Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: Go build doesn't disable import path checking in vendor trees when using GOPATH #51243

Open
simifalaye opened this issue Feb 17, 2022 · 1 comment
Assignees
Labels
GoCommand NeedsInvestigation
Milestone

Comments

@simifalaye
Copy link

@simifalaye simifalaye commented Feb 17, 2022

What version of Go are you using (go version)?

$ go version
go version go1.17.6 linux/amd64

Does this issue reproduce with the latest release?

Yes, tested with 1.17.6 and I haven't seen any changes to this code in later release tags

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GO111MODULE="off"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/simifa/.cache/go-build"
GOENV="/home/simifa/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/simifa/src/gopkgs/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/simifa/src/gopkgs"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.6"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3705488307=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Since GOPATH is still supported in this version, we can make a new package in the src folder of gopath and setup vendoring for external dependencies:

$ tree .
.
├── main.go
└── vendor
    └── github.com
        └── fakeusr
            └── fakepkg
                └── fake.go

main.go; import the vendor path for the package we want to include in the main file:

$ cat main.go
package main

import (
    "github.com/fakeusr/fakepkg"
)

func main() {
    fakepkg.PrintLog("Test pkg")
}

./vendor/github.com/fakeusr/fakepkg/fake.go; specify an "import comment" to enforce import path checking in external dependency:

$ cat ./vendor/github.com/fakeusr/fakepkg/fake.go
package fakepkg // import "fake.in/fakeusr/fakepkg.v2"

import (
    "log"
)

func PrintLog(str string) {
    log.Printf("%s", str)
}

Try building the package:

$ go build

What did you expect to see?

The package builds successfully because import path checking should be ignored in vendor trees:
https://pkg.go.dev/cmd/go#hdr-Import_path_checking

$ go build
$ echo $?
0

Tested with older versions of go (such as 1.10) and this package builds successfully

What did you see instead?

$ go build
main.go:4:5: code in directory /home/simifa/src/gopkgs/src/testpkg/vendor/github.com/fakeusr/fakepkg expects import "fake.in/fakeusr/fakepkg.v2"

Notes

Looking at src/cmd/go/internal/load/pkg.go:

if !cfg.ModulesEnabled && data.err == nil &&
data.p.ImportComment != "" && data.p.ImportComment != path &&
!strings.Contains(path, "/vendor/") && !strings.HasPrefix(path, "vendor/") {
data.err = fmt.Errorf("code in directory %s expects import %q", data.p.Dir, data.p.ImportComment)
}

We can see it's supposed to ignore import path checking when the path is inside the vendor tree BUT it's using the unresolved (unexpanded path to the vendor folder) so it doesn't realize that the code is actually in a vendor folder. It seems that this was introduced when the change was made to parallelize package loading.

@dmitshur
Copy link
Contributor

@dmitshur dmitshur commented Feb 17, 2022

@dmitshur dmitshur added GoCommand NeedsInvestigation labels Feb 17, 2022
@dmitshur dmitshur added this to the Backlog milestone Feb 17, 2022
@bcmills bcmills self-assigned this Feb 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
GoCommand NeedsInvestigation
Projects
None yet
Development

No branches or pull requests

3 participants