cmd/go: go build fails to read vcs info when .git is owned by a different user

[ultrabear]

What version of Go are you using (go version)?

$ go version
go version go1.18.3 linux/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/ultrabear/.cache/go-build"
GOENV="/home/ultrabear/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/ultrabear/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/ultrabear/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.18.3"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/ultrabear/cpgov/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2447704394=/tmp/go-build -gno-record-gcc-switches"
GOROOT/bin/go version: go version go1.18.3 linux/amd64
GOROOT/bin/go tool compile -V: compile version go1.18.3
uname -sr: Linux 5.15.46-1-MANJARO
LSB Version:	n/a
Distributor ID:	ManjaroLinux
Description:	Manjaro Linux
Release:	21.3.0
Codename:	Ruah
/usr/lib/libc.so.6: GNU C Library (GNU libc) stable release version 2.35.
lldb --version: lldb version 13.0.1
gdb --version: GNU gdb (GDB) 12.1

What did you do?

tried to build a program with a git repository in root, program stated:

$ sudo make
go build -o cpgov
error obtaining VCS status: exit status 128
	Use -buildvcs=false to disable VCS stamping.
make: *** [Makefile:5: cpgov] Error 1

while running without root works

$ make
go build -o cpgov
$ sudo make install
# successfully installs now that compilation is not happening

example not using Makefile as image:

What did you expect to see?

The program should not fail to grab vcs info (seemingly) just because it is in root instead of the owning user of the git repository (swapping permissions on .git to 777 did not work, swapping owner of .git to root.root did not work).

What did you see instead?

go build outputted a very unhelpful error message that it failed to obtain VCS information for some reason, and left not enough information to even properly understand the scope of this issue, for that reason I do not fully understand the scope of this issue, or even if it is somehow intended behavior.

[seankhliao]

This is a git issue:

11:28:23 ~/tmp/delve 0:00:00                                                       
master arccy@eevee» sudo /usr/bin/go build ./cmd/dlv
error obtaining VCS status: exit status 128
        Use -buildvcs=false to disable VCS stamping.

11:28:44 ~/tmp/delve 0:00:00                                                       
master arccy@eevee» sudo git status
fatal: unsafe repository ('/home/arccy/tmp/delve' is owned by someone else)
To add an exception for this directory, call:

        git config --global --add safe.directory /home/arccy/tmp/delve

[seankhliao]

on the safe.directory setting, git says:

This config setting is only respected when specified in a system or global config, not when it is specified in a repository config or via the command line option -c safe.directory=.

[ultrabear]

If this was a git issue, could go build be patched to forward git error messages to the end user instead of hiding them?

[bcmills]

If this was a git issue, could go build be patched to forward git error messages to the end user instead of hiding them?

That sounds appropriate. It looks like the error probably comes from here:
https://cs.opensource.google/go/go/+/master:src/cmd/go/internal/vcs/vcs.go;l=657-663;drc=160414ca6a30a210b82fb09abbd3541802a51017

Perhaps we should move ee.Stderr explicitly into the error text — the exec.ExitError.Error method omits it, but it seems to me that it is essentially always relevant for VCS commands executed by go.

[gopherbot]

Change https://go.dev/cl/468917 mentions this issue: deploy,devtools: use golang:1.20 image

[kaovilai]

This affects me as well.

git submodules were added like so

git repo
    | gitsubmodulegolang1
    | gitsubmodulegolang2
    Makefile

Content of makefile target

cd gitsubmodulegolang2 && go build .

added git status in here just to expose git errors like mentioned earlier comments.

❯ make oadp-operator 
cd oadp-operator && \
        cp -r . /var/folders/_y/scrnnz_x0tv2m92fwrzhctyw0000gn/T/tmp.1Bf2Za1L/  && cd /var/folders/_y/scrnnz_x0tv2m92fwrzhctyw0000gn/T/tmp.1Bf2Za1L/  && git status && \
        IMG=ttl.sh/oadp-operator-835baf8-demo:1d BUNDLE_IMG=ttl.sh/oadp-operator-bundle-835baf8-demo:1d \
                make docker-build docker-push bundle bundle-build bundle-push; \
        rm -rf /var/folders/_y/scrnnz_x0tv2m92fwrzhctyw0000gn/T/tmp.1Bf2Za1L/ 
fatal: not a git repository: /private/var/folders/_y/scrnnz_x0tv2m92fwrzhctyw0000gn/T/tmp.1Bf2Za1L/../.git/modules/oadp-operator

I would want -buildvcs flag to accept GOENV as well so I don't have to make changes in other projects I added as submodules and modifying go build inside Dockerfiles .

[quantonganh]

Perhaps we should move ee.Stderr explicitly into the error text

@bcmills If we do that, then what's the different between verbose and non-verbose mode?

but it seems to me that it is essentially always relevant for VCS commands executed by go.

If so, should we use runOutput instead of runOutputVerboseOnly?

[adambkaplan]

Also discussed on the golang-nuts mailing list: https://groups.google.com/g/golang-nuts/c/LZbM2WlZoJM