repoRootForImportDynamic has `security` arg equal to `web.Secure`(=0) when the url is http (not https)

What version of Go are you using (go version)?

$ go version
go version devel +35f4ec152b Sat Jan 5 00:45:14 2019 +0000 linux/amd64

or
ArchLinux's community/go 2:1.11.4-1

Does this issue reproduce with the latest release?

I guess

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/xftroxgpx/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/xftroxgpx/build/2nonpkgs/go.stuff/gopath"
GOPROXY=""
GORACE=""
GOROOT="/usr/lib/go"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build832694890=/tmp/go-build -gno-record-gcc-switches"

What did you do?

tried to build perkeep as per these instructions: https://perkeep.org/download
like:

$ cd $GOPATH/src
$ git clone https://github.com/perkeep/perkeep.git perkeep.org
...
$ cd perkeep.org
$ time go run make.go
...
(error here)
$ time go run make.go
...
(same error here)
$ go clean
...
(same error here)

What did you expect to see?

In short, this: ...(http/https fetch: Get http://...
In full, this:

go: bazil.org/fuse@v0.0.0-20160811212531-371fbbdaa898: unrecognized import path "bazil.org/fuse" (http/https fetch: Get http://bazil.org/fuse/?go-get=1: dial tcp 104.28.6.28:80: connect: connection refused sec:0 webinsec:1 websec:0)
go: error loading module requirements

What did you see instead?

In short, this: ...(https fetch: Get http://...
In full, this:

go: bazil.org/fuse@v0.0.0-20160811212531-371fbbdaa898: unrecognized import path "bazil.org/fuse" (https fetch: Get http://bazil.org/fuse/?go-get=1: dial tcp 104.28.6.28:80: connect: connection refused)
go: error loading module requirements

Relevant code:

go/src/cmd/go/internal/get/vcs.go

Lines 647 to 653 in 35f4ec1

	func RepoRootForImportPath(importPath string, mod ModuleMode, security web.SecurityMode) (*RepoRoot, error) {
	rr, err := repoRootFromVCSPaths(importPath, "", security, vcsPaths)
	if err == errUnknownSite {
	rr, err = repoRootForImportDynamic(importPath, mod, security)
	if err != nil {
	err = fmt.Errorf("unrecognized import path %q (%v)", importPath, err)
	}

go/src/cmd/go/internal/get/vcs.go

Lines 755 to 770 in 35f4ec1

	func repoRootForImportDynamic(importPath string, mod ModuleMode, security web.SecurityMode) (*RepoRoot, error) {
	slash := strings.Index(importPath, "/")
	if slash < 0 {
	slash = len(importPath)
	}
	host := importPath[:slash]
	if !strings.Contains(host, ".") {
	return nil, errors.New("import path does not begin with hostname")
	}
	urlStr, body, err := web.GetMaybeInsecure(importPath, security)
	if err != nil {
	msg := "https fetch: %v"
	if security == web.Insecure {
	msg = "http/" + msg
	}
	return nil, fmt.Errorf(msg, err)

Related issue: perkeep/perkeep#1242

The only setters that I've found (thanks grep) to be setting the security parameter are the following:

go/src/cmd/go/internal/get/get.go

Lines 400 to 403 in 35f4ec1

	security := web.Secure
	if Insecure {
	security = web.Insecure
	}

go/src/cmd/go/internal/modfetch/repo.go

Lines 218 to 221 in 35f4ec1

	security := web.Secure
	if get.Insecure {
	security = web.Insecure
	}

go/src/cmd/go/internal/modfetch/repo.go

Lines 263 to 266 in 35f4ec1

	security := web.Secure
	if get.Insecure {
	security = web.Insecure
	}

EDIT: which kinda means, to me, that Insecure (which is set by a command line arg?) and/or get.Insecure are having the value 0 (aka web.Secure)
EDIT2: Looks like get.Insecure referes to the same Insecure that's being set by command line args... (my golang knowledge is inexistent)

go/src/cmd/go/internal/get/get.go

Lines 100 to 114 in 35f4ec1

	var (
	getD = CmdGet.Flag.Bool("d", false, "")
	getF = CmdGet.Flag.Bool("f", false, "")
	getT = CmdGet.Flag.Bool("t", false, "")
	getU = CmdGet.Flag.Bool("u", false, "")
	getFix = CmdGet.Flag.Bool("fix", false, "")
	Insecure bool
	)
	func init() {
	work.AddBuildFlags(CmdGet)
	CmdGet.Run = runGet // break init loop
	CmdGet.Flag.BoolVar(&Insecure, "insecure", Insecure, "")
	}

The -insecure flag permits fetching from repositories and resolving
custom domains using insecure schemes such as HTTP. Use with caution.                                           

So then, I can only expect to see this ...(http/https fetch: Get http://... instead of this ...(https fetch: Get http://... ONLY when -insecure is used on command line ?!!

I guess not an issue then.

Turns out I didn't do $ cd $GOPATH/src but instead I did just $ cd $GOPATH and as soon as I moved perkeep.org dir from $GOPATH into $GOPATH/src I'm not even getting this error anymore! and perkeep compiled ok.
Success. Binaries are in /home/xftroxgpx/build/2nonpkgs/go.stuff/gopath/bin