Instructions for privately hosted go modules
drewwells opened this issue · 3 comments
It is clear that goproxy can be used for private repositories, but it is unclear how to correctly set this up. I have put goproxy on a computer with full ssh access (and populated GOPATH). I am able to use this to pull code from a machine without private repo access, but there's some caveats with it.
The client computer didn't appear to use the proxy if it could call git directly. So I removed ssh credentials to prevent this path. If I don't specify --insecure, then go get fails on sumdb checks.
This does not work, fails on sumdb
GONOPROXY=github.com/myorg GONOSUMDB=github.com/myorg go run *.go -listen=0.0.0.0:8082 -exclude "github.com/myorg" -proxy http://nope.nope
-> % GOPROXY=http://192.127.1.25:8082 go get -d -v github.com/myorg/myrepo@v1.6.4
github.com/myorg/myrepo@v1.6.4: verifying module: github.com/myorg/myrepo@v1.6.4: reading http://192.127.1.25:8082/sumdb/sum.golang.org/lookup/github.com/myorg/myrepo@v1.6.4: 410 Gone
server response: not found: github.com/myorg/myrepo@v1.6.4: invalid version: unknown revision v1.6.4
Disabling sumdb checks makes it work
GOPROXY=http://192.127.1.25:8082 go get --insecure -d -v github.com/myorg/myrepo@v1.6.4
go get: -insecure flag is deprecated; see 'go help get' for details
go: downloading github.com/myorg/myrepo v1.6.4
I am running into similar issues but not always.
The public sumdb is used for private repositories (e.g. repositories under --exclude).
Documentation on how to configure for internally hosted repositories is more than welcome.
Sometimes I need to restart the service a few times and then suddenly it starts to function.
Since this issue is stale for 3.5 months, I wonder if this repo is still supported in any way.
After further investigation, I found out that most of the issues I was running was caused by:
- using an older version of go (1.13.8) which has less specific error messages compared to version 1.16.7 that I am running right now. With the better error reporting I was able to solve the issues I had and it looks like to be stable now
- apparently I was not following the right procedure to update a dependency. How I always did it was changing the version in go.mod and that was it. The effect was however that the has in go.sum was not updated and the build on the build server would fail with a bad gateway error. The right procedure is to run a
go get <dependency name>which updates both go.mod and go.sum . - I did not retest it but I think it is necessary to add the wildcard (*) to the exclude repos that is put a flags to starting the goproxy service. If the wildcard is not there, it looks like goproxy treats my dependency as an external one instead of a private rep.
I hope this feedback is useful.
I meet that issue also, it's running good after setting GOPRIVATE on proxy machine