{"record":{"id":"8cbbfcdd84b51664","repo":"golang/go","slug":"s-and-s-disagree-about-go-import-for-s","errorCode":null,"errorMessage":"%s and %s disagree about go-import for %s","messagePattern":"(.+?) and (.+?) disagree about go-import for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/vcs/vcs.go","lineNumber":1045,"sourceCode":"\t}\n\t// If the import was \"uni.edu/bob/project\", which said the\n\t// prefix was \"uni.edu\" and the RepoRoot was \"evilroot.com\",\n\t// make sure we don't trust Bob and check out evilroot.com to\n\t// \"uni.edu\" yet (possibly overwriting/preempting another\n\t// non-evil student). Instead, first verify the root and see\n\t// if it matches Bob's claim.\n\tif mmi.Prefix != importPath {\n\t\tif cfg.BuildV {\n\t\t\tlog.Printf(\"get %q: verifying non-authoritative meta tag\", importPath)\n\t\t}\n\t\tvar imports []metaImport\n\t\turl, imports, err = metaImportsForPrefix(mmi.Prefix, mod, security)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tmetaImport2, err := matchGoImport(imports, importPath)\n\t\tif err != nil || mmi != metaImport2 {\n\t\t\treturn nil, fmt.Errorf(\"%s and %s disagree about go-import for %s\", resp.URL, url, mmi.Prefix)\n\t\t}\n\t}\n\n\tif err := validateRepoSubDir(mmi.SubDir); err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: invalid subdirectory %q: %v\", resp.URL, mmi.SubDir, err)\n\t}\n\n\tif err := validateRepoRoot(mmi.RepoRoot); err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: invalid repo root %q: %v\", resp.URL, mmi.RepoRoot, err)\n\t}\n\tvar vcs *Cmd\n\tif mmi.VCS == \"mod\" {\n\t\tvcs = vcsMod\n\t} else {\n\t\tvcs = vcsByCmd(mmi.VCS)\n\t\tif vcs == nil {\n\t\t\treturn nil, fmt.Errorf(\"%s: unknown vcs %q\", resp.URL, mmi.VCS)\n\t\t}","sourceCodeStart":1027,"sourceCodeEnd":1063,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/vcs/vcs.go#L1027-L1063","documentation":"Emitted during the non-authoritative-meta-tag verification step. When a meta tag's prefix is shorter than the import path (the 'Bob at uni.edu' anti-spoofing scenario), go re-fetches the declared prefix via metaImportsForPrefix and requires both sources to agree. If the second source lacks the entry or differs in VCS/RepoRoot/SubDir, this error names both URLs and the prefix.","triggerScenarios":"importPath='uni.edu/bob/x' where the first fetch declares prefix 'uni.edu'; go re-fetches 'uni.edu' and the second meta-import set either omits the entry or yields mmi != metaImport2.","commonSituations":"Partial misconfiguration where a subpath declares a broader prefix than the root actually serves; mid-migration vanity setups; inconsistent vanity server behind a CDN cache.","solutions":["Make the root prefix's go-import meta tags authoritative and identical to what subpaths declare","Set the meta tag prefix to exactly the import path (authoritative) so verification is skipped","Re-deploy the vanity server so all paths return consistent go-import tags"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Make the meta tag authoritative (prefix == importPath) to skip verification\n// <meta name=\"go-import\" content=\"uni.edu/bob/x git https://evilroot.com/bob/x\">","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep prefix declarations consistent across all paths of the vanity host","Prefer authoritative prefixes (prefix == import path) to avoid the re-verification round-trip"],"tags":["go","modules","vcs","vanity","security"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}