cmd/go: `go build` running `hg pull -f` in mercurial repository resulting in passphrase prompt

[bastianjoel]

Go version

go version go1.26.2 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/xxx/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/xxx/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3167022197=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/home/xxx/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/xxx/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/xxx/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.2'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

I have a project contained in a mercurial repository. When running go build it executes hg pull -f which triggers a prompt requesting credentials. This is a bit annoying. Also I do not want a go build to have such side effects. This is totally unexpected.

What did you see happen?

xxx@xxx:~/Projects/gemma$ go build -x -o ./cmd/gemma/gemma ./cmd/gemma
WORK=/tmp/go-build3922253331
cd /home/xxx/Projects/gemma
hg log -r. -T {node}:{date|hgdate}
cd /home/xxx/Projects/gemma
hg status -S
cd /home/xxx/Projects/gemma; hg pull -f
Enter passphrase for key '/home/xxx/.ssh/id_rsa':

What did you expect to see?

This behavior was introduced in go 1.26.0. We verified that this does not happen in go 1.25.x. This seems to be related to 426ef30 (#75119).

I do not expect a go build to run hg pull -f in my project.

[dr2chase]

@rsc @golang/command-line

[xxxserxxx]

It's not just the password prompt; it has a large impact on compile times, especially for smaller projects:

$ cat go.mod
module ser1.net/changelog

go 1.26.3
$ time go build -x .
WORK=/tmp/go-build172862819
cd /home/ser/workspace/changelog
hg log -r. -T {node}:{date|hgdate}
cd /home/ser/workspace/changelog
hg status -S
cd /home/ser/workspace/changelog; hg pull -f
5.143s # cd /home/ser/workspace/changelog; hg pull -f
cd /home/ser/workspace/changelog; hg branches -c -q
0.211s # cd /home/ser/workspace/changelog; hg branches -c -q
cd /home/ser/workspace/changelog; hg log -l1 --rev=b8c7f9e10055ddbadb8a77ae57f7e67431017b47 --template '{node} {date|hgdate} {tags}'
0.217s # cd /home/ser/workspace/changelog; hg log -l1 --rev=b8c7f9e10055ddbadb8a77ae57f7e67431017b47 --template '{node} {date|hgdate} {tags}'
cd /home/ser/workspace/changelog; hg tags -q
0.211s # cd /home/ser/workspace/changelog; hg tags -q
cd /home/ser/workspace/changelog; hg --config=extensions.goreposum=/usr/lib/go/lib/hg/goreposum.py goreposum -- .
0.230s # cd /home/ser/workspace/changelog; hg --config=extensions.goreposum=/usr/lib/go/lib/hg/goreposum.py goreposum -- .
cd /home/ser/workspace/changelog; hg log '--rev=ancestors(b8c7f9e10055ddbadb8a77ae57f7e67431017b47) and tag()' --template '{tags}
'
0.225s # cd /home/ser/workspace/changelog; hg log '--rev=ancestors(b8c7f9e10055ddbadb8a77ae57f7e67431017b47) and tag()' --template '{tags}
'
cd /home/ser/workspace/changelog; hg log -l1 --rev=b8c7f9e10055 --template '{node} {date|hgdate} {tags}'
0.223s # cd /home/ser/workspace/changelog; hg log -l1 --rev=b8c7f9e10055 --template '{node} {date|hgdate} {tags}'
cd /home/ser/workspace/changelog; hg cat --rev=b8c7f9e10055 -- go.mod
0.221s # cd /home/ser/workspace/changelog; hg cat --rev=b8c7f9e10055 -- go.mod
go build -x .  1.94s user 0.38s system 32% cpu 7.141 total

Turn off GOPROXY and build times go from 7s to sub-second:

$ hyperfine --warmup 1 -- 'go build .'
Benchmark 1: go build .
  Time (mean ± σ):      7.020 s ±  0.152 s    [User: 1.995 s, System: 0.381 s]
  Range (min … max):    6.802 s …  7.330 s    10 runs
$ export GOPROXY=off
$ hyperfine --warmup 1 -- 'go build .'
Benchmark 1: go build .
  Time (mean ± σ):     477.5 ms ±  10.2 ms    [User: 442.0 ms, System: 101.0 ms]
  Range (min … max):   461.5 ms … 497.9 ms    10 runs

Moving .hg (renaming to _hg) is the same as disabling GOPROXY.

I do not see this same behavior in git projects: go build does not try to make network fetches in git projects.

I'm fairly certain this is a regression, as most of my projects are Mercurial and I've only noticed these long build times recently.

[bastianjoel]

@rsc Any updates? This is getting quite annoying as those changes are messing with my working directory.
When switching back and forth between branches I am now not guaranteed to have the same codebase when doing builds in between. Especially for people who do not know about that bug I can imagine that this can be quite confusing.

IMHO 426ef30 should be reverted in case a fix is not easy to implement.

[xxxserxxx]

@bastianjoel Did you bisect, or is 426ef30 an educated guess? Not that I can do anything with the information; I'm just curious.

[bastianjoel]

@xxxserxxx I did not bisect but building from source with 426ef30 reverted fixes the problem. So not a guess anymore.