cmd/go: GOPROXY should have an equivalent to NO_PROXY

[chowey]

What version of Go are you using (go version)?

$ go version
go version go1.11.1 windows/386

What did you do?

I have a GOPROXY set up that will fetch from upstream. This lets me work within an otherwise internal-only corporate LAN. My GOPROXY is a simplified version of the Athens Project. It works quite well for repos from github.com and the like.

However, I would like to include a private repo as a module. The private repo is on the internal LAN. It supports basic auth but is not publicly available. After importing my private repo, I try go get . which is equivalent to:

set GOPROXY=myproxy
go get private.repo.net/my/repo

Of course it fails authentication.

What did you expect to see?

There should be a mechanism to disable GOPROXY for certain URLs. For example, HTTP_PROXY has NO_PROXY. Maybe we can have a GO_NOPROXY that works the same way. Then I would expect go get . to work successfully for both public repos (through the proxy) and private repos (not through the proxy).

What did you see instead?

I saw failed authentication with no way to get around it.

I recognize that authentication is a complex subject, because the GOPROXY would have to forward the client credentials and cache the results on a per-user basis. My thought is that authenticated servers should probably be accessed directly and not through a GOPROXY; hence the need for a GO_NOPROXY environment variable.

[mvdan]

/cc @bcmills @rsc

[hxzhao527]

This work is needed proxy to do, instead go get maybe.
The proxy handles auth or other custom request.

[clippit]

There're possible ways:

1. configuration about "no proxy url" in local, eg. "NO_PROXY"
2. proxy server filters URLs and proxy to original site directly
3. proxy server filters URLs and tell the client to get from original site

It seems by way 2 there can be no change with cmd/go, but it would break auth to original private repo. So I prefer way 1 or way 3.

[bcmills]

Dup of #26334? Or is this in the opposite direction (you don't want to ask the proxy for that module even if it can supply it)?

CC @FiloSottile @marwan-at-work @hyangah

[marwan-at-work]

I would expect go get . to work successfully for both public repos (through the proxy) and private repos (not through the proxy).

Sounds like a dup, as you'd be able to do GOPROXY=myproxy,direct

[chowey]

Yes, GOPROXY=myproxy,direct would do the trick. That seems to be the better solution.

[marwan-at-work]

Closing this issue, feel free to discuss details in the original issue Brian mentioned above.