1# To avoid VCS injection attacks, we should not accept multiple different VCS metadata
2# folders within a single module (either in the same directory, or nested in different
3# directories.)
4#
5# This behavior should be disabled by setting the allowmultiplevcs GODEBUG.
6
7[short] skip
8[!git] skip
9
10cd samedir
11
12exec git init .
13
14# Without explicitly requesting buildvcs, the go command should silently continue
15# without determining the correct VCS.
16go test -c -o $devnull .
17
18# If buildvcs is explicitly requested, we expect the go command to fail
19! go test -buildvcs -c -o $devnull .
20stderr '^error obtaining VCS status: multiple VCS detected:'
21
22env GODEBUG=allowmultiplevcs=1
23go test -buildvcs -c -o $devnull .
24
25env GODEBUG=
26cd ../nested
27exec git init .
28# cd a
29go test -c -o $devnull ./a
30! go test -buildvcs -c -o $devnull ./a
31stderr '^error obtaining VCS status: multiple VCS detected:'
32# allowmultiplevcs doesn't disable the check that the current directory, package, and
33# module are in the same repository.
34env GODEBUG=allowmultiplevcs=1
35! go test -buildvcs -c -o $devnull ./a
36stderr '^error obtaining VCS status: main package is in repository'
37
38-- samedir/go.mod --
39module example
40
41go 1.18
42-- samedir/example.go --
43package main
44-- samedir/.bzr/test --
45hello
46
47-- nested/go.mod --
48module example
49
50go 1.18
51-- nested/a/example.go --
52package main
53-- nested/a/.bzr/test --
54hello
View as plain text