cmd/go: downloading dependencies stuck when git tag signature is enable with an interactive editor

[Fryuni]

What version of Go are you using (go version)?

$ go version
go version go1.21.1 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/lotus/.cache/go-build'
GOENV='/home/lotus/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/lotus/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/lotus/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/nix/store/pvvv2lmx9m8b2n0447mljrl5xmla8r3h-go-1.21.1/share/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/nix/store/pvvv2lmx9m8b2n0447mljrl5xmla8r3h-go-1.21.1/share/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.1'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1926203900=/tmp/go-build -gno-record-gcc-switches'

What did you do?

My terminal has EDITOR=nvim set. go mod download gets stuck once it calls git tag and git opens NeoVim in the background.

The solution was to do EDITOR= go mod download. Maybe the EDITOR variable should be cleared when calling git.

What did you expect to see?

The command should complete

What did you see instead?

Nothing, the program is stuck. Inspecting the process tree, I see this:

[seankhliao]

Do you have other git config that interacts with the git tag command?
I also have EDITOR=nvim and this doesn't happen

[Fryuni]

The only one I have that affects git tag is tag.gpgsign=true, but that is non-interactive.
Removing that line doesn't fix the problem.

My config:

> git config --list
alias.wt=worktree
alias.wta=worktree add
alias.wtl=worktree list
alias.wtp=worktree prune
commit.gpgsign=true
core.excludesfile=/nix/store/mxxll2rqij72zfxbkh1vcs0607zjp8w9-gitignore
core.pager=/nix/store/48v25c5y058n4ql5d6lnj11givcfwbrd-delta-0.16.5/bin/delta
delta.features=side-by-side line-numbers
delta.delta.navigate=true
gpg.program=/nix/store/rl8h6j7mn8zsmxvfm9qwcnb63f41pimh-gnupg-2.4.1/bin/gpg2
init.defaultbranch=main
tag.gpgsign=true
url.ssh://git@github.com/.insteadof=https://github.com/
url.ssh://git@gitlab.com/.insteadof=https://gitlab.com/
user.email=luiz@lferraz.com
user.name=Luiz Ferraz
user.signingkey=2B568731DB2447EC

[bcmills]

I'm wondering why cmd/go is even running git tag at all — that seems like a weird command to run and maybe we can just not. 😅

I think it's coming from here:
https://cs.opensource.google/go/go/+/master:src/cmd/go/internal/modfetch/codehost/git.go;l=508-514;drc=d0c72c23dcb5afc80918686f18c14c870eacbd1c

It seems to me that if we know that the server has a tag ref, we should just fetch the server's refs instead of trying to recreate the tag ourselves, so that we don't (say) create a plain tag for what is an annotated tag upstream.
So perhaps instead of running git tag as a one-off we should just call r.fetchRefsLocked(ctx).

[bcmills]

@Fryuni, want to send a CL with that approach? (https://go.dev/doc/contribute)

I expect that the only tricky part will be writing a regression test — see mod_download_git_decorate_full.txt and mod_download_git_bareRepository.txt for examples of existing regression tests for bad interactions with user git configs.

[Fryuni]

I'll try it. Look out for the smoke in case something goes wrong 😄

[aaqaishtyaq]

Hey @Fryuni, Have you started working on this or can I help?

[Fryuni]

I haven't started anything on this. Its on my queue for Thursday (holiday here), but feel free to tackle it if you are interested :)

[quantonganh]

@Fryuni Could you please provide me with a minimal reproducible example?

[Fryuni]

Could you please provide me with a minimal reproducible example?

On my machine it happens for any project that has a dependency to download. If everything is already downloaded it works.

I can pick any lib and version tag not in my cache and do this to reproduce:

package main

import _ "github.com/some/lib"

func main() {}

module anything

go 1.20

require (
    "github.com/some/lib" v1.2.3
)

This issue is not happening for @seankhliao, who also have the same editor configured, so clearly there is some difference in my system that I'm unaware of.

[Fryuni]

I'm trying to write a test that fails when git tag is called so I can then implement @bcmills' idea, but I can't get it to fail only on git tag. All my attempts cause other Git operations to fail as well.

The most promising idea so far was to set the env var GIT_EDITOR=false so git tries to run the false binary as the editor, and that immediately exits with an error code. That works when running on an interactive environment, but git detects the tests as non-interactive, so it doesn't fail when running the tests, only when running manually.

It is also not very portable. false is generally a shell built-in; I happen to have it as a binary that immediately exits with code 1.

[bcmills]

It is also not very portable. false is generally a shell built-in; I happen to have it as a binary that immediately exits with code 1.

That one is fortunately much easier to deal with: you can always go build a binary to use as the EDITOR. 🙃

[bcmills]

The most promising idea so far was to set the env var GIT_EDITOR=false so git tries to run the false binary as the editor, and that immediately exits with an error code.

Huh. When I test locally, git tag doesn't seem to invoke $EDITOR at all:

$ EDITOR=false git tag v0.0.0

$ git tag -l
v0.0.0

Maybe there is something else in your .gitconfig that causes it to run the editor by default?

Or, maybe it is trying to use a signing key by default, and the prompt is actually for the signing key password rather than an annotation message?

[Fryuni]

I posted my full config up above.

When I run git tag manually, it opens an editor for the tag message. I can't even leave an empty message. Which version of git do you have? I see this:

❯ git -v
git version 2.42.0

# Closing the editor without adding a message
❯ git tag test
fatal: no tag message?

❯ EDITOR=false git tag test
hint: Waiting for your editor to close the file... error: There was a problem with the editor 'false'.
Please supply the message using either -m or -F option.

My GPG key doesn't require a password, but even if I disable tag.gpgsign the problem remains.

[Fryuni]

Sorry, you are partially right @bcmills. The tag.gpgsign=true was set on two different files and I was changing only one. A signed tag must have a message. If I don't sign the tag then the editor doesn't show up.

This is right at the top of the docs:

If one of -a, -s, or -u <key-id> is passed, the command creates a tag object, and requires a tag message. Unless -m <msg> or -F <file> is given, an editor is started for the user to type in the tag message.

So the problem is when the environment is interactive and the git config is set to sign tags.