What causes "%s and %s disagree about go-import for %s" in golang/go?

Make the root prefix's go-import meta tags authoritative and identical to what subpaths declare

%s and %s disagree about go-import for %s

Error message

%s and %s disagree about go-import for %s

What it means

Emitted during the non-authoritative-meta-tag verification step. When a meta tag's prefix is shorter than the import path (the 'Bob at uni.edu' anti-spoofing scenario), go re-fetches the declared prefix via metaImportsForPrefix and requires both sources to agree. If the second source lacks the entry or differs in VCS/RepoRoot/SubDir, this error names both URLs and the prefix.

Source

Thrown at src/cmd/go/internal/vcs/vcs.go:1045

	}
	// If the import was "uni.edu/bob/project", which said the
	// prefix was "uni.edu" and the RepoRoot was "evilroot.com",
	// make sure we don't trust Bob and check out evilroot.com to
	// "uni.edu" yet (possibly overwriting/preempting another
	// non-evil student). Instead, first verify the root and see
	// if it matches Bob's claim.
	if mmi.Prefix != importPath {
		if cfg.BuildV {
			log.Printf("get %q: verifying non-authoritative meta tag", importPath)
		}
		var imports []metaImport
		url, imports, err = metaImportsForPrefix(mmi.Prefix, mod, security)
		if err != nil {
			return nil, err
		}
		metaImport2, err := matchGoImport(imports, importPath)
		if err != nil || mmi != metaImport2 {
			return nil, fmt.Errorf("%s and %s disagree about go-import for %s", resp.URL, url, mmi.Prefix)
		}
	}

	if err := validateRepoSubDir(mmi.SubDir); err != nil {
		return nil, fmt.Errorf("%s: invalid subdirectory %q: %v", resp.URL, mmi.SubDir, err)
	}

	if err := validateRepoRoot(mmi.RepoRoot); err != nil {
		return nil, fmt.Errorf("%s: invalid repo root %q: %v", resp.URL, mmi.RepoRoot, err)
	}
	var vcs *Cmd
	if mmi.VCS == "mod" {
		vcs = vcsMod
	} else {
		vcs = vcsByCmd(mmi.VCS)
		if vcs == nil {
			return nil, fmt.Errorf("%s: unknown vcs %q", resp.URL, mmi.VCS)
		}

View on GitHub (pinned to b6b368adc5)

Solutions

Make the root prefix's go-import meta tags authoritative and identical to what subpaths declare
Set the meta tag prefix to exactly the import path (authoritative) so verification is skipped
Re-deploy the vanity server so all paths return consistent go-import tags

Defensive patterns

Strategy: validation

Validate before calling

// Make the meta tag authoritative (prefix == importPath) to skip verification
// <meta name="go-import" content="uni.edu/bob/x git https://evilroot.com/bob/x">

Prevention

Keep prefix declarations consistent across all paths of the vanity host
Prefer authoritative prefixes (prefix == import path) to avoid the re-verification round-trip

When it happens

Trigger: importPath='uni.edu/bob/x' where the first fetch declares prefix 'uni.edu'; go re-fetches 'uni.edu' and the second meta-import set either omits the entry or yields mmi != metaImport2.

Common situations: Partial misconfiguration where a subpath declares a broader prefix than the root actually serves; mid-migration vanity setups; inconsistent vanity server behind a CDN cache.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/8cbbfcdd84b51664. Report an issue: GitHub.