proxy.golang.org 403 forbidden

[teresa-recursion]

What version of Go are you using (go version)?

go version go1.16.5 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.16.5"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2005387958=/tmp/go-build -gno-record-gcc-switches"

What did you do?

When running a go build I'm getting a 403 from https://proxy.golang.org/github.com/klauspost/compress/@v/v1.13.5.zip. When I just navigate to this URL I am able to download the zip file. I get a 302 but the zip file downloads, I never get a 403. Under what circumstances would https://proxy.golang.org return a 403?

/go/pkg/mod/github.com/honeycombio/libhoney-go@v1.14.1/transmission/transmission.go:28:2: github.com/klauspost/compress@v1.13.5: 
reading https://proxy.golang.org/github.com/klauspost/compress/@v/v1.13.5.zip: 403 Forbidden

I'm unsure why it isn't just getting the zstd dependency which exists here, why it's falling back to the proxy, and then why the proxy is returning a 403.

What did you expect to see?

go: downloading github.com/klauspost/compress v1.10.11

(basically just getting the dependency and not throwing an error)

What did you see instead?

/go/pkg/mod/github.com/honeycombio/libhoney-go@v1.14.1/transmission/transmission.go:28:2: github.com/klauspost/compress@v1.13.5: 
reading https://proxy.golang.org/github.com/klauspost/compress/@v/v1.13.5.zip: 403 Forbidden

Apologies if this is a honeycombio issue or an environment issue, I've been trying to understand why I would ever get a 403 from https://proxy.golang.org but haven't been able to find anything.

[seankhliao]

Is this in a container? Did you test on the host? Is it just this one dependency? Does curl work? Do you have a corporate proxy you need to configure?

[teresa-recursion]

Is this in a container?

Yes, this is in a docker container based on golang:latest.

Did you test on the host?

I did test it locally on my local computer and it works fine, I don't get this error. So it must be an environment issue but I'm not sure what difference to look for between my computer and this docker container that could be the reason for this issue. I'm at a loss as to why I can't get this one dependency when all my other dependencies are retrieved without any issue.

Is it just this one dependency?

Yes.

Do you have a corporate proxy you need to configure?

No.

The build in question has actually been working for years and only within the last month or so have we run into this problem. I was hoping this would ring a bell for someone that could point me to some known reason that this specific package or any package might have this problem, but if not I would totally understand closing this issue because it is just something about the combination of this dependency and my specific environment and it probably wouldn't be an effective use of anyone's time to try to troubleshoot beyond that.

[findleyr]

I did test it locally on my local computer and it works fine

Can you try cURLing from the container shell session? What about an explicit go get github.com/klauspost/compress@v1.13.5?

Assuming the latter reproducibly fails, I think it's worth checking the following:

GODEBUG=http2debug=1 go get -x -v github.com/klauspost/compress@v1.13.5 2> debug.txt

The resulting debug.txt will be quite large, but toward the top you should see a ":path" header with a Expires=... value. Can you grab that timestamp and run it through date -d "@$TIMESTAMP"? (my theory is that somehow you're getting an expired redirect).

Thanks!

[heschi]

some known reason that this specific package or any package might have this problem

Since this wasn't addressed specifically: proxy.golang.org uses different serving paths for large and small files. So the most likely explanation is that this is the one dependency you have that's large enough to use the large file path. You might want to check quickly if other large modules (say, other versions of this module, or some big Kubernetes module) also fail in the same way.

[teresa-recursion]

@findleyr and @heschi thank you so much for your input here, I'm going to try all of these things. I ran GODEBUG=http2debug=1 go get -x -v github.com/klauspost/compress 2> debug.txt; in the relevant docker container and got this output. I don't see a value for "Expires" but maybe there is stiill something of value in here?

github.com/klauspost/compress (download)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
cd .                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
git clone -- https://github.com/klauspost/compress /go/src/github.com/klauspost/compress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
cd /go/src/github.com/klauspost/compress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
git submodule update --init --recursive                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            
cd /go/src/github.com/klauspost/compress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
git show-ref                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       
cd /go/src/github.com/klauspost/compress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
git submodule update --init --recursive                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            
WORK=/tmp/go-build850913329                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
github.com/klauspost/compress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      
mkdir -p $WORK/b001/                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
cat >$WORK/b001/importcfg << 'EOF' # internal                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      
# import config                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    
packagefile math=/usr/local/go/pkg/linux_amd64/math.a                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
EOF                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                
cd /go/src/github.com/klauspost/compress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           
/usr/local/go/pkg/tool/linux_amd64/compile -o $WORK/b001/_pkg_.a -trimpath "$WORK/b001=>" -p github.com/klauspost/compress -complete -buildid celOT_QSxwgNQ5pB0oqE/celOT_QSxwgNQ5pB0oqE -goversion go1.13.15 -D "" -importcfg $WORK/b001/importcfg -pack -c=4 ./compressible.go                                                                                                                                                                                                                                                                                                                                                    
/usr/local/go/pkg/tool/linux_amd64/buildid -w $WORK/b001/_pkg_.a # internal                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
cp $WORK/b001/_pkg_.a /root/.cache/go-build/65/65cd7644f1083675a15e1b0939afdf37838d1f664e5d9ea31359382e4abb84b3-d # internal                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       
mkdir -p /go/pkg/linux_amd64/github.com/klauspost/                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 
mv $WORK/b001/_pkg_.a /go/pkg/linux_amd64/github.com/klauspost/compress.a                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          
rm -r $WORK/b001/                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  

[findleyr]

@teresa-recursion it looks like you're in GOPATH mode with that output (which is why you had to remove the @v1.13.5).

Could you try running from a module, or running instead go mod download?

GODEBUG=http2debug=1 go mod download -x github.com/klauspost/compress@v1.13.5 2> debug.txt

If that produces empty output you likely hit the module cache, in which case you can run go clean -modcache.

[seankhliao]

also

curl -Lvo /dev/null https://proxy.golang.org/github.com/klauspost/compress/@v/v1.13.5.zip 2> debug2.txt

[teresa-recursion]

I hit enter too soon, here's the actual output of curl -Lvo /dev/null https://proxy.golang.org/github.com/klauspost/compress/@v/v1.13.5.zip 2> debug2.txt:

* Expire in 0 ms for 6 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 1 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                                                                          
                                 Dload  Upload   Total   Spent    Left  Speed                                                                                            
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                           
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50) 


(... many more lines like this cut out for space)

* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 4 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 3 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 3 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 4 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 4 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 4 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 8 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 5 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 5 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 8 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 5 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 5 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 7 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
*   Trying 173.194.215.141...                                                                                                                                            
* TCP_NODELAY set   
* TCP_NODELAY set                                                                                                                                                        
* Expire in 149988 ms for 3 (transfer 0x55979cfc5f50)                                                                                                                    
* Expire in 200 ms for 4 (transfer 0x55979cfc5f50)                                                                                                                       
* Connected to proxy.golang.org (173.194.215.141) port 443 (#0)                                                                                                          
* ALPN, offering h2                                                                                                                                                      
* ALPN, offering http/1.1                                                                                                                                                
* successfully set certificate verify locations:                                                                                                                         
*   CAfile: none                                                                                                                                                         
  CApath: /etc/ssl/certs                                                                                                                                                 
} [5 bytes data]                                                                                                                                                         
* TLSv1.3 (OUT), TLS handshake, Client hello (1):                                                                                                                        
} [512 bytes data]                                                                                                                                                       
* TLSv1.3 (IN), TLS handshake, Server hello (2):                                                                                                                         
{ [122 bytes data]                                                                                                                                                       
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):                                                                                                                 
{ [15 bytes data]                                                                                                                                                        
* TLSv1.3 (IN), TLS handshake, Certificate (11):                                                                                                                         
{ [7530 bytes data]                                                                                                                                                      
* TLSv1.3 (IN), TLS handshake, CERT verify (15):                                                                                                                         
{ [79 bytes data]                                                                                                                                                        
* TLSv1.3 (IN), TLS handshake, Finished (20):                                                                                                                            
{ [52 bytes data]                                                                                                                                                        
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):                                                                                                              
} [1 bytes data]                                                                                                                                                         
* TLSv1.3 (OUT), TLS handshake, Finished (20):                                                                                                                           
} [52 bytes data]                                                                                                                                                        
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384                                                                                                                  
* ALPN, server accepted to use h2                                                                                                                                        
* Server certificate:                                                                                                                                                    
*  subject: C=US; ST=California; L=Mountain View; O=Google LLC; CN=misc-sni.google.com                                                                                   
*  start date: Aug 16 01:52:55 2021 GMT                                                                                                                                  
*  expire date: Nov  8 01:52:54 2021 GMT 
   *  subjectAltName: host "proxy.golang.org" matched cert's "*.golang.org"                                                                                                 
*  issuer: C=US; O=Google Trust Services; CN=GTS CA 1O1                                                                                                                  
*  SSL certificate verify ok.                                                                                                                                            
* Using HTTP2, server supports multi-use                                                                                                                                 
* Connection state changed (HTTP/2 confirmed)                                                                                                                            
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0                                                                                         
} [5 bytes data]                                                                                                                                                         
* Using Stream ID: 1 (easy handle 0x55979cfc5f50)                                                                                                                        
} [5 bytes data]                                                                                                                                                         
> GET /github.com/klauspost/compress/@v/v1.13.5.zip HTTP/2                                                                                                               
> Host: proxy.golang.org                                                                                                                                                 
> User-Agent: curl/7.64.0                                                                                                                                                
> Accept: */*                                                                                                                                                            
>                                                                                                                                                                        
{ [5 bytes data]                                                                                                                                                         
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!                                                                                                              
} [5 bytes data]                                                                                                                                                         
< HTTP/2 302                                                                                                                                                             
< access-control-allow-origin: *                                                                                                                                         
< content-type: application/zip                                                                                                                                          
< date: Thu, 02 Sep 2021 00:31:41 GMT                                                                                                                                    
< etag: "e5b789e486f1e454ef02344c8235a1a4e285d7b8dd801ff8d667fce6309f3355"                                                                                               
< expires: Thu, 02 Sep 2021 03:31:41 GMT                                                                                                                                 
< location: https://storage.googleapis.com/proxy-golang-org-prod/6c3669ec5787390a-github.com:klauspost:compress-v1.13.5.zip?Expires=1630629101&GoogleAccessId=gcs-urlsign
er-prod%40golang-modproxy.iam.gserviceaccount.com&Signature=<REDACTED>                                                                                      
< x-content-type-options: nosniff                                                                                                                                        
< x-frame-options: SAMEORIGIN                                                                                                                                            
< x-xss-protection: 0                                                                                                                                                    
< content-length: 0                                                                                                                                                      
< cache-control: public, max-age=10800                                                                                                                                   
< age: 3961  
<                                                                                                                                                                        
{ [0 bytes data]                                                                                                                                                         
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0                                                                                           
* Connection #0 to host proxy.golang.org left intact                                                                                                                     
* Issue another request to this URL: 'https://storage.googleapis.com/proxy-golang-org-prod/6c3669ec5787390a-github.com:klauspost:compress-v1.13.5.zip?Expires=1630629101&
GoogleAccessId=gcs-urlsigner-prod%40golang-modproxy.iam.gserviceaccount.com&Signature=<REDACTED>'                                                            
* Expire in 1 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 1 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 1 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 1 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 1 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 1 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 0 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 1 ms for 1 (transfer 0x55979cfc5f50) 

(... many more lines like this cut out for space)

* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 2 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 4 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 3 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 3 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
* Expire in 4 ms for 1 (transfer 0x55979cfc5f50)                                                                                                                         
*   Trying 173.194.211.128...                                                                                                                                            
* TCP_NODELAY set                                                                                                                                                        
* Expire in 149994 ms for 3 (transfer 0x55979cfc5f50)                                                                                                                    
* Expire in 200 ms for 4 (transfer 0x55979cfc5f50)                                                                                                                       
* Connected to storage.googleapis.com (173.194.211.128) port 443 (#1)                                                                                                    
* ALPN, offering h2                                                                                                                                                      
* ALPN, offering http/1.1                                                                                                                                                
* successfully set certificate verify locations:                                                                                                                         
*   CAfile: none                                                                                                                                                         
  CApath: /etc/ssl/certs                                                                                                                                                 
} [5 bytes data]                                                                                                                                                         
* TLSv1.3 (OUT), TLS handshake, Client hello (1):                                                                                                                        
} [512 bytes data]                                                                                                                                                       
* TLSv1.3 (IN), TLS handshake, Server hello (2):                                                                                                                         
{ [122 bytes data]                                                                                                                                                       
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):                                                                                                                 
{ [15 bytes data]                                                                                                                                                        
* TLSv1.3 (IN), TLS handshake, Certificate (11):                                                                                                                         
{ [2777 bytes data]                                                                                                                                                      
* TLSv1.3 (IN), TLS handshake, CERT verify (15):                                                                                                                         
{ [79 bytes data]                                                                                                                                                        
* TLSv1.3 (IN), TLS handshake, Finished (20):                                                                                                                            
{ [52 bytes data]                                                                                                                                                        
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):                                                                                                              
} [1 bytes data]                                                                                                                                                         
* TLSv1.3 (OUT), TLS handshake, Finished (20):                                                                                                                           
} [52 bytes data]                                                                                                                                                        
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 
* ALPN, server accepted to use h2                                                                                                                                        
* Server certificate:                                                                                                                                                    
*  subject: C=US; ST=California; L=Mountain View; O=Google LLC; CN=*.storage.googleapis.com                                                                              
*  start date: Aug 16 02:55:40 2021 GMT                                                                                                                                  
*  expire date: Nov  8 02:55:39 2021 GMT                                                                                                                                 
*  subjectAltName: host "storage.googleapis.com" matched cert's "*.googleapis.com"                                                                                       
*  issuer: C=US; O=Google Trust Services; CN=GTS CA 1O1                                                                                                                  
*  SSL certificate verify ok.                                                                                                                                            
* Using HTTP2, server supports multi-use                                                                                                                                 
* Connection state changed (HTTP/2 confirmed)                                                                                                                            
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0                                                                                         
} [5 bytes data]                                                                                                                                                         
* Using Stream ID: 1 (easy handle 0x55979cfc5f50)                                                                                                                        
} [5 bytes data]                                                                                                                                                         
> GET /proxy-golang-org-prod/6c3669ec5787390a-github.com:klauspost:compress-v1.13.5.zip?Expires=1630629101&GoogleAccessId=gcs-urlsigner-prod%40golang-modproxy.iam.gservi
ceaccount.com&Signature=<REDACTED> HTTP/2                                                                                                                    
> Host: storage.googleapis.com                                                                                                                                           
> User-Agent: curl/7.64.0                                                                                                                                                
> Accept: */*                                                                                                                                                            
>                                                                                                                                                                        
{ [5 bytes data]                                                                                                                                                         
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!                                                                                                              
} [5 bytes data]                                                                                                                                                         
< HTTP/2 403                                                                                                                                                             
< x-guploader-uploadid: ADPycdvjaBzJHXw1L63npRCztuWZwkJLMHwLMnZpEb1pFZ0N1AL9qoVuCGAl54bDWBd7gmXMNiMzm_vAm98oQBk2kWk                                                      
< content-type: application/xml; charset=UTF-8                                                                                                                           
< content-length: 303                                                                                                                                                    
< date: Thu, 02 Sep 2021 01:37:42 GMT                                                                                                                                    
< expires: Thu, 02 Sep 2021 01:37:42 GMT                                                                                                                                 
< cache-control: private, max-age=0                                                                                                                                      
< server: UploadServer
<                                                                                                                                                                        
{ [5 bytes data]                                                                                                                                                         
100   303  100   303    0     0   3482      0 --:--:-- --:--:-- --:--:--  3482                                                                                           
* Connection #1 to host storage.googleapis.com left intact                                                                                                                                                           

[teresa-recursion]

And the response from GODEBUG=http2debug=1 go mod download github.com/klauspost/compress@v1.13.5 2> debug.txt was HUGE but this seems like the relevant bit at the end!

http2: Transport received SETTINGS flags=ACK len=0                                                                                                                       
http2: Transport received HEADERS flags=END_HEADERS stream=1 len=200                                                                                                     
http2: Transport received DATA stream=1 len=303 data="<?xml version='1.0' encoding='UTF-8'?><Error><Code>SecurityPolicyViolated</Code><Message>Request violates VPC Servi
ce Controls.</Message><Details>Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: " (47 bytes omitted)        
http2: Transport received DATA flags=END_STREAM stream=1 len=0 data=""                                                                                                   
http2: Transport received PING len=8 ping="\x00\x00\x00\x00\x00\x00\x00\x00"                                                                                             
github.com/klauspost/compress@v1.13.5: reading https://proxy.golang.org/github.com/klauspost/compress/@v/v1.13.5.zip: 403 Forbidden                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ​

I don't know what this means at first glance, but it's something I can investigate! I'm not sure if "prohibited by organization's policy" means my organization the organization of the package I'm using. I'm running this docker container on GCP Kubernetes Engine and although I answered "no" to the question about needing to configure a corporate proxy maybe there's something there that I'm just not aware of. It's interesting that I'm only seeing this for one dependency, but as suggested above maybe that's due to different paths taken based on size?

[teresa-recursion]

It looks like we enabled VPC Service Controls a few weeks ago (since the last time this build ran successfully and pulled down this dependency). I think that's what is going on here. I don't know if this investigation will be helpful for anyone else but it was immensely helpful for me. Thank you very much @seankhliao @findleyr @heschi !

[siba36]

I have the same issue when downloading mongoDB golang driver in vs code using the command:
go get go.mongodb.org/mongo-driver/mongo
I get this error:
go: downloading github.com/klauspost/compress v1.13.6 go.mongodb.org/mongo-driver/mongo imports go.mongodb.org/mongo-driver/x/mongo/driver imports github.com/klauspost/compress/zstd: github.com/klauspost/compress@v1.13.6: reading https://proxy.golang.org/github.com/klauspost/compress/@v/v1.13.6.zip: 403 Forbidden
I see that this issue is closed but can someone help me fix this

[amirrezafahimi]

I'm having the same problem
the result of go mod tidy is:

go: downloading github.com/klauspost/compress v1.13.6
quickstart imports
        go.mongodb.org/mongo-driver/mongo imports
        go.mongodb.org/mongo-driver/x/mongo/driver imports
        github.com/klauspost/compress/zstd: github.com/klauspost/compress@v1.13.6: reading https://proxy.golang.org/github.com/klauspost/compress/@v/v1.13.6.zip: 403 Forbidden

installing it separately produces the same error:

$ go get github.com/klauspost/compress                                                                                              ─╯
go: downloading github.com/klauspost/compress v1.15.1
go: github.com/klauspost/compress@v1.15.1: reading https://proxy.golang.org/github.com/klauspost/compress/@v/v1.15.1.zip: 403 Forbidden

currently using go version 1.18

[sasualx]

I had the same issue. When I was trying to reach https://proxy.golang.org/github.com/klauspost/compress/@v/v1.15.1.zip in the browser it said something like "this operation is not permitted in your location". I switched my VPN from Cyprus to Germany, and it solved it for me O.o

[srahkmli]

I had this same issue, try this
GOPROXY=https://goproxy.cn go get github.com/klauspost/compress

[hosseinmirzapur]

I had this same issue, try this GOPROXY=https://goproxy.cn go get github.com/klauspost/compress

This worked perfectly for me, thx you saved me a lot if time^_^