1 # To avoid VCS injection attacks, we should not accept multiple different VCS metadata
2 # folders within a single module (either in the same directory, or nested in different
3 # directories.)
4 #
5 # This behavior should be disabled by setting the allowmultiplevcs GODEBUG.
6
7 [short] skip
8 [!git] skip
9
10 cd samedir
11
12 exec git init .
13
14 # Without explicitly requesting buildvcs, the go command should silently continue
15 # without determining the correct VCS.
16 go test -c -o $devnull .
17
18 # If buildvcs is explicitly requested, we expect the go command to fail
19 ! go test -buildvcs -c -o $devnull .
20 stderr '^error obtaining VCS status: multiple VCS detected:'
21
22 env GODEBUG=allowmultiplevcs=1
23 go test -buildvcs -c -o $devnull .
24
25 env GODEBUG=
26 cd ../nested
27 exec git init .
28 # cd a
29 go test -c -o $devnull ./a
30 ! go test -buildvcs -c -o $devnull ./a
31 stderr '^error obtaining VCS status: multiple VCS detected:'
32 # allowmultiplevcs doesn't disable the check that the current directory, package, and
33 # module are in the same repository.
34 env GODEBUG=allowmultiplevcs=1
35 ! go test -buildvcs -c -o $devnull ./a
36 stderr '^error obtaining VCS status: main package is in repository'
37
38 -- samedir/go.mod --
39 module example
40
41 go 1.18
42 -- samedir/example.go --
43 package main
44 -- samedir/.bzr/test --
45 hello
46
47 -- nested/go.mod --
48 module example
49
50 go 1.18
51 -- nested/a/example.go --
52 package main
53 -- nested/a/.bzr/test --
54 hello
55
View as plain text