Solve the problem of go mod download dependency report 410 Gone error

background

Manage dependency packages through go mod. Several dependencies are private warehouses. There is no problem downloading them before. I just upgraded the Go version to 13 recently. I found that I couldn't pull it down and reported 410 Gone. (in fact, the semantics of this error is the same as that of HTTP Code 410, indicating that the access to resources is no longer available on the source server)

The detailed error is similar to the following:

go get -v bitbucket.org/compay/lucifer
go: finding bitbucket.org/compay/lucifer latest
go: downloading bitbucket.org/compay/lucifer v0.0.0-20190921175342-61a76c096369
verifying bitbucket.org/compay/lucifer@v0.0.0-20190921175342-61a76c096369: bitbucket.org/compay/lucifer@v0.0.0-20190921175342-61a76c096369: reading https://sum.golang.org/lookup/bitbucket.org/compay/lucifer@v0.0.0-20190921175342-61a76c096369: 410 Gone

problem analysis

I found information on the Internet and found that it is really related to the version upgrade of Go.

The root cause of the problem is go1 After version 13, the mechanism of Modules has been changed. GOPROXY can now be set to a comma separated list of proxy URL s, or to the special tag direct, whose default value is https://proxy.golang.org,direct. When parsing the path of a package to its module, the go command will continuously try all candidate module paths on each proxy server in the list. If the proxy server is unreachable or an HTTP status code other than 404 or 410 appears, the search will be terminated without requesting the remaining proxy servers.

Newly introduced GOPRIVATE Environment variables. It defines the module path that is not exposed to the public as the default value of low-level GONOPROXY and GONOSUMDB variables. These two variables provide the ability of proxy and verification through checksum database.

solve

There are two solutions: one is to use the GOPRIVATE environment variable to take the internal agent, and the other is to use the GONOSUMDB environment variable.

Use GOPRIVATE

As mentioned above, if the proxy server cannot reach, such as an error accessing 410 Gone, try to continue downloading the dependent package from the list of proxy servers defined by GOPRIVATE. Can be in their own ~ / In bashrc (or ~ /. zshrc), add the following command:

export GOPRIVATE="gitlab.com/idmabar,bitbucket.org/idmabar,github.com/idmabar"

Then try to pull the package again through go get:

$ go get bitbucket.org/company/lucifer
go: finding bitbucket.org/company/lucifer latest
go: downloading bitbucket.org/company/lucifer v0.0.0-20190921175342-61a76c096369
go: extracting bitbucket.org/company/lucifer v0.0.0-20190921175342-61a76c096369

Using GONOSUMDB

No attempt has been made. For details, please refer to this paper: Proposal: Secure the Public Go Module Ecosystem

Simply put, it is to define the GONOSUMDB variable:

export GONOSUMDB="gitlab.com/idmabar,bitbucket.org/idmabar,github.com/idmabar"

summary

This article sorted out how to solve the problem of go mod download dependency report 410 Gone error. This problem is only in go1 It was introduced after version 13. Therefore, after upgrading some software on the system, it is found that the behavior is different from that before, or the operation error is probably caused by the change of the software. In fact, most of the faults on the line are also caused by changes. Corresponding to the problems caused by changes, we need to find the change point or discovery faster to respond quickly.

reference resources

  1. go modules in version 1.13
  2. Proposal: Secure the Public Go Module Ecosystem
  3. go private repo - answer from Stackoverflow
  4. Provying a checksum dateabase API

Tags: Go

Posted by pastet89 on Sat, 14 May 2022 06:34:06 +0300