-
-
Notifications
You must be signed in to change notification settings - Fork 7.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
GOROOT should be in the default security config #10429
Comments
Thanks for the detailed report. We added a security configuration. The default setup has worked great for me on most MacOS/Linux setups, but I'll admit that I don't use Windows that much (we have passing tests, though, so it's not failing everywhere). Could you test by adding something like this to your [security]
[security.exec]
allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$']
osEnv = ['(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO*)$'] You could also set this as an OS env on your PC:
|
Hi @bep , Thanks for the (very) rapid response! I can confirm that, with a minor tweak (missing Is there (currently) a way to get Hugo to simply print its working environment, similar to what For future readers, the relevant part of the Hugo documentation on this stuff is here: Hugo's Security Model | Hugo |
This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs. |
It appears that, since v0.91.1, the change made here v0.90.1...v0.91.0#diff-f05a06652ef1b9e80126ab646b8d1e1231b91c8baf067e5755398cd622adbd86R95
causes
hugo
to no longer honour/useGOROOT
, if it is defined, meaning that, for me at least, in Windows with Go installed to a location other than the hardcoded default of "C:\go", hugo fails to perform operations such as "serve" that tries to call go under the hood.(I should stress that I think that's the root cause; it looks like it would be, as it appears to set/create the environment from scratch rather than build on the existing environment, but I have not tested this in a coding sense).
In v0.90.1-extended, things seem to work, but from 0.91.0 onwards (I have tried 0.91.1, 0.92.0, 0.93.0, 0.95.0 and 0.105.0, all "extended" variants), the problem occurs.
The error appears as follows:
while go env shows this (redacted and truncated):
which clearly indicates that
GOROOT
is set to something very different to "c:\go"I am using go version 1.19.1:
It's a bit old, and I cannot find the related info on the official Golang documentation pages, but this post (https://stackoverflow.com/a/31101257) suggests that, when Go is installed in Windows via the archive, GOROOT must be set correctly.
The text was updated successfully, but these errors were encountered: