Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.Sign up
cmd/go: module-mode import path check is more restrictive than GOPATH mode #29101
As of #18660,
We should resolve that difference, ideally by defining a filesystem-safe encoding for all paths currently accepted in
To be more precise, #18660 was about allowing Unicode letters within the "subdir" part of github.com import paths like "github.com/user/repo/subdir" (but not within "user" or "repo" parts).
To my knowledge, Unicode letters were allowed in vanity import paths since Go 1 or close to thereof. I tried Go 1.2.2 just now (the oldest release with binaries at https://golang.org/dl/), and it doesn't reject Unicode letters in a vanity import path:
Following up here as requested in @rsc's comment on golang.org/cl/212198.
I'm not sure what we did historically, but it looks like now, we do two checks when go-getting in GOPATH mode: first, we call
As I understand from reading the code, the
There are a lot of issues to solve once we start allowing Unicode.
Let's make import path elements checked with pathOK starting at the beginning of the Go 1.16 cycle. If a very important existing package comes up we can reconsider.
Some more context: I'm looking into doing this as the Go 1.16 tree has opened, but it's not clear which path to take:
GOPATH mode lets through unicode letters in github import paths, so using pathOK to check import paths will break users in GOPATH mode using these repos.
In module mode, the proxy disables non-ASCII unicode letters, but if
So the question is do we just want to disable these paths in module mode, or for both module and GOPATH mode. Disabling them for module mode sounds like a reasonable idea because these modules can't be used with the proxy, but there might be GOPATH users we'd be breaking.
I'm going to try to see if I can find a GitHub index I can search through to see if any repos with go files in directories with non-ASCII unicode letters actually exist.
This pulls in golang.org/cl/250920 which rejects Windows shortnames as path components in module.CheckImportPath (as is already done in cmd/go/internal/get's copy of CheckImportPath). This will allow us to replace the copy of CheckImportPath with the original. This also pulls in golang.org/cl/250919 which rejects + in CheckPath and CheckImportPath, and golang.org/cl/235597, which adds methods to the zip package for gorelease, but shouldn't affect cmd. This change also updates the cmd/go test case TestScript/mod_bad_filenames to reflect that golang.org/x/mod/zip error messages now include filenames for bad file names that can't be included in zip archives. Updates #29101 Change-Id: I7f654325dc33b19bc9c6f77a56546747add5a47f Reviewed-on: https://go-review.googlesource.com/c/go/+/251877 Run-TryBot: Michael Matloob <email@example.com> TryBot-Result: Gobot Gobot <firstname.lastname@example.org> Reviewed-by: Jay Conrod <email@example.com> Reviewed-by: Bryan C. Mills <firstname.lastname@example.org>
…aths The copy of CheckImportPath in path.go and the regular expression for github repos in vcsPaths together allow import paths with unicode letters with import paths. These all come from github repos with non-ASCII unicode letters with paths in directories. This mainly shows up in GOPATH mode, but could also show up in Module mode when getting a module in GOPROXY=direct mode. We expect there to not be any significant affected users of this change-- an investingation of github repos that would produce import paths that would comply with the copy CheckImportPaths that's being removed, but not modload.CheckImportPaths only surfaced a handful of cases, all of which seemed to be small test or demonstation repos. But this CL is being submitted early in the cycle so that it can be backed out if need be. Updates #29101 Change-Id: I719df4af5b318e1330e90d8a0bffe5bb8d816f4f Reviewed-on: https://go-review.googlesource.com/c/go/+/251878 Run-TryBot: Michael Matloob <email@example.com> TryBot-Result: Gobot Gobot <firstname.lastname@example.org> Reviewed-by: Bryan C. Mills <email@example.com> Reviewed-by: Jay Conrod <firstname.lastname@example.org>
That test tested that import paths with non-ASCII unicode paths were allowed by the Go command. Remove this test case because golang.org/cl/251878 removes that support. Also rewrite a test case in TestRepoRootForImportPath in the test for cmd/go/internal/get to reflect that unicode directory names are now disallowed. Updates #29101 Change-Id: I669e220facd04fc82ccd05dd08e8f1ff4d48b1fd Reviewed-on: https://go-review.googlesource.com/c/go/+/252297 Run-TryBot: Michael Matloob <email@example.com> TryBot-Result: Gobot Gobot <firstname.lastname@example.org> Reviewed-by: Bryan C. Mills <email@example.com>