cmd/go/internal/modfetch: add GOINSECURE

Enables insecure fetching of dependencies whos path matches those specified in
the enironment variable GOINSECURE.

Fixes #32966

Change-Id: I378920fbd5a4436df0b5af3fb5533e663e2cc758
GitHub-Last-Rev: 2c87b303acbe86e273bd0b8514e338d34794b0d6
GitHub-Pull-Request: golang/go#35357
Reviewed-on: https://go-review.googlesource.com/c/go/+/205238
Run-TryBot: Bryan C. Mills <bcmills@google.com>
Reviewed-by: Bryan C. Mills <bcmills@google.com>
Reviewed-by: Jay Conrod <jayconrod@google.com>

diff --git a/src/cmd/go/alldocs.go b/src/cmd/go/alldocs.go
index fad2d9f0feb47f06d5f6b2327ed5204887a7f46d..0be368d5601c32a02544ab4a913c3d5c6f8cb2a5 100644 (file)
--- a/src/cmd/go/alldocs.go
+++ b/src/cmd/go/alldocs.go
@@ -1604,6 +1604,10 @@
 //             Because the entries are space-separated, flag values must
 //             not contain spaces. Flags listed on the command line
 //             are applied after this list and therefore override it.
+//     GOINSECURE
+//             Comma-separated list of glob patterns (in the syntax of Go's path.Match)
+//             of module path prefixes that should always be fetched in an insecure
+//             manner. Only applies to dependencies that are being fetched directly.
 //     GOOS
 //             The operating system for which to compile code.
 //             Examples are linux, darwin, windows, netbsd.

diff --git a/src/cmd/go/internal/cfg/cfg.go b/src/cmd/go/internal/cfg/cfg.go
index 1f7ece7165c7494ed0244767124a6672d5960e6a..61dc6bdda664779c6f2e29dd39f97072526f6850 100644 (file)
--- a/src/cmd/go/internal/cfg/cfg.go
+++ b/src/cmd/go/internal/cfg/cfg.go
@@ -245,11 +245,12 @@ var (
        GOPPC64  = envOr("GOPPC64", fmt.Sprintf("%s%d", "power", objabi.GOPPC64))
        GOWASM   = envOr("GOWASM", fmt.Sprint(objabi.GOWASM))
 
-       GOPROXY   = envOr("GOPROXY", "https://proxy.golang.org,direct")
-       GOSUMDB   = envOr("GOSUMDB", "sum.golang.org")
-       GOPRIVATE = Getenv("GOPRIVATE")
-       GONOPROXY = envOr("GONOPROXY", GOPRIVATE)
-       GONOSUMDB = envOr("GONOSUMDB", GOPRIVATE)
+       GOPROXY    = envOr("GOPROXY", "https://proxy.golang.org,direct")
+       GOSUMDB    = envOr("GOSUMDB", "sum.golang.org")
+       GOPRIVATE  = Getenv("GOPRIVATE")
+       GONOPROXY  = envOr("GONOPROXY", GOPRIVATE)
+       GONOSUMDB  = envOr("GONOSUMDB", GOPRIVATE)
+       GOINSECURE = Getenv("GOINSECURE")
 )
 
 // GetArchEnv returns the name and setting of the

diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go
index 023d542d8856192a03b1d697aa17e1661f6aa369..ff4a7e4a46aecceb80948c55db84cee4c91b2d8c 100644 (file)
--- a/src/cmd/go/internal/envcmd/env.go
+++ b/src/cmd/go/internal/envcmd/env.go
@@ -75,6 +75,7 @@ func MkEnv() []cfg.EnvVar {
                {Name: "GOFLAGS", Value: cfg.Getenv("GOFLAGS")},
                {Name: "GOHOSTARCH", Value: runtime.GOARCH},
                {Name: "GOHOSTOS", Value: runtime.GOOS},
+               {Name: "GOINSECURE", Value: cfg.GOINSECURE},
                {Name: "GONOPROXY", Value: cfg.GONOPROXY},
                {Name: "GONOSUMDB", Value: cfg.GONOSUMDB},
                {Name: "GOOS", Value: cfg.Goos},

diff --git a/src/cmd/go/internal/help/helpdoc.go b/src/cmd/go/internal/help/helpdoc.go
index 1dc892cb325b872de04508fd721bf18876d9f2cf..ac16312aaf437d46da883a9e2fcc31df29b8431c 100644 (file)
--- a/src/cmd/go/internal/help/helpdoc.go
+++ b/src/cmd/go/internal/help/helpdoc.go
@@ -506,6 +506,10 @@ General-purpose environment variables:
                Because the entries are space-separated, flag values must
                not contain spaces. Flags listed on the command line
                are applied after this list and therefore override it.
+       GOINSECURE
+               Comma-separated list of glob patterns (in the syntax of Go's path.Match)
+               of module path prefixes that should always be fetched in an insecure
+               manner. Only applies to dependencies that are being fetched directly.
        GOOS
                The operating system for which to compile code.
                Examples are linux, darwin, windows, netbsd.

diff --git a/src/cmd/go/internal/modfetch/insecure.go b/src/cmd/go/internal/modfetch/insecure.go
new file mode 100644 (file)
index 0000000..8420432
--- /dev/null
+++ b/src/cmd/go/internal/modfetch/insecure.go
@@ -0,0 +1,16 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package modfetch
+
+import (
+       "cmd/go/internal/cfg"
+       "cmd/go/internal/get"
+       "cmd/go/internal/str"
+)
+
+// allowInsecure reports whether we are allowed to fetch this path in an insecure manner.
+func allowInsecure(path string) bool {
+       return get.Insecure || str.GlobsMatchPath(cfg.GOINSECURE, path)
+}

diff --git a/src/cmd/go/internal/modfetch/repo.go b/src/cmd/go/internal/modfetch/repo.go
index 39a3c076cd8432e9ddda1c0747484292cdc7e63a..4273da0317679a3dd9c44a23a3ba86c0c15312fa 100644 (file)
--- a/src/cmd/go/internal/modfetch/repo.go
+++ b/src/cmd/go/internal/modfetch/repo.go
@@ -257,7 +257,8 @@ var (
 
 func lookupDirect(path string) (Repo, error) {
        security := web.SecureOnly
-       if get.Insecure {
+
+       if allowInsecure(path) {
                security = web.Insecure
        }
        rr, err := get.RepoRootForImportPath(path, get.PreferMod, security)
@@ -302,7 +303,7 @@ func ImportRepoRev(path, rev string) (Repo, *RevInfo, error) {
        // version control system, we ignore meta tags about modules
        // and use only direct source control entries (get.IgnoreMod).
        security := web.SecureOnly
-       if get.Insecure {
+       if allowInsecure(path) {
                security = web.Insecure
        }
        rr, err := get.RepoRootForImportPath(path, get.IgnoreMod, security)

diff --git a/src/cmd/go/testdata/script/mod_convert_tsv_insecure.txt b/src/cmd/go/testdata/script/mod_convert_tsv_insecure.txt
new file mode 100644 (file)
index 0000000..f0d0b27
--- /dev/null
+++ b/src/cmd/go/testdata/script/mod_convert_tsv_insecure.txt
@@ -0,0 +1,24 @@
+env GO111MODULE=on
+
+# secure fetch should report insecure warning
+cd $WORK/test
+go mod init
+stderr 'redirected .* to insecure URL'
+
+# insecure fetch should not
+env GOINSECURE=*.golang.org
+rm go.mod
+go mod init
+! stderr 'redirected .* to insecure URL'
+
+# insecure fetch invalid path should report insecure warning
+env GOINSECURE=foo.golang.org
+rm go.mod
+go mod init
+stderr 'redirected .* to insecure URL'
+
+-- $WORK/test/dependencies.tsv --
+vcs-test.golang.org/insecure/go/insecure       git     6fecd21f7c0c    2019-09-04T18:39:48Z 
+
+-- $WORK/test/x.go --
+package x // import "m"

diff --git a/src/cmd/go/testdata/script/mod_get_insecure_redirect.txt b/src/cmd/go/testdata/script/mod_get_insecure_redirect.txt
index a83b17672d4c1ded8935e5ad1acfa7c6062c9785..3755f1763321e66a41cc0b04dcc6b66296404dd7 100644 (file)
--- a/src/cmd/go/testdata/script/mod_get_insecure_redirect.txt
+++ b/src/cmd/go/testdata/script/mod_get_insecure_redirect.txt
@@ -11,3 +11,24 @@ env GOSUMDB=off
 stderr 'redirected .* to insecure URL'
 
 go get -d -insecure vcs-test.golang.org/insecure/go/insecure
+
+# insecure host
+env GOINSECURE=vcs-test.golang.org
+go clean -modcache
+go get -d vcs-test.golang.org/insecure/go/insecure
+
+# insecure glob host
+env GOINSECURE=*.golang.org
+go clean -modcache
+go get -d vcs-test.golang.org/insecure/go/insecure
+
+# insecure multiple host
+env GOINSECURE=somewhere-else.com,*.golang.org
+go clean -modcache
+go get -d vcs-test.golang.org/insecure/go/insecure
+
+# different insecure host does not fetch
+env GOINSECURE=somewhere-else.com
+go clean -modcache
+! go get -d vcs-test.golang.org/insecure/go/insecure
+stderr 'redirected .* to insecure URL'

diff --git a/src/cmd/go/testdata/script/mod_sumdb_cache.txt b/src/cmd/go/testdata/script/mod_sumdb_cache.txt
index 486bdf5ecf6c6da4453cf8fa7014104abbe64f29..2937b2e4dcd66afce921342bcbf6ae7f13d80a0b 100644 (file)
--- a/src/cmd/go/testdata/script/mod_sumdb_cache.txt
+++ b/src/cmd/go/testdata/script/mod_sumdb_cache.txt
@@ -37,7 +37,14 @@ env GOPROXY=$proxy/sumdb-504
 ! go get -d rsc.io/quote@v1.5.2
 stderr 504
 
+# GOINSECURE does not bypass checksum lookup
+env GOINSECURE=rsc.io
+env GOPROXY=$proxy/sumdb-504
+! go get -d rsc.io/quote@v1.5.2
+stderr 504
+
 # but -insecure bypasses the checksum lookup entirely
+env GOINSECURE=
 go get -d -insecure rsc.io/quote@v1.5.2
 
 # and then it is in go.sum again

diff --git a/src/internal/cfg/cfg.go b/src/internal/cfg/cfg.go
index 4c2cf8ee8b6ee380fa4858c2cfd5dea664871afd..0d227ecd1009ff8f3cf3652b2321d67a25e0e7ae 100644 (file)
--- a/src/internal/cfg/cfg.go
+++ b/src/internal/cfg/cfg.go
@@ -43,6 +43,7 @@ const KnownEnv = `
        GOGCCFLAGS
        GOHOSTARCH
        GOHOSTOS
+       GOINSECURE
        GOMIPS
        GOMIPS64
        GONOPROXY