{"record":{"id":"7a25e06957f10079","repo":"golang/go","slug":"govcs-disallows-using-s-for-s-s-see-go-help-v","errorCode":null,"errorMessage":"GOVCS disallows using %s for %s %s; see 'go help vcs'","messagePattern":"GOVCS disallows using (.+?) for (.+?) (.+?); see 'go help vcs'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/vcs/vcs.go","lineNumber":748,"sourceCode":"\t\t// and are always allowed.\n\t\treturn nil\n\t}\n\n\tgovcsOnce.Do(func() {\n\t\tgovcs, govcsErr = parseGOVCS(os.Getenv(\"GOVCS\"))\n\t\tgovcs = append(govcs, defaultGOVCS...)\n\t})\n\tif govcsErr != nil {\n\t\treturn govcsErr\n\t}\n\n\tprivate := module.MatchPrefixPatterns(cfg.GOPRIVATE, root)\n\tif !govcs.allow(root, private, vcs.Cmd) {\n\t\twhat := \"public\"\n\t\tif private {\n\t\t\twhat = \"private\"\n\t\t}\n\t\treturn fmt.Errorf(\"GOVCS disallows using %s for %s %s; see 'go help vcs'\", vcs.Cmd, what, root)\n\t}\n\n\treturn nil\n}\n\n// RepoRoot describes the repository root for a tree of source code.\ntype RepoRoot struct {\n\tRepo     string // repository URL, including scheme\n\tRoot     string // import path corresponding to the SubDir\n\tSubDir   string // subdirectory within the repo (empty for root)\n\tIsCustom bool   // defined by served <meta> tags (as opposed to hard-coded pattern)\n\tVCS      *Cmd\n}\n\nfunc httpPrefix(s string) string {\n\tfor _, prefix := range [...]string{\"http:\", \"https:\"} {\n\t\tif strings.HasPrefix(s, prefix) {\n\t\t\treturn prefix","sourceCodeStart":730,"sourceCodeEnd":766,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/vcs/vcs.go#L730-L766","documentation":"checkGOVCS applies the parsed GOVCS rules (user-provided GOVCS plus built-in defaults) to a specific VCS/path combination. The built-in defaults allow only git and hg for public repositories, and all VCS types for private (GOPRIVATE-matched) repositories. If no rule permits the combination, the operation is blocked for security.","triggerScenarios":"`go get` of a public module hosted on SVN, Fossil, or Bazaar (disallowed by default GOVCS); or a custom restrictive GOVCS that excludes the VCS needed for a particular path.","commonSituations":"Fetching a public Fossil/Bazaar/SVN repo without configuring GOVCS; restrictive corporate GOVCS policy; GOPRIVATE not set for a private repo that uses a non-git/hg VCS.","solutions":["Add an explicit GOVCS rule for the path: `GOVCS=example.com:fossil,public:git|hg`","If the module is actually private, add its prefix to GOPRIVATE so the 'private: all' default applies","Run `go help vcs` to understand the GOVCS format and defaults","For broad access, set `GOVCS=*:all` (reduces security — understand the risk)"],"exampleFix":"# before: public Fossil repo blocked by default GOVCS\nexport GOPRIVATE=''\ngo get example.com/fossil-repo  # GOVCS disallows using fossil for public\n\n# after: add explicit GOVCS rule\nexport GOVCS=\"example.com:fossil\"\ngo get example.com/fossil-repo\n\n# or mark the path as private (if applicable)\nexport GOPRIVATE=\"example.com\"\ngo get example.com/fossil-repo","handlingStrategy":"validation","validationCode":"# Check whether the needed VCS is allowed by current GOVCS settings\n# List current GOVCS and defaults\nGOVCS_VAL=\"${GOVCS:-}\"\necho \"Current GOVCS: ${GOVCS_VAL:-<unset — defaults: public:git|hg, private:all>}\"\necho \"GOPRIVATE: ${GOPRIVATE:-<unset>}\"\necho \"If fetching a public SVN/Fossil/Bazaar repo, add an explicit GOVCS rule.\"\necho \"Example: GOVCS=example.com:fossil\"","typeGuard":null,"tryCatchPattern":"# Detect GOVCS denial and provide actionable guidance\nERR=$(go get $IMPORT_PATH 2>&1)\nif echo \"$ERR\" | grep -q 'GOVCS disallows'; then\n  echo 'Blocked by GOVCS policy. Options:'\n  echo '  1. Add GOVCS rule: export GOVCS=\"<domain>:<vcs>,public:git|hg\"'\n  echo '  2. Add to GOPRIVATE if the module is private: export GOPRIVATE=\"<domain>\"'\n  echo '  See: go help vcs'\nfi","preventionTips":["Document GOVCS requirements for projects using non-git/hg public repos","Set GOPRIVATE for internal/private modules to use the 'private: all' default","Review GOVCS policy before fetching modules from unusual VCS hosts"],"tags":["vcs","config","govcs","security","policy"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}