cmd/go: loops without output when a module fetch via git+ssh fails to authenticate

[seh]

What version of Go are you using (go version)?

go version go1.13.3 darwin/amd64

Does this issue reproduce with the latest release?

This is the latest release available to me at time of writing.

What operating system and processor architecture are you using (go env)?

go env Output

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/seh/Library/Caches/go-build"
GOENV="/Users/seh/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/seh/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/Cellar/go/1.13.3/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.13.3/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/d5/r0rch5j95zjcjmh12gzb7lfc0000gn/T/go-build882545304=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

As described previously in #33568 (comment), I added a few new packages to an existing Go module. Let's call one of the new modules dependency, and another that imports the first one dependent.

In file go.mod:

module example.com/repo.git

go 1.13

In file dependency/greet.go:

package dependency

const Place = "world"

In file dependent/main.go:

package main

import "example.com/repo.git/dependency"
import "fmt"

func main() {
  fmt.Printf("Hello, %s!\n", dependency.Place)
}

Now, say that I decide that I don't need the dependency module anymore, and I delete the dependency directory, but I edit the dependency/main.go file such that I mistakenly leave that import statement in place:

package main

// Note that this now refers to a nonexistent package.
import "example.com/repo.git/dependency"
import "fmt"

func main() {
  fmt.Println("Hello, world!")
}

Now, try to run go build to build the program in dependency.

[Aside]
In the main.go file above, the first import statement is no longer used, which is a problem that arises so frequently that our tools like goimports automatically remove such statements. I can't recall now whether triggering this problem required leaving use of that missing package in place.

What did you expect to see?

go build should fail quickly and print a message complaining that this dependency package does not exist within this module, ideally not looking anything up over the network, since the module is already defined locally in this source tree.

What did you see instead?

go build hangs, producing no output.

Running go build -v instead, we see output like the following:

go build -v output

# cd .; git ls-remote https://example.com/repo
fatal: unable to access 'https://example.com/repo/': The requested URL returned error: 403
# cd .; git ls-remote https://example.com/repo
fatal: unable to access 'https://example.com/repo/': The requested URL returned error: 403
# cd .; git ls-remote https://example.com/repo
fatal: unable to access 'https://example.com/repo/': The requested URL returned error: 403
# cd .; git ls-remote https://example.com/repo
fatal: unable to access 'https://example.com/repo/': The requested URL returned error: 403
# cd .; git ls-remote git+ssh://example.com/repo
Received disconnect from 1.2.3.4 port 22:2: Too many authentication failures
Disconnected from 1.2.3.4 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
# cd .; git ls-remote git+ssh://example.com/repo
Received disconnect from 2.3.4.5 port 22:2: Too many authentication failures
Disconnected from 2.3.4.5 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
# cd .; git ls-remote git+ssh://example.com/repo
Received disconnect from 2.3.4.5 port 22:2: Too many authentication failures
Disconnected from 2.3.4.5 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
# cd .; git ls-remote git+ssh://example.com/repo
Received disconnect from 1.2.3.4 port 22:2: Too many authentication failures
Disconnected from 1.2.3.4 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
# cd .; git ls-remote ssh://example.com/repo
Received disconnect from 2.3.4.5 port 22:2: Too many authentication failures
Disconnected from 2.3.4.5 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
# cd .; git ls-remote ssh://example.com/repo
Received disconnect from 2.3.4.5 port 22:2: Too many authentication failures
Disconnected from 2.3.4.5 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
# cd .; git ls-remote ssh://example.com/repo
Received disconnect from 2.3.4.5 port 22:2: Too many authentication failures
Disconnected from 2.3.4.5 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
# cd .; git ls-remote ssh://example.com/repo
Received disconnect from 2.3.4.5 port 22:2: Too many authentication failures
Disconnected from 2.3.4.5 port 22
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
^C

In this case, it turns out that the SSH server requires a particular user name to authenticate, requiring an entry like the following in my ~/.gitconfig file:

[url "ssh://sentinel@example.com/"]
	insteadOf =  https://example.com/

With that in place, go build is able to complete its fetch attempt, and conclude that the dependency package truly does not exist, and prints a message like this:

build example.com/repo.git/dependent: cannot load example.com/repo.git/dependency: no matching versions for query "latest"

More clear to me would be if go build had noted that there's no directory here called dependency, but we referred to it via that import path from that file.