What causes "no explicit url was passed" in golang/go?

Do not call runGitAuth with an empty url; guard the caller: `if url == "" { return }` before the call.

no explicit url was passed

Error message

no explicit url was passed

What it means

Returned by runGitAuth when the url argument is empty, because `git credential` provides no way to enumerate stored credentials and therefore needs an explicit URL. The standard caller (runGoAuth) guards this case with `if url == "" { continue }` before invoking runGitAuth, so under normal use of the go command this error is not reached. It exists as a defensive contract for direct callers of runGitAuth.

Source

Thrown at src/cmd/go/internal/auth/gitauth.go:38

	"net/url"
	"os/exec"
	"strings"
)

const maxTries = 3

// runGitAuth retrieves credentials for the given url using
// 'git credential fill', validates them with a HEAD request
// (using the provided client) and updates the credential helper's cache.
// It returns the matching credential prefix, the http.Header with the
// Basic Authentication header set, or an error.
// The caller must not mutate the header.
func runGitAuth(client *http.Client, dir, url string) (string, http.Header, error) {
	if url == "" {
		// No explicit url was passed, but 'git credential'
		// provides no way to enumerate existing credentials.
		// Wait for a request for a specific url.
		return "", nil, fmt.Errorf("no explicit url was passed")
	}
	if dir == "" {
		// Prevent config-injection attacks by requiring an explicit working directory.
		// See https://golang.org/issue/29230 for details.
		panic("'git' invoked in an arbitrary directory") // this should be caught earlier.
	}
	cmd := exec.Command("git", "credential", "fill")
	cmd.Dir = dir
	cmd.Stdin = strings.NewReader(fmt.Sprintf("url=%s\n", url))
	out, err := cmd.CombinedOutput()
	if err != nil {
		return "", nil, fmt.Errorf("'git credential fill' failed (url=%s): %w\n%s", url, err, out)
	}
	parsedPrefix, username, password := parseGitAuth(out)
	if parsedPrefix == "" {
		return "", nil, fmt.Errorf("'git credential fill' failed for url=%s, could not parse url\n", url)
	}
	// Check that the URL Git gave us is a prefix of the one we requested.

View on GitHub (pinned to b6b368adc5)

Solutions

Do not call runGitAuth with an empty url; guard the caller: `if url == "" { return }` before the call.
Rely on the go command's built-in GOAUTH=git handling rather than invoking gitauth internals directly.

Defensive patterns

Strategy: validation

Validate before calling

// If calling runGitAuth directly, guard the empty-url case first.
if url == "" {
    return "", nil, errors.New("runGitAuth requires a non-empty url")
}
return runGitAuth(client, dir, url)

Prevention

Always check `url != ""` before calling runGitAuth.
Prefer the go command's built-in GOAUTH=git handling over calling internals.

When it happens

Trigger: runGitAuth is invoked with url == "". Reachable only if an internal caller bypasses the guard in auth.go (a regression or a third-party tool calling the unexported function via a fork).

Common situations: End users of the go command should not encounter this. It would surface only from a buggy internal caller or a forked/maintained version that drops the url guard.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/397cb5ded4d421ea. Report an issue: GitHub.