Description
Background
It is not uncommon for companies to host Go libraries as private repositories, and even provide vanity URLs that redirect to specific directories in a private repository; Go already provides ways for dealing with those private repositories by using the GOPRIVATE, GONOSUMDB, and GONOPROXY environments, which requires users to export those environments and/or configure their tooling appropriately to handle those exceptions.
I have seen an array of different solutions for those cases, which ranges from repositories providing wrappers for go mod and go build by exporting the aforementioned environment variables before invoking the command, to requiring plugins for handling .env files containing the necessary set of environments for handling projects with private dependencies.
Solution
I believe Go can provide a far better developer experience by leveraging go.mod, which could (a) allow private repositories to be provided in a private, nosum, and noproxy blocks, or (b) allow private/nosum/noproxy dependencies to be marked as so through a comment, just like indirect does.
Option A: Augmenting go.mod with blocks
Just like require, one would be able to provide URLs that will be interpreted just like when passed to their related environment variables:
module my-application-using-private-mods
go 1.17
private (
go.myvanityurl.com
github.com/organization-with-private-repositories
)
require (
// ...
)
Extra blocks such as nosum and noproxy could also be allowed, and all blocks provide the same behaviour as when setting environment variables:
list of glob patterns (in the syntax of Go's path.Match) of module path prefixes that should always be fetched directly or that should not be compared against the checksum database.
Option B: Leveraging comments like indirect
The same is already done with the indirect comment, but instead of implementing a new block type, a single comment may be placed on every private (nosumdb + noproxy) dependency:
module my-application-using-private-mods
go 1.17
require (
github.com/organization-with-private-repositories/foo v1.0.0 // private
github.com/google/uuid v1.1.2
// ...
)