cmd/go: fix module get -insecure

Need to actually use the flag for it to take effect.

Fixes #27049.

Change-Id: I57227b45f46f9dd67ecbf87c11bb2d08124bcfa0
Reviewed-on: https://go-review.googlesource.com/129801
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

src/cmd/go/go_test.go

@@ -3532,14 +3532,24 @@ func TestImportLocal(t *testing.T) {
 }
 
 func TestGoGetInsecure(t *testing.T) {
+	test := func(t *testing.T, modules bool) {
 		testenv.MustHaveExternalNetwork(t)
 
 		tg := testgo(t)
 		defer tg.cleanup()
 		tg.makeTempdir()
-	tg.setenv("GOPATH", tg.path("."))
 		tg.failSSH()
 
+		if modules {
+			tg.setenv("GOPATH", tg.path("gp"))
+			tg.tempFile("go.mod", "module m")
+			tg.cd(tg.path("."))
+			tg.setenv("GO111MODULE", "on")
+		} else {
+			tg.setenv("GOPATH", tg.path("."))
+			tg.setenv("GO111MODULE", "off")
+		}
+
 		const repo = "insecure.go-get-issue-15410.appspot.com/pkg/p"
 
 		// Try go get -d of HTTP-only repo (should fail).
@@ -3550,6 +3560,15 @@ func TestGoGetInsecure(t *testing.T) {
 
 		// Try updating without -insecure (should fail).
 		tg.runFail("get", "-d", "-u", "-f", repo)
+
+		if modules {
+			tg.run("list", "-m", "...")
+			tg.grepStdout("insecure.go-get-issue", "should find insecure module")
+		}
+	}
+
+	t.Run("gopath", func(t *testing.T) { test(t, false) })
+	t.Run("modules", func(t *testing.T) { test(t, true) })
 }
 
 func TestGoGetUpdateInsecure(t *testing.T) {

src/cmd/go/internal/modfetch/repo.go

@@ -216,7 +216,11 @@ func lookup(path string) (r Repo, err error) {
 		return lookupProxy(path)
 	}
 
-	rr, err := get.RepoRootForImportPath(path, get.PreferMod, web.Secure)
+	security := web.Secure
+	if get.Insecure {
+		security = web.Insecure
+	}
+	rr, err := get.RepoRootForImportPath(path, get.PreferMod, security)
 	if err != nil {
 		// We don't know where to find code for a module with this path.
 		return nil, err
@@ -257,7 +261,11 @@ func ImportRepoRev(path, rev string) (Repo, *RevInfo, error) {
 	// Note: Because we are converting a code reference from a legacy
 	// version control system, we ignore meta tags about modules
 	// and use only direct source control entries (get.IgnoreMod).
-	rr, err := get.RepoRootForImportPath(path, get.IgnoreMod, web.Secure)
+	security := web.Secure
+	if get.Insecure {
+		security = web.Insecure
+	}
+	rr, err := get.RepoRootForImportPath(path, get.IgnoreMod, security)
 	if err != nil {
 		return nil, nil, err
 	}