dependabot / dependabot/dependabot-core

Problems with detecting updates of Golang dependencies in private repositories

Open
#1,884 7 comments 9 reactions 0 assignees View on GitHub
F: private-registries 💂‍♂️ L: go:modules T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

**Package manage/ecosystem**
go_modules

**Manifest contents prior to update**
```
module go.my-company.com/our-service

go 1.13

require (
...
go.my-company.com/private-dependency.git v1.0.2
...
)
```

**Updated dependency**
from `go.my-company.com/private-dependency.git v1.0.2` to `go.my-company.com/private-dependency.git v1.1.0`

**What you expected to see, versus what you actually saw**

I'd expect a pull request for `go.my-company.com/private-dependency.git v1.1.0`

What I actually get is an error message like this

```
/usr/local/bundle/gems/dependabot-go_modules-0.113.28/lib/dependabot/go_modules/file_parser.rb:145:in `handle_parser_error': go: go.my-company.com/private-dependency.git@v1.0.2: reading go.my-company.com/private-dependency.git/go.mod at revision v1.0.2: unknown revision v1.0.2 (Dependabot::DependencyFileNotResolvable)
from /usr/local/bundle/gems/dependabot-go_modules-0.113.28/lib/dependabot/go_modules/file_parser.rb:90:in `block (2 levels) in module_info'
from /usr/local/bundle/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:143:in `with_git_configured'
from /usr/local/bundle/gems/dependabot-go_modules-0.113.28/lib/dependabot/go_modules/file_parser.rb:71:in `block in module_info'
from /usr/local/bundle/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `block (2 levels) in in_a_temporary_directory'
from /usr/local/bundle/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `chdir'
from /usr/local/bundle/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:37:in `block in in_a_temporary_directory'
from /usr/local/lib/ruby/2.6.0/tmpdir.rb:93:in `mktmpdir'
from /usr/local/bundle/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:34:in `in_a_temporary_directory'
from /usr/local/bundle/gems/dependabot-go_modules-0.113.28/lib/dependabot/go_modules/file_parser.rb:70:in `module_info'
from /usr/local/bundle/gems/dependabot-go_modules-0.113.28/lib/dependabot/go_modules/file_parser.rb:20:in `parse'
from ./update.rb:95:in `'
```

**Images of the diff or a link to the PR, issue or logs**
*not applicable*

**Background**

We use

```
git config --global url."https://OAuth:${SYSTEM_ACCESSTOKEN}@dev.visualstudio.com/org/project/_git/".insteadOf "git://go.my-company.com/"
```
to redirect go mod dependency requests to `git://go.my-company.com`, which works for all dependency-related operations with go mod but seems to raise issues with the `dependabot-core/go_modules/helpers/install-dir/go_modules/bin/helper` utility.

If I run

```
echo '{"function":"getUpdatedVersion","args":{"dependency":{"name":"go.my-company.com/private-dependency.git","version":"v1.0.2","indirect":false}}}' | /Users/mimi/workspace/github/dependabot-core/go_modules/helpers/install-dir/go_modules/bin/helper
```

on my laptop, things work as expected and I see

```
{"result":"v1.1.0"}
```

If I run it within dependabot-core, I either get the error mentioned above, or I get

```
/Users/mimi/.rbenv/versions/2.6.5/lib/ruby/gems/2.6.0/gems/dependabot-common-0.113.28/lib/dependabot/shared_helpers.rb:112:in `run_helper_subprocess': git ls-remote -q git://go.my-company.com/private-dependency in /Users/mimi/workspace/go/pkg/mod/cache/vcs/104cd3930c025d3880a366f9222d12c72e76daf950d49cd5534b9fbe2f3bf3c1: exit status 128: (Dependabot::SharedHelpers::HelperSubprocessFailed)
fatal: unable to look up go.my-company.com (port 9418) (nodename nor servname provided, or not known)
```

so it seems like the

```
[url "https://OAuth:TOKEN@dev.visualstudio.com/org/project/_git/"]
insteadOf = git://go.my-company.com/
```

in my `.gitconfig` is not used when running dependabot.

A `git ls-remote -q git://go.my-company.com/private-dependency` shows the refs as expected.

Thanks for your assistance!

Contributor guide

Open the contributing guide

Research direction

Start with dependabot/go_modules/file_parser.rb and the go_modules/helpers/install-dir/go_modules/bin/helper utility mentioned in the trace. Reproduce getUpdatedVersion and compare its git configuration behavior with the standalone command, including git ls-remote. Done means private Go module updates resolve the existing version and return v1.1.0 without a parser or helper subprocess error.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, go, ruby
Domain
tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.