mirror of https://github.com/golang/go.git
fdc21f3eaf
Historically, serveContent has not set Content-Length when the user provides Content-Encoding. This causes broken responses when the user sets both Content-Length and Content-Encoding, and the request is a range request, because the returned data doesn't match the declared length. CL 381956 fixed this case by changing serveContent to always set a Content-Length header. Unfortunately, I've discovered multiple cases in the wild of users setting Content-Encoding: gzip and passing serveContent a ResponseWriter wrapper that gzips the data written to it. This breaks serveContent in a number of ways. In particular, there's no way for it to respond to Range requests properly, because it doesn't know the recipient's view of the content. What the user should be doing in this case is just using io.Copy to send the gzipped data to the response. Or possibly setting Transfer-Encoding: gzip. But whatever they should be doing, what they are doing has mostly worked for non-Range requests, and setting Content-Length makes it stop working because the length of the file being served doesn't match the number of bytes being sent. So in the interests of not breaking users (even if they're misusing serveContent in ways that are already broken), partially revert CL 381956. For non-Range requests, don't set Content-Length when the user has set Content-Encoding. This matches our previous behavior and causes minimal harm in cases where we could have set Content-Length. (We will send using chunked encoding rather than identity, but that's fine.) For Range requests, set Content-Length unconditionally. Either the user isn't mangling the data in the ResponseWriter, in which case the length is correct, or they are, in which case the response isn't going to contain the right bytes anyway. (Note that a Range request for a Content-Length: gzip file is requesting a range of *gzipped* bytes, not a range from the uncompressed file.) Change-Id: I5e788e6756f34cee520aa7c456826f462a59f7eb Reviewed-on: https://go-review.googlesource.com/c/go/+/542595 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> |
||
|---|---|---|
| .. | ||
| archive | ||
| arena | ||
| bufio | ||
| builtin | ||
| bytes | ||
| cmd | ||
| cmp | ||
| compress | ||
| container | ||
| context | ||
| crypto | ||
| database/sql | ||
| debug | ||
| embed | ||
| encoding | ||
| errors | ||
| expvar | ||
| flag | ||
| fmt | ||
| go | ||
| hash | ||
| html | ||
| image | ||
| index/suffixarray | ||
| internal | ||
| io | ||
| log | ||
| maps | ||
| math | ||
| mime | ||
| net | ||
| os | ||
| path | ||
| plugin | ||
| reflect | ||
| regexp | ||
| runtime | ||
| slices | ||
| sort | ||
| strconv | ||
| strings | ||
| sync | ||
| syscall | ||
| testdata | ||
| testing | ||
| text | ||
| time | ||
| unicode | ||
| unsafe | ||
| vendor | ||
| Make.dist | ||
| README.vendor | ||
| all.bash | ||
| all.bat | ||
| all.rc | ||
| bootstrap.bash | ||
| buildall.bash | ||
| clean.bash | ||
| clean.bat | ||
| clean.rc | ||
| cmp.bash | ||
| go.mod | ||
| go.sum | ||
| make.bash | ||
| make.bat | ||
| make.rc | ||
| race.bash | ||
| race.bat | ||
| run.bash | ||
| run.bat | ||
| run.rc | ||
README.vendor
Vendoring in std and cmd
========================
The Go command maintains copies of external packages needed by the
standard library in the src/vendor and src/cmd/vendor directories.
There are two modules, std and cmd, defined in src/go.mod and
src/cmd/go.mod. When a package outside std or cmd is imported
by a package inside std or cmd, the import path is interpreted
as if it had a "vendor/" prefix. For example, within "crypto/tls",
an import of "golang.org/x/crypto/cryptobyte" resolves to
"vendor/golang.org/x/crypto/cryptobyte". When a package with the
same path is imported from a package outside std or cmd, it will
be resolved normally. Consequently, a binary may be built with two
copies of a package at different versions if the package is
imported normally and vendored by the standard library.
Vendored packages are internally renamed with a "vendor/" prefix
to preserve the invariant that all packages have distinct paths.
This is necessary to avoid compiler and linker conflicts. Adding
a "vendor/" prefix also maintains the invariant that standard
library packages begin with a dotless path element.
The module requirements of std and cmd do not influence version
selection in other modules. They are only considered when running
module commands like 'go get' and 'go mod vendor' from a directory
in GOROOT/src.
Maintaining vendor directories
==============================
Before updating vendor directories, ensure that module mode is enabled.
Make sure that GO111MODULE is not set in the environment, or that it is
set to 'on' or 'auto'.
Requirements may be added, updated, and removed with 'go get'.
The vendor directory may be updated with 'go mod vendor'.
A typical sequence might be:
cd src
go get golang.org/x/net@master
go mod tidy
go mod vendor
Use caution when passing '-u' to 'go get'. The '-u' flag updates
modules providing all transitively imported packages, not only
the module providing the target package.
Note that 'go mod vendor' only copies packages that are transitively
imported by packages in the current module. If a new package is needed,
it should be imported before running 'go mod vendor'.