cmd/go: 'go vet cmd' fails with "use of internal package" when run in GOROOT/src/cmd

[bcmills]

~/go-review/src/cmd$ go version
go version devel +320cc79002 Tue Oct 27 12:36:54 2020 +0000 linux/amd64

~/go-review/src/cmd$ go vet cmd
package cmd/vendor/github.com/google/pprof/driver
        vendor/github.com/google/pprof/driver/driver.go:24:2: use of internal package github.com/google/pprof/internal/driver not allowed
package cmd/vendor/github.com/google/pprof/driver
        vendor/github.com/google/pprof/driver/driver.go:25:2: use of internal package github.com/google/pprof/internal/plugin not allowed
…

~/go-review/src/cmd$ cd ..

~/go-review/src$ go vet cmd

~/go-review/src$

I'm not actually sure whether this bug is in cmd/go or in cmd/vet.

There was a similar issue (#41358) in cmd/api which we resolved by omitting the vendored packages. However, in this case I think we really should be running vet on these packages — we just need to get go vet to interpret the imports from within those packages correctly.

This comment in cmd/go is related: https://github.com/golang/go/blob/ece7a33386a4fbd2ff9859902f780ed82120b985/src/cmd/go/internal/modload/load.go#L1151-L1155

CC @matloob @jayconrod

[ericrrath]

FWIW, go list produces similar error output when run against e.g. golang 1.22.5 source, using golang 1.22.5:

$ go version
go version go1.22.5 darwin/arm64
$ git status
HEAD detached at go1.22.5
nothing to commit, working tree clean
$ go list ./...
package std/archive/tar
    archive/tar/common.go:16:2: use of internal package internal/godebug not allowed
package std/archive/zip
    archive/zip/reader.go:13:2: use of internal package internal/godebug not allowed
...

The use-case here is gathering information about full dependency graph, and getting all the licenses of those dependencies. Is there a better, more orthodox way to achieve this?

[matloob]

@ericrrath was the go command that you're running built using the code you checked out? If you're running a go command that has a different GOROOT embedded you can run into issues.

I tried building go at go1.22.5 and running go list ./... in the src directory and got no errors.

If you are getting errors running go list ./... in its $GOROOT/src could you let me know which directory you're running it in?

I'm not sure I totally understand your use case. Are you trying to get license information from the top comments of each of the source files?

[ericrrath]

@matloob - good point, I was running go list using a different version of go than the source I was running that command against. I'll try using the go built from that source.

[ericrrath]

Yep, that worked, @matloob. Thanks!