 
      content="gitlab.***.local/test/libraries/libupdater 
               https://gitlab.***.local/test/libraries/libupdater 
               https://gitlab.***.local/test/libraries/libupdater/-/tree/master{/dir} 
               https://gitlab.***.local/test/libraries/libupdater/-/blob/master{/dir}/{file}#L{line}"
    >
  </head>
  <body>
    go get https://gitlab.***.local/test/libraries/libupdater
  </body>
</html>

The result returned when the project is public is correct.

Public

In the picture above, we have the same result without access token

Expected behavior

I think that the visibility must not change which part is returned for go-import; it must return the exact path of the repository in both cases.

Informations about my infrastructure:

  • Gitlab self-hosted
  • Gitlab version: 15.7.5-ee
  • Runner version: 15.5.1
  • Golang version: 1.19

I've had the problem for a while and never knew how to solve it except by doing a replace in the go.mod, which is obviously not practical.

Edited by 🤖 GitLab Bot 🤖