6

We are using private Bitbucket repositories to manage our Go libraries. By using the insteadOf config for git as described e.g. in this Stackoverflow answer, we had a working build up to Go version 1.12. Versions 1.13 and 1.14 do not work any more. We are seeing errors like this:

$ go vet ./...
go: downloading bitbucket.org/travelloapp/golibs v1.0.42
usercache/usercache.go:6:2: bitbucket.org/travelloapp/golibs@v1.0.42: verifying module: bitbucket.org/travelloapp/golibs@v1.0.42: reading https://sum.golang.org/lookup/bitbucket.org/travelloapp/golibs@v1.0.42: 410 Gone
        server response:
        not found: bitbucket.org/travelloapp/golibs@v1.0.42: reading https://api.bitbucket.org/2.0/repositories/travelloapp/golibs?fields=scm: 403 Forbidden
                server response: Access denied. You must have write or admin access.

The Go FAQ proposes to set up curl's ~/.netrc file. I've done that, using Bitbucket's "App Password" feature. It is not changing the result. I have added both bitbucket.org and api.bitbucket.org as host names.

I can test the file setup is correct with curl directly:

$ curl -n https://api.bitbucket.org/2.0/repositories/travelloapp/golibs?fields=scm
{"scm": "git"}

For the record: despite the Bitbucket error message. repository read access seems to be the only permission required, although I have tried with all permissions enabled as well.

Am I missing something? Why did the approach that works for Go 1.12 stop working for higher versions?

I'm currently using:

$ go version
go version go1.14.2 linux/amd64
$ git version
git version 2.17.1
$ curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.1 zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp 
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy PSL

We encountered the issue first when Go 1.13 came out, at the moment we are still holding all environments back on 1.12.

Peter Becker
  • 8,795
  • 7
  • 41
  • 64
  • If you are a commercial company, I would suggest that you look into Athens goproxy (https://github.com/gomods/athens/). It is simpler infra than managing environments of all developers. It is an active project with number of deployments in production. – praveent Apr 28 '20 at 02:12
  • 1
    See https://stackoverflow.com/a/58372469/7426 – Adrian Apr 28 '20 at 13:42

1 Answers1

4

Since go@1.13 to have a behavior similar to previous versions, you need to set GOPRIVATE environmental variable for private repositories

jano
  • 735
  • 7
  • 20