# To avoid VCS injection attacks, we should not accept multiple different VCS metadata
# folders within a single module (either in the same directory, or nested in different
# directories.)
#
# This behavior should be disabled by setting the allowmultiplevcs GODEBUG.

[short] skip
[!git] skip

cd samedir

exec git init .

# Without explicitly requesting buildvcs, the go command should silently continue
# without determining the correct VCS.
go test -c -o $devnull .

# If buildvcs is explicitly requested, we expect the go command to fail
! go test -buildvcs -c -o $devnull .
stderr '^error obtaining VCS status: multiple VCS detected:'

env GODEBUG=allowmultiplevcs=1
go test -buildvcs -c -o $devnull .

env GODEBUG=
cd ../nested
exec git init .
# cd a
go test -c -o $devnull ./a
! go test -buildvcs -c -o $devnull ./a
stderr '^error obtaining VCS status: multiple VCS detected:'
# allowmultiplevcs doesn't disable the check that the current directory, package, and
# module are in the same repository.
env GODEBUG=allowmultiplevcs=1
! go test -buildvcs -c -o $devnull ./a
stderr '^error obtaining VCS status: main package is in repository'

-- samedir/go.mod --
module example

go 1.18
-- samedir/example.go --
package main
-- samedir/.bzr/test --
hello

-- nested/go.mod --
module example

go 1.18
-- nested/a/example.go --
package main
-- nested/a/.bzr/test --
hello