cmd/go: go mod download seems now incompatible with git version 1

[gjenkins8]

What version of Go are you using (go version)?

$ go version
go version go1.17.8 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/var/tmp/gomodcache"
GONOPROXY="*.dev.mycompany.com"
GONOSUMDB="*.dev.mycompany.com"
GOOS="linux"
GOPATH="/go"
GOPRIVATE="*.dev.mycompany.com"
GOPROXY="https://goproxy.dev.mycompany.com,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.8"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2616314172=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Attempted to fetch/download a module from git via go mod download on a rhel7 (git version 1) system:

go mod download github.dev.mycompany.com/myteam/mymodule@v1.0.1
go mod download: github.dev.mycompany.com/myteam/mymodule@v1.0.1: invalid version: resolves to version v0.0.0-20220103224853-41201e2e180e (v1.0.1 is not a tag)

The OS here is rhel7, which ships with git version one:

$ cat /etc/os-release
NAME="Red Hat Enterprise Linux Server"
VERSION="7.9 (Maipo)"
...
$ git --version
git version 1.8.3.1

When fetching this module on a system with git version 2, go mod download successfully fetches the module (more details below)

What did you expect to see?

go mod download able to successfully use git version 1 to fetch the module.

What did you see instead?

$ go mod download -x github.dev.mycompany.com/myteam/mymodule@v1.0.1
...
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' refs/tags/v1.0.1 --
...

Invoking the logged git command directly:

$ cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' refs/tags/v1.0.1 --
41201e2e180ea3942a7dfd9fa8a7791de3bdf62c 1641250133 %D

It seems this version of git doesn't support the %D format specifier. I will post the full log in a following comment on this issue.

On a system with git version 2:

$ go version
go version go1.17.8 linux/amd64
$ git version
git version 2.25.1
$ go mod download -x github.dev.mycompany.com/myteam/mymodule@v1.0.1
# success
$ cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' refs/tags/v1.0.1 --
41201e2e180ea3942a7dfd9fa8a7791de3bdf62c 1641250133 grafted, tag: v1.0.1

(Note: I've edited module, github instance and domain names, since these are company private names)

(Note 2: The environment has a git credential helper installed, but I don't think given the successful git access this is relevant)

[gjenkins8]

Full log from go mod download -x github.dev.mycompany.com/myteam/mymodule@v1.0.1:

$ go mod download -x github.dev.mycompany.com/myteam/mymodule@v1.0.1
# get https://github.dev.mycompany.com/myteam/mymodule?go-get=1
# get https://github.dev.mycompany.com/myteam/mymodule?go-get=1: 200 OK (0.612s)
mkdir -p /var/tmp/gomodcache/cache/vcs # git3 https://github.dev.mycompany.com/myteam/mymodule.git
# lock /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d.lock# /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d for git3 https://github.dev.mycompany.com/myteam/mymodule.git
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git tag -l
0.005s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git tag -l
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' refs/tags/v1.0.1 --
0.005s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' refs/tags/v1.0.1 --
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git ls-remote -q origin
0.932s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git ls-remote -q origin
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git cat-file blob 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c:go.mod
0.006s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git cat-file blob 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c:go.mod
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git cat-file blob 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c:go.mod
0.007s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git cat-file blob 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c:go.mod
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c --
0.008s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c --
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git cat-file blob 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c:go.mod
0.006s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git cat-file blob 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c:go.mod
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git for-each-ref --format %(refname) refs/tags --merged 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c
0.004s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git for-each-ref --format %(refname) refs/tags --merged 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' 41201e2e180e --
0.004s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git -c log.showsignature=false log -n1 '--format=format:%H %ct %D' 41201e2e180e --
cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git cat-file blob 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c:go.mod
0.007s # cd /var/tmp/gomodcache/cache/vcs/0be68f0b3f6ae46d99c4c556601c77b6f43aebfc8c565c460e79ccf3b9c08b5d; git cat-file blob 41201e2e180ea3942a7dfd9fa8a7791de3bdf62c:go.mod
go mod download: github.dev.mycompany.com/myteam/mymodule@v1.0.1: invalid version: resolves to version v0.0.0-20220103224853-41201e2e180e (v1.0.1 is not a tag)

[gjenkins8]

If the answer is: "please use a system with a modern version of git", that is fair 😄 . But I don't think there was an intention to drop support for git version 1? And/or it might be worth considering updating docs and release notes if so?

Edit: A colleague's idea: if git version 1 isn't supported, an explicit version check+fail would be a much nicer user experience.

[ianlancetaylor]

CC @bcmills

[ALTree]

Also #51253 and #38373. #38373 (comment) also noted that installing git2 did fix their issue.

But I don't think there was an intention to drop support for git version 1? And/or it might be worth considering updating docs and release notes if so?

See #26746.

[bcmills]

Per #26746 (comment), I do not plan to test against (or add workarounds for) Git versions older than 2.17.6 due to known CVEs and lack of documentation.

You are welcome to contribute a CL for compatibility with older versions, but any CL for compatibility should include a reference to the command documentation for the version in question.