What causes "unsupported scheme: %s" in golang/go?

Use an https:// URL (or http:// with GOINSECURE) for the module source.

unsupported scheme: %s

Error message

unsupported scheme: %s

What it means

Returned by web.get when url.Scheme is anything other than "", "http", "https", or "file". The go command only speaks HTTP(S) and file:// for module fetching; schemes like ftp://, git://, ssh://, rsync:// are rejected here rather than passed to the network stack.

Source

Thrown at src/cmd/go/internal/web/http.go:233

	if res == nil {
		switch url.Scheme {
		case "http":
			if security == SecureOnly {
				if cfg.BuildX {
					fmt.Fprintf(os.Stderr, "# get %s: insecure\n", url.Redacted())
				}
				return nil, fmt.Errorf("insecure URL: %s", url.Redacted())
			}
		case "":
			if security != Insecure {
				panic("should have returned after HTTPS failure")
			}
		default:
			if cfg.BuildX {
				fmt.Fprintf(os.Stderr, "# get %s: unsupported\n", url.Redacted())
			}
			return nil, fmt.Errorf("unsupported scheme: %s", url.Redacted())
		}

		insecure := new(urlpkg.URL)
		*insecure = *url
		insecure.Scheme = "http"
		if insecure.User != nil && security != Insecure {
			if cfg.BuildX {
				fmt.Fprintf(os.Stderr, "# get %s: insecure credentials\n", insecure.Redacted())
			}
			return nil, fmt.Errorf("refusing to pass credentials to insecure URL: %s", insecure.Redacted())
		}

		res, err = fetch(insecure)
		if err == nil {
			fetched = insecure
		} else {
			if cfg.BuildX {
				fmt.Fprintf(os.Stderr, "# get %s: %v\n", insecure.Redacted(), err)

View on GitHub (pinned to b6b368adc5)

Solutions

Use an https:// URL (or http:// with GOINSECURE) for the module source.
For direct VCS, drop the scheme and let the go command infer VCS via the meta-tag protocol (go-get=1).
If a local path is intended, use a file:// URL or a local replace directive with a filesystem path.
Verify GOPROXY entries are all http(s):// or 'direct'/'off'.

Example fix

// before
replace example.com/m => git://git.corp/m.git

// after
replace example.com/m => https://git.corp/m.git

Defensive patterns

Strategy: validation

Validate before calling

var validSchemes = map[string]bool{"http": true, "https": true, "file": true, "": true}

func validateProxyOrModuleURL(raw string) error {
    u, err := urlpkg.Parse(raw)
    if err != nil { return err }
    if !validSchemes[u.Scheme] {
        return fmt.Errorf("unsupported scheme %q for %s", u.Scheme, raw)
    }
    return nil
}

Prevention

Never put git://, ssh://, or rsync:// URLs in GOPROXY or replace directives.
Lint go.mod replace lines in CI to catch exotic schemes.
Use 'go env GOPROXY' checks to verify proxy entries before building.

When it happens

Trigger: A module proxy URL or vanity import URL with an exotic scheme, e.g. 'git://host/repo' in a replace directive or GOPROXY, or a malformed URL that parsed with an unexpected .Scheme.

Common situations: User pastes a 'git://' clone URL into a replace directive expecting VCS-style fetching; a copied SCP-style 'user@host:path' that misparsed; GOPROXY set to an ssh:// URL by mistake.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/f1b477e429934fe6. Report an issue: GitHub.