cmd/go: Go build doesn't disable import path checking in vendor trees when using GOPATH

[simifalaye]

What version of Go are you using (go version)?

$ go version
go version go1.17.6 linux/amd64

Does this issue reproduce with the latest release?

Yes, tested with 1.17.6 and I haven't seen any changes to this code in later release tags

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="off"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/simifa/.cache/go-build"
GOENV="/home/simifa/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/simifa/src/gopkgs/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/simifa/src/gopkgs"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.6"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3705488307=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Since GOPATH is still supported in this version, we can make a new package in the src folder of gopath and setup vendoring for external dependencies:

$ tree .
.
├── main.go
└── vendor
    └── github.com
        └── fakeusr
            └── fakepkg
                └── fake.go

main.go; import the vendor path for the package we want to include in the main file:

$ cat main.go
package main

import (
    "github.com/fakeusr/fakepkg"
)

func main() {
    fakepkg.PrintLog("Test pkg")
}

./vendor/github.com/fakeusr/fakepkg/fake.go; specify an "import comment" to enforce import path checking in external dependency:

$ cat ./vendor/github.com/fakeusr/fakepkg/fake.go
package fakepkg // import "fake.in/fakeusr/fakepkg.v2"

import (
    "log"
)

func PrintLog(str string) {
    log.Printf("%s", str)
}

Try building the package:

$ go build

What did you expect to see?

The package builds successfully because import path checking should be ignored in vendor trees:
https://pkg.go.dev/cmd/go#hdr-Import_path_checking

$ go build
$ echo $?
0

Tested with older versions of go (such as 1.10) and this package builds successfully

What did you see instead?

$ go build
main.go:4:5: code in directory /home/simifa/src/gopkgs/src/testpkg/vendor/github.com/fakeusr/fakepkg expects import "fake.in/fakeusr/fakepkg.v2"

Notes

Looking at src/cmd/go/internal/load/pkg.go:

go/src/cmd/go/internal/load/pkg.go

Lines 906 to 910 in 9de1ac6

	if !cfg.ModulesEnabled && data.err == nil &&
	data.p.ImportComment != "" && data.p.ImportComment != path &&
	!strings.Contains(path, "/vendor/") && !strings.HasPrefix(path, "vendor/") {
	data.err = fmt.Errorf("code in directory %s expects import %q", data.p.Dir, data.p.ImportComment)
	}

We can see it's supposed to ignore import path checking when the path is inside the vendor tree BUT it's using the unresolved (unexpanded path to the vendor folder) so it doesn't realize that the code is actually in a vendor folder. It seems that this was introduced when the change was made to parallelize package loading.

[dmitshur]

CC @matloob, @bcmills.