cmd/go: document that <meta> tags should be early in the HTML for go get
While we are here, fix a few things not updated for -insecure.
Fixes #8163.
Change-Id: Ib80c9ac00d6b61cce26c3d20bee3d30ab9af1331
Reviewed-on: https://go-review.googlesource.com/12148
Reviewed-by: Rob Pike <r@golang.org>
diff --git a/src/cmd/go/alldocs.go b/src/cmd/go/alldocs.go
index 56c1c0e..33ea685 100644
--- a/src/cmd/go/alldocs.go
+++ b/src/cmd/go/alldocs.go
@@ -985,7 +985,7 @@
When a version control system supports multiple protocols,
each is tried in turn when downloading. For example, a Git
-download tries git://, then https://, then http://.
+download tries https://, then git+ssh://.
If the import path is not a known code hosting site and also lacks a
version control qualifier, the go tool attempts to fetch the import
@@ -1001,6 +1001,10 @@
fetched with "go get". If it's not an exact match, another http
request is made at the prefix to verify the <meta> tags match.
+The meta tag should appear as early in the file as possible.
+In particular, it should appear before any raw JavaScript or CSS,
+to avoid confusing the go command's restricted parser.
+
The vcs is one of "git", "hg", "svn", etc,
The repo-root is the root of the version control system
@@ -1010,10 +1014,10 @@
import "example.org/pkg/foo"
-will result in the following request(s):
+will result in the following requests:
https://example.org/pkg/foo?go-get=1 (preferred)
- http://example.org/pkg/foo?go-get=1 (fallback)
+ http://example.org/pkg/foo?go-get=1 (fallback, only with -insecure)
If that page contains the meta tag
diff --git a/src/cmd/go/help.go b/src/cmd/go/help.go
index cd71ade..45d8ae5 100644
--- a/src/cmd/go/help.go
+++ b/src/cmd/go/help.go
@@ -195,7 +195,7 @@
When a version control system supports multiple protocols,
each is tried in turn when downloading. For example, a Git
-download tries git://, then https://, then http://.
+download tries https://, then git+ssh://.
If the import path is not a known code hosting site and also lacks a
version control qualifier, the go tool attempts to fetch the import
@@ -211,6 +211,10 @@
fetched with "go get". If it's not an exact match, another http
request is made at the prefix to verify the <meta> tags match.
+The meta tag should appear as early in the file as possible.
+In particular, it should appear before any raw JavaScript or CSS,
+to avoid confusing the go command's restricted parser.
+
The vcs is one of "git", "hg", "svn", etc,
The repo-root is the root of the version control system
@@ -220,10 +224,10 @@
import "example.org/pkg/foo"
-will result in the following request(s):
+will result in the following requests:
https://example.org/pkg/foo?go-get=1 (preferred)
- http://example.org/pkg/foo?go-get=1 (fallback)
+ http://example.org/pkg/foo?go-get=1 (fallback, only with -insecure)
If that page contains the meta tag
