invalid proxy URL scheme (must be https, http, file): %s

Error message

invalid proxy URL scheme (must be https, http, file): %s

What it means

newProxyRepo rejects any proxy URL scheme that is not http, https, or file. Schemes like ftp, ssh, gopher, git, ws fall through the switch to the default branch.

Source

Thrown at src/cmd/go/internal/modfetch/proxy.go:213

func newProxyRepo(baseURL, path string) (Repo, error) {
	// Parse the base proxy URL.
	base, err := url.Parse(baseURL)
	if err != nil {
		return nil, err
	}
	redactedBase := base.Redacted()
	switch base.Scheme {
	case "http", "https":
		// ok
	case "file":
		if *base != (url.URL{Scheme: base.Scheme, Path: base.Path, RawPath: base.RawPath}) {
			return nil, fmt.Errorf("invalid file:// proxy URL with non-path elements: %s", redactedBase)
		}
	case "":
		return nil, fmt.Errorf("invalid proxy URL missing scheme: %s", redactedBase)
	default:
		return nil, fmt.Errorf("invalid proxy URL scheme (must be https, http, file): %s", redactedBase)
	}

	// Append the module path to the URL.
	url := base
	enc, err := module.EscapePath(path)
	if err != nil {
		return nil, err
	}
	url.Path = strings.TrimSuffix(base.Path, "/") + "/" + enc
	url.RawPath = strings.TrimSuffix(base.RawPath, "/") + "/" + pathEscape(enc)

	return &proxyRepo{url, path, redactedBase, sync.Once{}, nil, nil}, nil
}

func (p *proxyRepo) ModulePath() string {
	return p.path
}

View on GitHub (pinned to b6b368adc5)

Solutions

Use a real HTTPS Go module proxy, or 'direct' to fetch from VCS over the supported VCS protocols (separate from GOPROXY scheme rules).
Self-host goproxy or Athens and point GOPROXY at its https:// endpoint.
Drop unsupported schemes from the list entirely.

Example fix

// before
//   GOPROXY=git://github.com,direct
// after
//   GOPROXY=https://proxy.golang.org,direct

Defensive patterns

Strategy: validation

Validate before calling

func validateProxyScheme(s string) error {
    u, err := url.Parse(strings.TrimSpace(s))
    if err != nil { return err }
    switch u.Scheme {
    case "http", "https", "file": return nil
    case "": return fmt.Errorf("missing scheme")
    default: return fmt.Errorf("unsupported scheme %q", u.Scheme)
    }
}

Type guard

func hasAllowedProxyScheme(s string) bool {
    u, err := url.Parse(strings.TrimSpace(s))
    if err != nil { return false }
    switch u.Scheme {
    case "http", "https", "file": return true
    }
    return false
}

Prevention

Use only http/https/file for GOPROXY entries.
For raw VCS access use GOPROXY=direct rather than git:// or ssh://.

When it happens

Trigger: GOPROXY entry begins with an unsupported scheme such as ftp://, git://, or ssh://. base.Scheme is non-empty but none of the three accepted cases.

Common situations: Pointing GOPROXY at a raw git URL instead of an HTTPS module proxy; copy-paste of a VCS clone URL; misconfiguration expecting the go command to fetch via git protocol.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/66b241e2db8f5781. Report an issue: GitHub.