What causes "%s: invalid subdirectory %q: %v" in golang/go?

Correct the go-import meta tag's subdirectory to be a clean relative path with no leading '/' or '-'

%s: invalid subdirectory %q: %v

Error message

%s: invalid subdirectory %q: %v

What it means

validateRepoSubDir rejected the SubDir field of the matched meta import. The validator disallows a leading '/' ("leading slash") or a leading '-' ("leading hyphen") to prevent argument injection into VCS commands. The %s is resp.URL, %q is the offending subdirectory, %v is the validator's message.

Source

Thrown at src/cmd/go/internal/vcs/vcs.go:1050

	// non-evil student). Instead, first verify the root and see
	// if it matches Bob's claim.
	if mmi.Prefix != importPath {
		if cfg.BuildV {
			log.Printf("get %q: verifying non-authoritative meta tag", importPath)
		}
		var imports []metaImport
		url, imports, err = metaImportsForPrefix(mmi.Prefix, mod, security)
		if err != nil {
			return nil, err
		}
		metaImport2, err := matchGoImport(imports, importPath)
		if err != nil || mmi != metaImport2 {
			return nil, fmt.Errorf("%s and %s disagree about go-import for %s", resp.URL, url, mmi.Prefix)
		}
	}

	if err := validateRepoSubDir(mmi.SubDir); err != nil {
		return nil, fmt.Errorf("%s: invalid subdirectory %q: %v", resp.URL, mmi.SubDir, err)
	}

	if err := validateRepoRoot(mmi.RepoRoot); err != nil {
		return nil, fmt.Errorf("%s: invalid repo root %q: %v", resp.URL, mmi.RepoRoot, err)
	}
	var vcs *Cmd
	if mmi.VCS == "mod" {
		vcs = vcsMod
	} else {
		vcs = vcsByCmd(mmi.VCS)
		if vcs == nil {
			return nil, fmt.Errorf("%s: unknown vcs %q", resp.URL, mmi.VCS)
		}
	}

	if err := checkGOVCS(vcs, mmi.Prefix); err != nil {
		return nil, err
	}

View on GitHub (pinned to b6b368adc5)

Solutions

Correct the go-import meta tag's subdirectory to be a clean relative path with no leading '/' or '-'
Leave the subdirectory empty if the module root equals the repo root

Defensive patterns

Strategy: validation

Validate before calling

// Validate a go-import subdirectory the same way cmd/go does
func validSubDir(s string) error {
  if s == "" { return nil }
  if s[0] == '/' { return errors.New("leading slash") }
  if s[0] == '-' { return errors.New("leading hyphen") }
  return nil
}

Prevention

Keep the subdirectory field empty unless the module lives in a repo subdir
Never start the subdirectory with '/' or '-'

When it happens

Trigger: A go-import meta tag's third field starts with '/' or '-', e.g. content="example.com git https://x /sub".

Common situations: Vanity server misconfiguration writing an absolute path or a flag-like value into the subdirectory field.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/ad7196f9fa1299c2. Report an issue: GitHub.