{"record":{"id":"f1b477e429934fe6","repo":"golang/go","slug":"unsupported-scheme-s","errorCode":null,"errorMessage":"unsupported scheme: %s","messagePattern":"unsupported scheme: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/web/http.go","lineNumber":233,"sourceCode":"\n\tif res == nil {\n\t\tswitch url.Scheme {\n\t\tcase \"http\":\n\t\t\tif security == SecureOnly {\n\t\t\t\tif cfg.BuildX {\n\t\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: insecure\\n\", url.Redacted())\n\t\t\t\t}\n\t\t\t\treturn nil, fmt.Errorf(\"insecure URL: %s\", url.Redacted())\n\t\t\t}\n\t\tcase \"\":\n\t\t\tif security != Insecure {\n\t\t\t\tpanic(\"should have returned after HTTPS failure\")\n\t\t\t}\n\t\tdefault:\n\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: unsupported\\n\", url.Redacted())\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"unsupported scheme: %s\", url.Redacted())\n\t\t}\n\n\t\tinsecure := new(urlpkg.URL)\n\t\t*insecure = *url\n\t\tinsecure.Scheme = \"http\"\n\t\tif insecure.User != nil && security != Insecure {\n\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: insecure credentials\\n\", insecure.Redacted())\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"refusing to pass credentials to insecure URL: %s\", insecure.Redacted())\n\t\t}\n\n\t\tres, err = fetch(insecure)\n\t\tif err == nil {\n\t\t\tfetched = insecure\n\t\t} else {\n\t\t\tif cfg.BuildX {\n\t\t\t\tfmt.Fprintf(os.Stderr, \"# get %s: %v\\n\", insecure.Redacted(), err)","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/web/http.go#L215-L251","documentation":"Returned by web.get when url.Scheme is anything other than \"\", \"http\", \"https\", or \"file\". The go command only speaks HTTP(S) and file:// for module fetching; schemes like ftp://, git://, ssh://, rsync:// are rejected here rather than passed to the network stack.","triggerScenarios":"A module proxy URL or vanity import URL with an exotic scheme, e.g. 'git://host/repo' in a replace directive or GOPROXY, or a malformed URL that parsed with an unexpected .Scheme.","commonSituations":"User pastes a 'git://' clone URL into a replace directive expecting VCS-style fetching; a copied SCP-style 'user@host:path' that misparsed; GOPROXY set to an ssh:// URL by mistake.","solutions":["Use an https:// URL (or http:// with GOINSECURE) for the module source.","For direct VCS, drop the scheme and let the go command infer VCS via the meta-tag protocol (go-get=1).","If a local path is intended, use a file:// URL or a local replace directive with a filesystem path.","Verify GOPROXY entries are all http(s):// or 'direct'/'off'."],"exampleFix":"// before\nreplace example.com/m => git://git.corp/m.git\n\n// after\nreplace example.com/m => https://git.corp/m.git","handlingStrategy":"validation","validationCode":"var validSchemes = map[string]bool{\"http\": true, \"https\": true, \"file\": true, \"\": true}\n\nfunc validateProxyOrModuleURL(raw string) error {\n    u, err := urlpkg.Parse(raw)\n    if err != nil { return err }\n    if !validSchemes[u.Scheme] {\n        return fmt.Errorf(\"unsupported scheme %q for %s\", u.Scheme, raw)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never put git://, ssh://, or rsync:// URLs in GOPROXY or replace directives.","Lint go.mod replace lines in CI to catch exotic schemes.","Use 'go env GOPROXY' checks to verify proxy entries before building."],"tags":["network","modules","url","validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}