- Add GitLab as a Go proxy
- Fetch modules from private projects
- Working with Go
With the Go proxy for GitLab, every project in GitLab can be fetched with the Go proxy protocol.
The Go proxy for GitLab is under development and not ready for production use, due to potential performance issues with large repositories.
It is deployed behind a feature flag that is disabled by default.
GitLab administrators with access to the GitLab Rails console can enable it for your instance.
To enable it:
Feature.enable(:go_proxy) # or
To disable it:
To enable or disable it for specific projects:
Feature.enable(:go_proxy, Project.find(1)) Feature.disable(:go_proxy, Project.find(2))
The Package Registry is enabled for new projects by default. If you cannot find the Packages > List entry under your project’s sidebar, verify the following:
- Your GitLab administrator has enabled support for the Package Registry.
- The Package Registry is enabled for your project.
The available proxy endpoints are:
- Project - can fetch modules defined by a project -
To use the Go proxy for GitLab to fetch Go modules from GitLab, add the
appropriate proxy endpoint to
GOPROXY. For details on setting Go environment
variables, see Set environment variables. For
details on configuring
GOPROXY, see Dependency Management in Go >
For example, adding the project-specific endpoint to
GOPROXY will tell Go
to initially query that endpoint and fall back to the default behavior:
go env -w GOPROXY='https://gitlab.com/api/v4/projects/1234/packages/go,https://proxy.golang.org,direct'
With this configuration, Go fetches dependencies as follows:
- Attempt to fetch from the project-specific Go proxy.
- Attempt to fetch from proxy.golang.org.
- Fetch directly with version control system operations (such as
svn checkout, and so on).
GOPROXY is not specified, Go follows steps 2 and 3, which corresponds to
contains the project-specific endpoint, Go will only query that endpoint.
go does not support transmitting credentials over insecure connections. The
steps below work only if GitLab is configured for HTTPS.
- Configure Go to include HTTP basic authentication credentials when fetching from the Go proxy for GitLab.
- Configure Go to skip downloading of checksums for private GitLab projects from the public checksum database.
machine <url> login <username> password <token>
<url> should be the URL of the GitLab instance, for example
<token> should be your username and the personal access
When downloading dependencies, by default Go 1.13 and later validate fetched
sources against the checksum database
sum.golang.org. If the checksum of the
fetched sources does not match the checksum from the database, Go will not build
the dependency. This causes private modules to fail to build, as
sum.golang.org cannot fetch the source of private modules and thus cannot
provide a checksum. To resolve this issue,
GONOSUMDB should be set to a
comma-separated list of private projects. For details on setting Go environment
variables, see Set environment variables. For more
details on disabling this feature of Go, see Dependency Management in Go >
For example, to disable checksum queries for
go env -w GONOSUMDB='gitlab.com/my/project,<previous value>'
If you are unfamiliar with managing dependencies in Go, or Go in general, consider reviewing the following documentation:
Go uses environment variables to control various features. These can be managed
in all the usual ways, but Go 1.14 will read and write Go environment variables
from and to a special Go environment file,
~/.go/env by default. If
set to a file, Go will read and write that file instead. If
GOENV is not set
GOPATH is set, Go will read and write
Go environment variables can be read with
go env <var> and, in Go 1.14 and
later, can be written with
go env -w <var>=<value>. For example,
go env -w GOPATH=/go.
Go modules and module versions are defined by source repositories, such as Git,
SVN, Mercurial, and so on. A module is a repository containing
go.mod and Go
files. Module versions are defined by VCS tags. To publish a module, push
go.mod and source files to a VCS repository. To publish a module version, push
a VCS tag. See Dependency Management in Go >
Versioning for more
details on what constitutes a valid module or module version.