golang/go · error

https fetch: %v

Error message

https fetch: %v

What it means

Thrown by Go's dynamic import-path discovery (repoRootForImportDynamic) when the initial HTTPS GET used to fetch go-import meta tags fails at the transport level. The wrapped %v carries the underlying net/http, TLS, or DNS error from web.Get. The message is prefixed with 'http/' only when security == web.Insecure (the GOINSECURE/GOPRIVATE path).

Source

Thrown at src/cmd/go/internal/vcs/vcs.go:1002

	return &urlpkg.URL{Host: host, Path: path, RawQuery: "go-get=1"}, nil
}

// repoRootForImportDynamic finds a *RepoRoot for a custom domain that's not
// statically known by repoRootFromVCSPaths.
//
// This handles custom import paths like "name.tld/pkg/foo" or just "name.tld".
func repoRootForImportDynamic(importPath string, mod ModuleMode, security web.SecurityMode) (*RepoRoot, error) {
	url, err := urlForImportPath(importPath)
	if err != nil {
		return nil, err
	}
	resp, err := web.Get(security, url)
	if err != nil {
		msg := "https fetch: %v"
		if security == web.Insecure {
			msg = "http/" + msg
		}
		return nil, fmt.Errorf(msg, err)
	}
	body := resp.Body
	defer body.Close()
	imports, err := parseMetaGoImports(body, mod)
	if len(imports) == 0 {
		if respErr := resp.Err(); respErr != nil {
			// If the server's status was not OK, prefer to report that instead of
			// an XML parse error.
			return nil, respErr
		}
	}
	if err != nil {
		return nil, fmt.Errorf("parsing %s: %v", importPath, err)
	}
	// Find the matched meta import.
	mmi, err := matchGoImport(imports, importPath)
	if err != nil {
		if _, ok := err.(ImportMismatchError); !ok {

View on GitHub (pinned to b6b368adc5)

Solutions

1. Verify the host serves go-import meta tags: curl -v 'https://<importPath>?go-get=1'
2. For private HTTP-only hosts, set GOINSECURE=<host> (and GOPRIVATE=<host>) and confirm meta tags are present
3. Check TLS validity with curl -v and inspect HTTPS_PROXY/HTTP_PROXY env
4. Confirm DNS resolves and that no MITM proxy is terminating TLS

// Preflight reachability check before relying on dynamic discovery
import (
  "crypto/tls"
  "fmt"
  "net/http"
  "time"
)
func reachable(u string) error {
  c := &http.Client{Timeout: 10 * time.Second,
    Transport: &http.Transport{TLSClientConfig: &tls.Config{}}}
  r, err := c.Get(u + "?go-get=1")
  if err != nil { return err }
  defer r.Body.Close()
  if r.StatusCode != 200 { return fmt.Errorf("status %d", r.StatusCode) }
  return nil
}

When it happens

Trigger: Running `go get`, `go install`, or `go mod download` against a vanity import path (e.g. 'example.com/pkg') when the request to the constructed URL (https://<importPath>?go-get=1) cannot complete: connection refused, TLS handshake failure, DNS NXDOMAIN, proxy timeout, or cert validation error.

Common situations: Air-gapped or corporate-proxied networks blocking HTTPS; expired/self-signed TLS certs on the vanity server; typo in the import-path domain; GOINSECURE not set for an HTTP-only private host; GOPROXY=off combined with a non-module path; captive portal intercepting TLS.

Related errors

• fetching %s: %v
• ReadZip: encoded file exceeds allowed size
• tls: server sent an unnecessary HelloRetryRequest key_share
• tls: server sent two HelloRetryRequest messages
• tls: server sent a cookie in a normal ServerHello

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/924e64a3eee98563. Report an issue: GitHub.