cmd/go: git VCS qualifier in module path uses git:// scheme

[dgl]

What version of Go are you using (go version)?

$ go version
go version go1.21.3 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/root/.cache/go-build'
GOENV='/root/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.3'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/src/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2460490683=/tmp/go-build -gno-record-gcc-switches'

What did you do?

In a clean docker env:

docker run -it golang:1.21.3
mkdir /src
cd /src

I tried to get a URL containing ".git":

go mod init foo
go get dgl.cx/foo.git

What did you expect to see?

Per https://go.dev/ref/mod#vcs-find

If the module path has a VCS qualifier (one of .bzr, .fossil, .git, .hg, .svn) at the end of a path component, the go command will use everything up to that path qualifier as the repository URL

[...]

If the URL does not include a scheme (either because the module path has a VCS qualifier or because the tag lacks a scheme), the go command will try each protocol supported by the version control system. For example, with Git, the go command will try https:// then git+ssh://. Insecure protocols (like http:// and git://) may only be used if the module path is matched by the GOINSECURE environment variable.

i.e. I expected that as described it will try the two schemes https and git+ssh in turn.

What did you see instead?

I've definitely not set GOINSECURE, but I see:

go: module dgl.cx/foo.git: git ls-remote -q origin in /go/pkg/mod/cache/vcs/b982d3896f60780c91477b0905164a9bb9b91a39d383c88b4152672c759055ab: exit status 128:
	fatal: unable to connect to dgl.cx:
	dgl.cx[0: [ipv4 address elided]]: errno=Connection refused
	dgl.cx[1: [ipv6 address elided]]: errno=Cannot assign requested address

It's definitely trying to connect over plain git protocol (git://):

$ sudo tcpdump -n port git
[...]
12:40:25.143285 IP [ip elided].53232 > [ip elided].9418: Flags [S], seq 3202314552, win 64240, options [mss 1460,sackOK,TS val 1040977568 ecr 0,nop,wscale 7], length 0

[seankhliao]

I see

$ go get -x dgl.cx/foo.git
# get https://dgl.cx/?go-get=1
cd /go/pkg/mod
git ls-remote https://dgl.cx/foo
# get https://dgl.cx/?go-get=1: 200 OK (0.155s)
cd /go/pkg/mod
git ls-remote git+ssh://dgl.cx/foo
cd /go/pkg/mod
git ls-remote ssh://dgl.cx/foo
mkdir -p /go/pkg/mod/cache/vcs # git3 git://dgl.cx/foo
# lock /go/pkg/mod/cache/vcs/b982d3896f60780c91477b0905164a9bb9b91a39d383c88b4152672c759055ab.lock
# /go/pkg/mod/cache/vcs/b982d3896f60780c91477b0905164a9bb9b91a39d383c88b4152672c759055ab for git3 git://dgl.cx/foo
cd /go/pkg/mod/cache/vcs/b982d3896f60780c91477b0905164a9bb9b91a39d383c88b4152672c759055ab; git ls-remote -q origin
0.091s # cd /go/pkg/mod/cache/vcs/b982d3896f60780c91477b0905164a9bb9b91a39d383c88b4152672c759055ab; git ls-remote -q origin
go: module dgl.cx/foo.git: git ls-remote -q origin in /go/pkg/mod/cache/vcs/b982d3896f60780c91477b0905164a9bb9b91a39d383c88b4152672c759055ab: exit status 128:
	fatal: unable to connect to dgl.cx:
	dgl.cx[0: 51.15.69.169]: errno=Connection refused
	dgl.cx[1: 2001:bc8:1820:23b::1]: errno=Cannot assign requested address

looks like the git origin was saved with git:// ?

[gopherbot]

Change https://go.dev/cl/539321 mentions this issue: cmd/go/internal/vcs: error out if the requested repo does not support a secure protocol

[bcmills]

@gopherbot, please backport to Go 1.21 and 1.20.

[gopherbot]

Backport issue(s) opened: #63972 (for 1.20), #63973 (for 1.21).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/540257 mentions this issue: cmd/go/internal/vcs: error out if the requested repo does not support a secure protocol

[gopherbot]

Change https://go.dev/cl/540335 mentions this issue: [release-branch.go1.20] cmd/go/internal/vcs: error out if the requested repo does not support a secure protocol