What version of Go are you using (go version)?
$ go version
go version go1.13.4 linux/amd64
Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (go env)?
go env Output
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/fd0/.cache/go-build"
GOENV="/home/fd0/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/fd0/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/zsh-1000/go-build763029635=/tmp/go-build -gno-record-gcc-switches"
What did you do?
I've tried to download the GPG signature files for Go and discovered some odd behavior:
Go releases can be downloaded by accessing e.g. https://golang.org/dl/go1.13.4.src.tar.gz. There's a redirect to https://dl.google.com/go/go1.13.4.src.tar.gz:
$ curl -i https://golang.org/go1.13.4.src.tar.gz
HTTP/2 302
date: Wed, 20 Nov 2019 19:08:18 GMT
content-type: text/html; charset=utf-8
content-length: 67
location: https://dl.google.com/go/go1.13.4.src.tar.gz
[...]
<a href="https://dl.google.com/go/go1.13.4.src.tar.gz">Found</a>.
So I can just use curl -L or wget to download the release:
$ wget --no-verbose https://golang.org/dl/go1.13.4.src.tar.gz
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
2019-11-20 19:04:36 URL:https://dl.google.com/go/go1.13.4.src.tar.gz [21619153/21619153] -> "go1.13.4.src.tar.gz" [1]
This does not work for the GPG signature files:
$ wget --no-verbose https://golang.org/dl/go1.13.4.src.tar.gz.asc
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
2019-11-20 19:05:15 URL:https://golang.org/dl/go1.13.4.src.tar.gz.asc [330/330] -> "go1.13.4.src.tar.gz.asc" [1]
$ cat go1.13.4.src.tar.gz.asc
<!DOCTYPE html>
<html>
<head>
<meta name="go-import" content="golang.org/dl git https://go.googlesource.com/dl">
<meta http-equiv="refresh" content="0; url=https://golang.org/dl/#go1.13.4.src.tar.gz.asc">
</head>
<body>
Nothing to see here; <a href="https://golang.org/dl/#go1.13.4.src.tar.gz.asc">move along</a>.
</body>
</html>
The server's response for a signature is a bit odd:
$ curl -i https://golang.org/dl/go1.13.4.src.tar.gz.asc
HTTP/2 200
date: Wed, 20 Nov 2019 19:09:40 GMT
content-type: text/html; charset=utf-8
content-length: 330
vary: Accept-Encoding
location: https://golang.org/dl/#go1.13.4.src.tar.gz.asc
[...]
<!DOCTYPE html>
<html>
<head>
<meta name="go-import" content="golang.org/dl git https://go.googlesource.com/dl">
<meta http-equiv="refresh" content="0; url=https://golang.org/dl/#go1.13.4.src.tar.gz.asc">
</head>
<body>
Nothing to see here; <a href="https://golang.org/dl/#go1.13.4.src.tar.gz.asc">move along</a>.
</body>
</html>
There's a location header which is ignored by browsers because the status code is 200, but browsers will honor the meta tag and redirect to https://golang.org/dl/.
The signature file can be accessed here though:
$ curl -i https://dl.google.com/go/go1.13.4.src.tar.gz.asc
HTTP/2 200
accept-ranges: bytes
content-disposition: attachment
content-length: 819
[...]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAABCAAGBQJdu22LAAoJEGSUxtaZfCFeXigQAKc6NflWvvbaZ6S7RCVuRNzA
[...]
-----END PGP SIGNATURE-----
What did you expect to see?
The URL https://golang.org/dl/go1.13.4.src.tar.gz.asc should redirect to https://dl.google.com/go/go1.13.4.tar.gz.asc as for the normal releases.
What did you see instead?
The server returns an odd result with a status code of 200 and a location header.
What version of Go are you using (
go version)?Does this issue reproduce with the latest release?
Yes
What operating system and processor architecture are you using (
go env)?go envOutputWhat did you do?
I've tried to download the GPG signature files for Go and discovered some odd behavior:
Go releases can be downloaded by accessing e.g. https://golang.org/dl/go1.13.4.src.tar.gz. There's a redirect to https://dl.google.com/go/go1.13.4.src.tar.gz:
So I can just use
curl -Lorwgetto download the release:This does not work for the GPG signature files:
The server's response for a signature is a bit odd:
There's a
locationheader which is ignored by browsers because the status code is 200, but browsers will honor themetatag and redirect tohttps://golang.org/dl/.The signature file can be accessed here though:
What did you expect to see?
The URL https://golang.org/dl/go1.13.4.src.tar.gz.asc should redirect to https://dl.google.com/go/go1.13.4.tar.gz.asc as for the normal releases.
What did you see instead?
The server returns an odd result with a status code of 200 and a
locationheader.