env GOVCS='github.com:svn|hg'
! go get github.com/google/go-cmp
stderr '^go: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'
env GOVCS='github.com/google/go-cmp/inner:git,github.com:svn|hg'
! go get github.com/google/go-cmp
stderr '^go: GOVCS disallows using git for public github.com/google/go-cmp; see ''go help vcs''$'

# bad patterns are reported (for more bad patterns, see TestGOVCSErrors)
env GOVCS='git'

	err string
}{
	{`,`, `empty entry in GOVCS`},
	{`,x`, `empty entry in GOVCS`},
	{`x,`, `malformed entry in GOVCS (missing colon): "x"`},
	{`x:y,`, `empty entry in GOVCS`},
	{`x`, `malformed entry in GOVCS (missing colon): "x"`},
	{`x:`, `empty VCS list in GOVCS: "x:"`},
	{`x:|`, `empty VCS name in GOVCS: "x:|"`},
	{`x:y|`, `empty VCS name in GOVCS: "x:y|"`},
	{`x:|y`, `empty VCS name in GOVCS: "x:|y"`},

		// and are always allowed.
		return nil
	}

	govcsOnce.Do(func() {
		govcs, govcsErr = parseGOVCS(os.Getenv("GOVCS"))
		govcs = append(govcs, defaultGOVCS...)
	})
	if govcsErr != nil {
		return govcsErr
	}

	private := module.MatchPrefixPatterns(cfg.GOPRIVATE, root)
	if !govcs.allow(root, private, vcs.Cmd) {
		what := "public"
		if private {
			what = "private"
		}

[short] skip

env GO111MODULE=on
env GOPROXY=direct
env GOSUMDB=off
env GOVCS='*:off'

# Without credentials, downloading a module from a path that requires HTTPS
# basic auth should fail.
env NETRC=$WORK/empty
! go mod tidy
stderr '^\tserver response: ACCESS DENIED, buddy$'
stderr '^\tserver response: File\? What file\?$'

# With credentials from a netrc file, it should succeed.
env NETRC=$WORK/netrc
go mod tidy
go list all

	GOINSECURE
	GOMIPS
	GOMIPS64
	GOMODCACHE
	GONOPROXY
	GONOSUMDB
	GOOS
	GOPATH
	GOPPC64
	GOPRIVATE
	GOPROXY
	GORISCV64
	GOROOT
	GOSUMDB
	GOTMPDIR
	GOTOOLCHAIN
	GOTOOLDIR
	GOVCS
	GOWASM
	GOWORK
	GO_EXTLINK_ENABLED
	PKG_CONFIG

        GOPRIVATE=""
        GOPROXY="https://proxy.golang.org,direct"
        GOROOT="/usr/local/go"
        GOSUMDB="sum.golang.org"
        GOTMPDIR=""
        GOTOOLDIR="/usr/local/go/pkg/tool/darwin_arm64"
        GOVCS=""
        GOVERSION="go1.20.7"
        GCCGO="gccgo"
        AR="ar"
        CC="clang"
        CXX="clang++"
        CGO_ENABLED="1"
        GOMOD="/dev/null"
        GOWORK=""
        CGO_CFLAGS="-O2 -g"

variable; otherwise it is public.

If no rules in the GOVCS variable match a particular module or import path,
the 'go get' command applies its default rule, which can now be summarized
in GOVCS notation as 'public:git|hg,private:all'.

To allow unfettered use of any version control system for any package, use:

	GOVCS=*:all

To disable all use of version control, use:

	GOVCS=*:off

		{Name: "GOSUMDB", Value: cfg.GOSUMDB, Changed: cfg.GOSUMDBChanged},
		{Name: "GOTMPDIR", Value: cfg.Getenv("GOTMPDIR")},
		{Name: "GOTOOLCHAIN"},
		{Name: "GOTOOLDIR", Value: build.ToolDir},
		{Name: "GOVCS", Value: cfg.GOVCS},
		{Name: "GOVERSION", Value: runtime.Version()},
		{Name: "GODEBUG", Value: os.Getenv("GODEBUG")},
		{Name: "GOTELEMETRY", Value: telemetry.Mode()},
		{Name: "GOTELEMETRYDIR", Value: telemetry.Dir()},
	}

	GONOPROXY, GONOPROXYChanged = EnvOrAndChanged("GONOPROXY", GOPRIVATE)
	GONOSUMDB, GONOSUMDBChanged = EnvOrAndChanged("GONOSUMDB", GOPRIVATE)
	GOINSECURE                  = Getenv("GOINSECURE")
	GOVCS                       = Getenv("GOVCS")
)

// EnvOrAndChanged returns the environment variable value
// and reports whether it differs from the default value.
func EnvOrAndChanged(name, def string) (v string, changed bool) {

// variable; otherwise it is public.
//
// If no rules in the GOVCS variable match a particular module or import path,
// the 'go get' command applies its default rule, which can now be summarized
// in GOVCS notation as 'public:git|hg,private:all'.
//
// To allow unfettered use of any version control system for any package, use:
//
//	GOVCS=*:all
//
// To disable all use of version control, use:
//