StevenACoffman · August 5, 2025 15:06 · Jul 13, 2024 · Jul 13, 2024 · Jul 13, 2024 · Jul 13, 2024
diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -42,7 +42,7 @@ An alternative to using `[email protected]` is to [generate a personal access token
 
 ```
 # Github
-git config --global url."https://oauth2:${{ GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
+git config --global url."https://oauth2:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
 
 # Gitlab personal access token
 git config --global url."https://gitlab-ci-token:${GITLAB_PERSONAL_ACCESS_TOKEN}@gitlab.com/".insteadOf "https://gitlab.com/"

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -1,4 +1,6 @@
 ## Set GOPRIVATE to match your github organization
+I keep fixing this up, but if it fails for you, check if these are better maintained https://tip.golang.org/cmd/go/#hdr-Configuration_for_downloading_non_public_code and https://golang.org/ref/mod#private-modules.
+
 Cloning the repo using one of the below techniques should work correctly but you may still be getting an unrecognized import error.
 
 As it stands for Go v1.13, I found in the doc that we should [use the GOPRIVATE variable](https://golang.org/cmd/go/#hdr-Module_configuration_for_non_public_modules) like so:

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -1,5 +1,5 @@
 ## Set GOPRIVATE to match your github organization
-Cloning the repo using one of the below techniques should correctly but you may still getting an unrecognized import error.
+Cloning the repo using one of the below techniques should work correctly but you may still be getting an unrecognized import error.
 
 As it stands for Go v1.13, I found in the doc that we should [use the GOPRIVATE variable](https://golang.org/cmd/go/#hdr-Module_configuration_for_non_public_modules) like so:
 ```

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -40,7 +40,7 @@ An alternative to using `[email protected]` is to [generate a personal access token
 
 ```
 # Github
-git config --global url."https://${GITHUB_TOKEN}:x-oauth-basic@github.com/".insteadOf "https://github.com/"
+git config --global url."https://oauth2:${{ GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
 
 # Gitlab personal access token
 git config --global url."https://gitlab-ci-token:${GITLAB_PERSONAL_ACCESS_TOKEN}@gitlab.com/".insteadOf "https://gitlab.com/"

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -52,3 +52,23 @@ git config --global url."https://user%40bitbucket.com:${BITBUCKET_ACCESS_TOKEN}@
 You could also just store credentials in a credential helper like the `~/.git-credentials` file.
 
 Both should still work with go get -u, and also works with Docker builds.
+
+### Git Credential Manager (GCM) alternative
+[Git Credential Manager (GCM)](https://github.com/git-ecosystem/git-credential-manager) is another way to store your credentials securely and connect to GitHub over HTTPS. With GCM, you don't have to [manually create and store a personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens), as GCM manages authentication on your behalf, including [2FA (two-factor authentication)](https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa).
+
+1. Install Git using Homebrew:
+  ```
+  brew install git
+   ```
+2. Install GCM using Homebrew:
+  ```
+  brew install --cask git-credential-manager
+  ```
+For macOS, you don't need to run git config because GCM automatically configures Git for you.
+
+The next time you clone an HTTPS URL that requires authentication, Git will prompt you to log in using a browser window. You may first be asked to authorize an OAuth app. If your account or organization requires [two-factor auth](https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa), you'll also need to complete the 2FA challenge.
+
+Once you've authenticated successfully, your credentials are stored in the macOS keychain and will be used every time you clone an HTTPS URL. Git will not require you to type your credentials in the command line again unless you change your credentials.
+
+
+For more information or to report issues with GCM, see the official GCM docs at "[Git Credential Manager.](https://github.com/GitCredentialManager/git-credential-manager)"
diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -18,12 +18,14 @@ $ cat ~/.gitconfig
 $ go get -u -f github.com/private/repo && echo Success!
 Success!
 ```
+
 In Git `ssh://git@host/resource`, `git+ssh://git@host/resource`, `ssh+git://git@host/resource` and `git@host:resource` are [all the same protocol](https://git.kernel.org/pub/scm/git/git.git/commit/?id=c05186cc38ca4605bff1f275619d7d0faeaf2fa5).
 
 <table><tr><td>:bulb: <b>NOTE:</b> <a name="https://golang.org/doc/faq#git_https">go get uses HTTPS when cloning a repository</a>. So <a name="https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf">configuring insteadOf rewriting rules</a> will cause problems with <code>go get -u github.com/private/repo</code> later on, since a check at update time to verify that the local package's remote repository matches that of its custom import. This change was <a name="https://golang.org/doc/go1.4#canonicalimports">introduced in Go 1.4</a>.</td></tr></table>
 
 The workaround for that rewriting check would be to use `go get -u -f github.com/private/repo`:
 
+From the [`go get`](https://pkg.go.dev/cmd/go/internal/get#pkg-variables) options here: 
 > The -f flag, valid only when -u is set, forces get -u not to verify that each package has been checked out from the source control repository implied by its import path. This can be useful if the source is a local fork of the original.
 
 Sources:

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -9,9 +9,12 @@ The 'go env -w' command (see 'go help env') can be used to set these variables f
 ## How to `go get` private repos using SSH key auth instead of password auth.
 ```bash
 $ git config --global url."[email protected]:".insteadOf "https://github.com/"
+$ git config --global url."[email protected]:".insteadOf "https://gitlab.com/"
 $ cat ~/.gitconfig
 [url "[email protected]:"]
 	insteadOf = https://github.com/
+[url "[email protected]:"]
+	insteadOf = https://gitlab.com/
 $ go get -u -f github.com/private/repo && echo Success!
 Success!
 ```

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -38,8 +38,10 @@ An alternative to using `[email protected]` is to [generate a personal access token
 git config --global url."https://${GITHUB_TOKEN}:[email protected]/".insteadOf "https://github.com/"
 
 # Gitlab personal access token
-git clone https://gitlab-ci-token:${GITLAB_PERSONAL_ACCESS_TOKEN}@gitlab.com/username/myrepo.git
+git config --global url."https://gitlab-ci-token:${GITLAB_PERSONAL_ACCESS_TOKEN}@gitlab.com/".insteadOf "https://gitlab.com/"
 
+# BitBucket is a weird place. You need user slug rather than username
+git config --global url."https://user%40bitbucket.com:${BITBUCKET_ACCESS_TOKEN}@bitbucket.com/".insteadOf "https://bitbucket.com/"
 ```
 
 You could also just store credentials in a credential helper like the `~/.git-credentials` file.

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -38,7 +38,7 @@ An alternative to using `[email protected]` is to [generate a personal access token
 git config --global url."https://${GITHUB_TOKEN}:[email protected]/".insteadOf "https://github.com/"
 
 # Gitlab personal access token
-git clone https://gitlab-ci-token:${Personal Access Tokens}@gitlab.com/username/myrepo.git
+git clone https://gitlab-ci-token:${GITLAB_PERSONAL_ACCESS_TOKEN}@gitlab.com/username/myrepo.git
 
 ```
 

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -37,8 +37,8 @@ An alternative to using `[email protected]` is to [generate a personal access token
 # Github
 git config --global url."https://${GITHUB_TOKEN}:[email protected]/".insteadOf "https://github.com/"
 
-# BitBucket
-git config --global url."[email protected]:".insteadOf "https://bitbucket.org/"
+# Gitlab personal access token
+git clone https://gitlab-ci-token:${Personal Access Tokens}@gitlab.com/username/myrepo.git
 
 ```
 

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -17,9 +17,9 @@ Success!
 ```
 In Git `ssh://git@host/resource`, `git+ssh://git@host/resource`, `ssh+git://git@host/resource` and `git@host:resource` are [all the same protocol](https://git.kernel.org/pub/scm/git/git.git/commit/?id=c05186cc38ca4605bff1f275619d7d0faeaf2fa5).
 
-<table><tr><td>:bulb: <b>NOTE:</b> Since <a name="https://golang.org/doc/faq#git_https">go get uses HTTPS when cloning a repository</a>, <a name="https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf">configuring insteadOf rewriting rules</a> will cause problems with <code>go get -u github.com/private/repo</code> later on, since a check at update time to verify that the local package's remote repository matches that of its custom import. This change was <a name="https://golang.org/doc/go1.4#canonicalimports">introduced in Go 1.4</a>.</td></tr></table>
+<table><tr><td>:bulb: <b>NOTE:</b> <a name="https://golang.org/doc/faq#git_https">go get uses HTTPS when cloning a repository</a>. So <a name="https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf">configuring insteadOf rewriting rules</a> will cause problems with <code>go get -u github.com/private/repo</code> later on, since a check at update time to verify that the local package's remote repository matches that of its custom import. This change was <a name="https://golang.org/doc/go1.4#canonicalimports">introduced in Go 1.4</a>.</td></tr></table>
 
-The workaround for that check would be to use `go get -u -f github.com/private/repo`:
+The workaround for that rewriting check would be to use `go get -u -f github.com/private/repo`:
 
 > The -f flag, valid only when -u is set, forces get -u not to verify that each package has been checked out from the source control repository implied by its import path. This can be useful if the source is a local fork of the original.
 

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -17,10 +17,7 @@ Success!
 ```
 In Git `ssh://git@host/resource`, `git+ssh://git@host/resource`, `ssh+git://git@host/resource` and `git@host:resource` are [all the same protocol](https://git.kernel.org/pub/scm/git/git.git/commit/?id=c05186cc38ca4605bff1f275619d7d0faeaf2fa5).
 
-<table><tr><td>:bulb: <b>NOTE:</b> Since [go get uses HTTPS when cloning a repository](https://golang.org/doc/faq#git_https), [configuring insteadOf rewriting rules](https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf) will cause problems with `go get -u github.com/private/repo` later on, since a check at update time to verify that the local package's remote repository matches that of its custom import. This change was [introduced in Go 1.4](https://golang.org/doc/go1.4#canonicalimports).</td></tr></table>
-
-
-Since [go get uses HTTPS when cloning a repository](https://golang.org/doc/faq#git_https), [configuring insteadOf rewriting rules](https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf) will cause problems with `go get -u github.com/private/repo` later on, since a check at update time to verify that the local package's remote repository matches that of its custom import. This change was [introduced in Go 1.4](https://golang.org/doc/go1.4#canonicalimports).
+<table><tr><td>:bulb: <b>NOTE:</b> Since <a name="https://golang.org/doc/faq#git_https">go get uses HTTPS when cloning a repository</a>, <a name="https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf">configuring insteadOf rewriting rules</a> will cause problems with <code>go get -u github.com/private/repo</code> later on, since a check at update time to verify that the local package's remote repository matches that of its custom import. This change was <a name="https://golang.org/doc/go1.4#canonicalimports">introduced in Go 1.4</a>.</td></tr></table>
 
 The workaround for that check would be to use `go get -u -f github.com/private/repo`:
 

diff --git a/gistfile1.md b/gistfile1.md
@@ -1,15 +0,0 @@
-```bash
-$ ssh -A vm
-$ git config --global url."[email protected]:".insteadOf "https://github.com/"
-$ cat ~/.gitconfig
-[url "[email protected]:"]
-	insteadOf = https://github.com/
-$ go get github.com/private/repo && echo Success!
-Success!
-```
-
-Sources:
-
-- https://help.github.com/articles/which-remote-url-should-i-use #You can also use SSH agent forwarding with your deploy script to avoid managing keys on the server.
-- http://golang.org/doc/faq #Why does "go get" use HTTPS when cloning a repository?
-- https://www.kernel.org/pub/software/scm/git/docs/git-config.html #url.\<base\>.insteadOf

diff --git a/goGetPrivate.md b/goGetPrivate.md
@@ -0,0 +1,50 @@
+## Set GOPRIVATE to match your github organization
+Cloning the repo using one of the below techniques should correctly but you may still getting an unrecognized import error.
+
+As it stands for Go v1.13, I found in the doc that we should [use the GOPRIVATE variable](https://golang.org/cmd/go/#hdr-Module_configuration_for_non_public_modules) like so:
+```
+GOPRIVATE=github.com/ORGANISATION_OR_USER_NAME go get -u -f github.com/ORGANISATION_OR_USER_NAME/REPO_NAME
+```
+The 'go env -w' command (see 'go help env') can be used to set these variables for future go command invocations.
+## How to `go get` private repos using SSH key auth instead of password auth.
+```bash
+$ git config --global url."[email protected]:".insteadOf "https://github.com/"
+$ cat ~/.gitconfig
+[url "[email protected]:"]
+	insteadOf = https://github.com/
+$ go get -u -f github.com/private/repo && echo Success!
+Success!
+```
+In Git `ssh://git@host/resource`, `git+ssh://git@host/resource`, `ssh+git://git@host/resource` and `git@host:resource` are [all the same protocol](https://git.kernel.org/pub/scm/git/git.git/commit/?id=c05186cc38ca4605bff1f275619d7d0faeaf2fa5).
+
+<table><tr><td>:bulb: <b>NOTE:</b> Since [go get uses HTTPS when cloning a repository](https://golang.org/doc/faq#git_https), [configuring insteadOf rewriting rules](https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf) will cause problems with `go get -u github.com/private/repo` later on, since a check at update time to verify that the local package's remote repository matches that of its custom import. This change was [introduced in Go 1.4](https://golang.org/doc/go1.4#canonicalimports).</td></tr></table>
+
+
+Since [go get uses HTTPS when cloning a repository](https://golang.org/doc/faq#git_https), [configuring insteadOf rewriting rules](https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf) will cause problems with `go get -u github.com/private/repo` later on, since a check at update time to verify that the local package's remote repository matches that of its custom import. This change was [introduced in Go 1.4](https://golang.org/doc/go1.4#canonicalimports).
+
+The workaround for that check would be to use `go get -u -f github.com/private/repo`:
+
+> The -f flag, valid only when -u is set, forces get -u not to verify that each package has been checked out from the source control repository implied by its import path. This can be useful if the source is a local fork of the original.
+
+Sources:
+
+- https://help.github.com/articles/which-remote-url-should-i-use #You can also use SSH agent forwarding with your deploy script to avoid managing keys on the server.
+- http://golang.org/doc/faq #Why does "go get" use HTTPS when cloning a repository?
+- https://www.kernel.org/pub/software/scm/git/docs/git-config.html #url.\<base\>.insteadOf
+
+## How to `go get` private repos using HTTPS via Personal Access Tokens
+
+An alternative to using `[email protected]` is to [generate a personal access token on your GitHub account](https://github.com/settings/tokens/new) (or for a service account), grant it repo access, and then use the following instead:
+
+```
+# Github
+git config --global url."https://${GITHUB_TOKEN}:[email protected]/".insteadOf "https://github.com/"
+
+# BitBucket
+git config --global url."[email protected]:".insteadOf "https://bitbucket.org/"
+
+```
+
+You could also just store credentials in a credential helper like the `~/.git-credentials` file.
+
+Both should still work with go get -u, and also works with Docker builds.
diff --git a/gistfile1.md b/gistfile1.md
@@ -1,5 +1,6 @@
 ```bash
 $ ssh -A vm
+$ git config --global url."[email protected]:".insteadOf "https://github.com/"
 $ cat ~/.gitconfig
 [url "[email protected]:"]
 	insteadOf = https://github.com/

diff --git a/gistfile1.md b/gistfile1.md
@@ -1,7 +1,7 @@
 ```bash
 $ ssh -A vm
 $ cat ~/.gitconfig
-url "[email protected]:"]
+[url "[email protected]:"]
 	insteadOf = https://github.com/
 $ go get github.com/private/repo && echo Success!
 Success!

diff --git a/gistfile1.md b/gistfile1.md
@@ -11,4 +11,4 @@ Sources:
 
 - https://help.github.com/articles/which-remote-url-should-i-use #You can also use SSH agent forwarding with your deploy script to avoid managing keys on the server.
 - http://golang.org/doc/faq #Why does "go get" use HTTPS when cloning a repository?
-- https://www.kernel.org/pub/software/scm/git/docs/git-config.html #url.<base>.insteadOf
+- https://www.kernel.org/pub/software/scm/git/docs/git-config.html #url.\<base\>.insteadOf
diff --git a/gistfile1.md b/gistfile1.md
@@ -9,6 +9,6 @@ Success!
 
 Sources:
 
-https://help.github.com/articles/which-remote-url-should-i-use #You can also use SSH agent forwarding with your deploy script to avoid managing keys on the server.
-http://golang.org/doc/faq #Why does "go get" use HTTPS when cloning a repository?
-https://www.kernel.org/pub/software/scm/git/docs/git-config.html #url.<base>.insteadOf
+- https://help.github.com/articles/which-remote-url-should-i-use #You can also use SSH agent forwarding with your deploy script to avoid managing keys on the server.
+- http://golang.org/doc/faq #Why does "go get" use HTTPS when cloning a repository?
+- https://www.kernel.org/pub/software/scm/git/docs/git-config.html #url.<base>.insteadOf
diff --git a/gistfile1.md b/gistfile1.md
@@ -0,0 +1,14 @@
+```bash
+$ ssh -A vm
+$ cat ~/.gitconfig
+url "[email protected]:"]
+	insteadOf = https://github.com/
+$ go get github.com/private/repo && echo Success!
+Success!
+```
+
+Sources:
+
+https://help.github.com/articles/which-remote-url-should-i-use #You can also use SSH agent forwarding with your deploy script to avoid managing keys on the server.
+http://golang.org/doc/faq #Why does "go get" use HTTPS when cloning a repository?
+https://www.kernel.org/pub/software/scm/git/docs/git-config.html #url.<base>.insteadOf