We are using private Bitbucket repositories to manage our Go libraries. By using the insteadOf config for git as described e.g. in this Stackoverflow answer, we had a working build up to Go version 1.12. Versions 1.13 and 1.14 do not work any more. We are seeing errors like this:
$ go vet ./...
go: downloading bitbucket.org/travelloapp/golibs v1.0.42
usercache/usercache.go:6:2: bitbucket.org/travelloapp/[email protected]: verifying module: bitbucket.org/travelloapp/[email protected]: reading https://sum.golang.org/lookup/bitbucket.org/travelloapp/[email protected]: 410 Gone
server response:
not found: bitbucket.org/travelloapp/[email protected]: reading https://api.bitbucket.org/2.0/repositories/travelloapp/golibs?fields=scm: 403 Forbidden
server response: Access denied. You must have write or admin access.
The Go FAQ proposes to set up curl's ~/.netrc file. I've done that, using Bitbucket's "App Password" feature. It is not changing the result. I have added both bitbucket.org and api.bitbucket.org as host names.
I can test the file setup is correct with curl directly:
$ curl -n https://api.bitbucket.org/2.0/repositories/travelloapp/golibs?fields=scm
{"scm": "git"}
For the record: despite the Bitbucket error message. repository read access seems to be the only permission required, although I have tried with all permissions enabled as well.
Am I missing something? Why did the approach that works for Go 1.12 stop working for higher versions?
I'm currently using:
$ go version
go version go1.14.2 linux/amd64
$ git version
git version 2.17.1
$ curl --version
curl 7.58.0 (x86_64-pc-linux-gnu) libcurl/7.58.0 OpenSSL/1.1.1 zlib/1.2.11 libidn2/2.0.4 libpsl/0.19.1 (+libidn2/2.0.4) nghttp2/1.30.0 librtmp/2.3
Release-Date: 2018-01-24
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API Kerberos SPNEGO NTLM NTLM_WB SSL libz TLS-SRP HTTP2 UnixSockets HTTPS-proxy PSL
We encountered the issue first when Go 1.13 came out, at the moment we are still holding all environments back on 1.12.