cmd/go: Permission Denied when downloading a private module with go get

[arieroos]

What version of Go are you using (go version)?

$ go version
go version go1.18.2 darwin/amd64

Does this issue reproduce with the latest release?

Yes. Assuming 1.18.2 is the latest release.

I tested with go1.16.5 to ensure that it wasn't a config issue on my machine, but I managed to successfully install the same module with go1.16 on the same machine.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/arieroos/Library/Caches/go-build"
GOENV="/Users/arieroos/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/arieroos/Workspace/go/pkg/mod"
GONOPROXY="github.com/Direct-Debit"
GONOSUMDB="github.com/Direct-Debit"
GOOS="darwin"
GOPATH="/Users/arieroos/Workspace/go"
GOPRIVATE="github.com/Direct-Debit"
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/Users/arieroos/Workspace/go/go1.18.2"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/Users/arieroos/Workspace/go/go1.18.2/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.18.2"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/arieroos/Workspace/NewProject/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/vf/k2jjqxc950x3ss37bswvhnt40000gn/T/go-build145816414=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

I tried downloading a private module by running:

export GOPRIVATE=github.com/Private-Org
go get github.com/Private-Org/go-commons 

What did you expect to see?

I expected my private module to be downloaded.

What did you see instead?

I got this output:

go: module github.com/Private-Org/go-commons: git ls-remote -q origin in /Users/arieroos/Workspace/go/pkg/mod/cache/vcs/4371bddb1b5a61a8f85ece4f86eaa40bbac4cc02925be418880bcce25aafa433: exit status 128:
        [email protected]: Permission denied (publickey).
        fatal: Could not read from remote repository.
        
        Please make sure you have the correct access rights
        and the repository exists.

Additional Notes

• My public key is fine, I can successfully clone the repo in question and ssh -T [email protected] works as expected.
• We tried reproducing the issue on my colleague's machine (Ubuntu 20.04), but it works correctly on his machine.

[mknyszek]

CC @bcmills maybe?

[seankhliao]

Show your git config and ssh setup?
also, go get -v -x ... output please.

[bcmills]

You need either an insteadOf clause in your .gitconfig or a personal access token in your .netrc. See #26134 (comment).

[bcmills]

Duplicate of #26134

[arieroos]

I don't think this is a duplicate of #26134, because I do have this in my gitconfig:

[url "ssh://[email protected]/"]
        insteadOf = https://github.com/

go get -v -x ... output:

mkdir -p /Users/arieroos/Workspace/go/pkg/mod/cache/vcs # git3 https://github.com/Private-Org/go-commons
# lock /Users/arieroos/Workspace/go/pkg/mod/cache/vcs/4371bddb1b5a61a8f85ece4f86eaa40bbac4cc02925be418880bcce25aafa433.lock# /Users/arieroos/Workspace/go/pkg/mod/cache/vcs/4371bddb1b5a61a8f85ece4f86eaa40bbac4cc02925be418880bcce25aafa433 for git3 https://github.com/Private-Org/go-commons
cd /Users/arieroos/Workspace/go/pkg/mod/cache/vcs/4371bddb1b5a61a8f85ece4f86eaa40bbac4cc02925be418880bcce25aafa433; git ls-remote -q origin
3.141s # cd /Users/arieroos/Workspace/go/pkg/mod/cache/vcs/4371bddb1b5a61a8f85ece4f86eaa40bbac4cc02925be418880bcce25aafa433; git ls-remote -q origin
# get https://github.com/Private-Org/go-commons
# get https://github.com/Private-Org/go-commons: 404 Not Found (1.131s)
# get https://proxy.golang.org/github.com/@v/list
# get https://proxy.golang.org/github.com/@v/list: 410 Gone (1.423s)
go: module github.com/Private-Org/go-commons: git ls-remote -q origin in /Users/arieroos/Workspace/go/pkg/mod/cache/vcs/4371bddb1b5a61a8f85ece4f86eaa40bbac4cc02925be418880bcce25aafa433: exit status 128:
        [email protected]: Permission denied (publickey).
        fatal: Could not read from remote repository.
        
        Please make sure you have the correct access rights
        and the repository exists.

[seankhliao]

and what happens if you do:

cd /Users/arieroos/Workspace/go/pkg/mod/cache/vcs/4371bddb1b5a61a8f85ece4f86eaa40bbac4cc02925be418880bcce25aafa433; git ls-remote -q origin

[arieroos]

@seankhliao That command runs successfully. It asks for my private key passphrase and the lists all the refs in the repo.

I also downgraded my project go version to 1.17, which gave the same issue. However, I don't get this issue with 1.16. So it seems that the go get changes between 1.16 and 1.17 might have something to do with this.

[al-villalba]

@arieroos , I've been fighting with a similar problem and this is what worked for me:

[email protected]: Permission denied (publickey) tells you that go get is not using a password nor a ssh key.

Whilst commands like git fetch, git pull worked for me on the same repository because I was using an ssh key set up in ~/.ssh/config (as alias), it looked as if go get did not take any configuration from ~/.ssh/config.

So next; I checked out why my ssh key was not used. Looking around, I found out that go get needed the key to be added to the ssh-agent. Hence,

• I listed the keys added to the agent with ssh-add -l
• I verified that the key I had to use for the authentication was not added to the agent
• I added the key: ssh-add ~/.ssh/<your_private.key>
• And bingo! go get worked!

I hope this helps.

[arieroos]

@al-villalba That worked! Thanks a million!

[seankhliao]

https://go.dev/doc/go1.17#password-prompts

go doesn't look at (or care about) ssh, it's up to git the user to ensure https://git/repo is translated into something that can be fetched automatically

[al-villalba]

It's not about what method to use for authentication, ssh or https. It's about how to use ssh+key, as this method is the preferred method for corporate private repositories and often is the only one.

Don't take me wrong, but if I can login to a remote machine with ssh, copy files remotely with scp, fetch content from private repositories with git fetch, using my keys set up in ~/.ssh/config, I will expect go get will be able to download using ~/.ssh/config. And this doesn't seem to be the case.

[bcmills]

It's about how to use ssh+key, as this method is the preferred method for corporate private repositories and often is the only one.

Ah! In that case, I think #49515 is probably a better fit. See specifically #49515 (comment) for details.

[arieroos]

https://go.dev/doc/go1.17#password-prompts

Ah. I missed that when I originally read the release notes.
Thanks everyone for your help!