make download-deps fails with GOPROXY=direct

[pimzand]

Description

Building navidrome on Fedora 36 fails

Expected Behaviour

Build succeeds

Steps to reproduce

git clone https://github.com/navidrome/navidrome.git
cd navidrome
make setup

after quite a while:

go: github.com/wader/tag@v0.0.0-20200426234345-d072771f6a51: invalid version: unknown revision d072771f6a51
make: *** [Makefile:114: download-deps] Error 1

Platform information

• Navidrome version: git commit ce0db83
• Browser and version: n/a
• Operating System: Fedora 36, building from source

Additional information

golang 1.18.2

[pimzand]

The failing command is go mod download -x

In Fedora 36, dependencies are being fetched directly using git from the source, ie github.
In Ubuntu 22.04 LTS, they are being download as zip files via proxy.golang.org

I'm not sure what causes this difference in behaviour.
Fedora has golang 1.18.2, Ubuntu 1.18.1.

It appears to me that the build process is depending on an invalid cache, as
https://proxy.golang.org/github.com/wader/tag/@v/v0.0.0-20200426234345-d072771f6a51.zip exists but
https://github.com/wader/tag/@v/v0.0.0-20200426234345-d072771f6a51.zip does not.

[pimzand]

Ubuntu will fail too, if the GOPROXY environment variable is set to "direct", ie
GOPROXY=direct go mod download -x

Apparently, Ubuntu/Debian are hardcoding GOPROXY=https://proxy.golang.org/ into golang binaries.
Navidrome should not rely on that and set the GOPROXY environment variable it relies on in the Makefile.

[deluan]

Thanks for opening the GH issue and the investigation!

IMO, we should not "hardcode" configurations that are meant to allow the user to customize their environment. What if someone wants to use a different proxy?

I feel like this type of config should be set in the user's own environment (in .profile, .zshrc, .bashrc....)

[pimzand]

Yes, ideally we should be able to use any, or even better, no proxy.

But it turns out that as it is, the navidrome build depends on a specific proxy.
Navidrome depends on https://github.com/wader/tag/@v/v0.0.0-20200426234345-d072771f6a51.zip
which does not exist (anymore?) on github but appears to be cached on proxy.golang.org
Nobody seems to notice this, as quite conveniently, debian/ubuntu have hardcoded this proxy into their go compiler.
Clear your go cache, set GOPROXY=off in your environment and find out for yourself.

As long as this dependency exists, the hardcoding should be in the build script, so we do not depend on specific distro's doing the hardcoding for us.
Ideally, the "tag" dependency should be fixed so any or no proxy can be used.

[deluan]

Ideally, the "tag" dependency should be fixed so any or no proxy can be used.

Yes, IMO that's the solution. Thanks for your investigation. This dependency was hardcoded to a pending PR for that repo that solved an issue with Ogg files. Turns out the PR was merged and the original branch deleted, causing this issue.

I changed the go.mod to point to the new version of the package and after doing that I'm now able to build it in a clean installation with GOPROXY=direct, so I think this issue is solved and we don't need to hardcode the GOPROXY in our codebase.

Can you please remove this change from the PR #1767? I'll also take a look at ways to upgrade WebPack so we don't need to patch the create-react-app dependency.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.