Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: should `go list -versions` list cached versions when GOPROXY=off? #32337

bcmills opened this issue May 30, 2019 · 2 comments

cmd/go: should `go list -versions` list cached versions when GOPROXY=off? #32337

bcmills opened this issue May 30, 2019 · 2 comments


Copy link

@bcmills bcmills commented May 30, 2019

Users can set GOPROXY=off to disable module fetches. When that is set, however, they can still resolve versions that are already present in the local cache.

However, it can be difficult to figure out what those versions actually are: go list -versions -m $MODULE produces unhelpful error output (#32335) if the module is not present in the proxy, and truncated output if the module is present:$ gotip version
go version devel +220552f6 Thu May 30 17:59:57 2019 +0000 linux/amd64$ gotip mod init
go: creating new go.mod: module$ GOPROXY='' gotip list -versions -m
go: finding v1.5.2 v1.0.0 v1.1.0 v1.2.0 v1.2.1 v1.3.0 v1.4.0 v1.5.0 v1.5.1 v1.5.2 v1.5.3-pre1$ GOPROXY=off gotip list -versions -m
go list -m module "" is not a known dependency$ GOPROXY='' gotip get
go: finding v1.3.0
go: finding v0.0.0-20170915032832-14c0d48ead0c
go: downloading v1.5.2
go: extracting v1.5.2
go: downloading v1.3.0
go: extracting v1.3.0
go: downloading v0.0.0-20170915032832-14c0d48ead0c
go: extracting v0.0.0-20170915032832-14c0d48ead0c$ GOPROXY=off gotip list -versions -m$

The workaround is to set GOPROXY="file://$GOPATH/pkg/mod/cache/download" before running go list:$ GOPROXY="file://$GOPATH/pkg/mod/cache/download" gotip list -versions -m v1.5.2$

Unfortunately, that's really not discoverable (Paul's example notwithstanding).

Instead, I propose that when GOPROXY is set to off, go list -versions should list the versions that are available without consulting the proxy, as if the user had set GOPROXY="file://$GOPATH/pkg/mod/cache/download".

I don't see any other reasonable behavior we could provide in that case, and that would turn an otherwise useless-in-context command into a useful one.

CC @jayconrod @hyangah @thepudds @myitcv @rsc

Copy link

@myitcv myitcv commented May 31, 2019

I'm more than likely behind in the conversation, but to me GOPROXY=off simply says "don't use the proxy". Which could/should mean "go direct", rather than "go local"?

Copy link

@hyangah hyangah commented May 31, 2019

Thanks @bcmills for filing this issue.

A bit more context behind this feature request: I found using Go without network access became harder and requires more learning in module mode than in the old GOPATH mode. In module mode, the best I could do was to ensure they are in the module cache or somewhere Go can recognize as a file proxy, but that is still insufficient because many Go commands will not work unless I explicitly set GOPROXY=file://$GOPATH/pkg/mod/cache/download (which I will never memorize) or the go.mod files in my workspace already specify the module and its version completely.

Another option I thought about is to have another GOPROXY mode (maybe GOPROXY=local, an alias of GOPROXY=file://$GOPATH/pkg/mod/cache/download). Unlike GOPROXY=off, I hope this mode to allow go get to pick up the latest module/version available in the module cache even when the module, version is not specified in go.mod yet. But given that GOPROXY=off is already confusing as @myitcv pointed out, I am not sure introducing another mode is a good idea.

No matter what decision Go team makes on this specific issue, I hope improvement in user experience when using Go without network.

movie-travel-code added a commit to movie-travel-code/tools that referenced this issue Aug 21, 2019
The original implementation relies on 'go list' to download the deps.
'go list' is called by other request handler indirectly. This approach
is unpredictable and 'go list' is black box to us. So it's better
download the deps manually in 'ManageDeps', i.e. inside 'initialize'
request handler.

For security, set 'GO111MODULE=off' by default, 'GO111MODULE=off' will
disable the deps download by inconsistencies.

NOTE:'GO111MODULE=off' break the go langserver ability in some extent.
The official option for disable the network access is setting
'GOPROXY=off' under mod mode, however this option will break the go
langserver totally. Related issue: golang/go#32337
@rsc rsc modified the milestones: Go1.14, Backlog Oct 9, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants
You can’t perform that action at this time.