{"record":{"id":"2b00772184afb0c7","repo":"golang/go","slug":"no-lookupref","errorCode":null,"errorMessage":"no lookupRef","messagePattern":"no lookupRef","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/cmd/go/internal/modfetch/codehost/vcs.go","lineNumber":359,"sourceCode":"\nfunc (r *vcsRepo) loadRepoSum(ctx context.Context) {\n\tif r.cmd.repoSum == nil {\n\t\treturn\n\t}\n\twhere := r.remote\n\tif r.fetched.Load() {\n\t\twhere = \".\" // use local repo\n\t}\n\tout, err := Run(ctx, r.dir, r.cmd.repoSum(where))\n\tif err != nil {\n\t\treturn\n\t}\n\tr.repoSum = strings.TrimSpace(string(out))\n}\n\nfunc (r *vcsRepo) lookupRef(ctx context.Context, ref string) (string, error) {\n\tif r.cmd.lookupRef == nil {\n\t\treturn \"\", fmt.Errorf(\"no lookupRef\")\n\t}\n\tout, err := Run(ctx, r.dir, r.cmd.lookupRef(r.remote, ref))\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn strings.TrimSpace(string(out)), nil\n}\n\n// repoSumOrigin returns an Origin containing a RepoSum.\nfunc (r *vcsRepo) repoSumOrigin(ctx context.Context) *Origin {\n\torigin := &Origin{\n\t\tVCS:     r.cmd.vcs,\n\t\tURL:     r.remote,\n\t\tRepoSum: r.repoSum,\n\t}\n\tr.repoSumOnce.Do(func() { r.loadRepoSum(ctx) })\n\torigin.RepoSum = r.repoSum\n\treturn origin","sourceCodeStart":341,"sourceCodeEnd":377,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/modfetch/codehost/vcs.go#L341-L377","documentation":"vcsRepo.lookupRef returns this when the active vcsCmd has no lookupRef function. The svn and fossil command descriptors do not define lookupRef, so any CheckReuse path that needs to resolve a hash by ref fails immediately with this sentinel.","triggerScenarios":"CheckReuse calls lookupRef on a svn or fossil repo (cmd.lookupRef==nil) when old.Ref or old.Hash needs verification — e.g. an origin record with a Ref but no RepoSum for a fossil-backed module.","commonSituations":"A fossil or svn vanity import whose cached origin lacks a RepoSum, forcing the hash-verification branch in CheckReuse which then needs lookupRef that those VCS types do not implement.","solutions":["Use the module proxy (GOPROXY) which bypasses the VCS lookupRef path entirely.","Run `go clean -modcache` to drop the un-verifiable origin record so a fresh one is created.","Migrate the upstream repo to git, which fully implements lookupRef."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func supportsLookupRef(vcs string) bool {\n    return vcs == \"git\" || vcs == \"hg\"\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid svn/fossil when reuse verification matters — use git or hg.","Route exotic VCS modules through GOPROXY so lookupRef is never invoked."],"tags":["vcs","svn","fossil","checkreuse","unsupported"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}