Download only private modules from internal go proxy and get the public ones from the an external proxy

Question

I got started with migrating a Go project to use modules for dependency management. My company has an internal go proxy that hosts PRIVATE modules ONLY. So, I need a way to download the PRIVATE modules from the internal proxy, let say goproxy.company.com and the public modules like the golang.org/x/tools/cmd/goimports and github.com/sirupsen/logrus from a publicly available go proxy like proxy.golang.org. I was thought this would solve it.

GOPROXY='goproxy.company.com,proxy.golang.org,direct'

GPPRIVATE=*.company.com/*

But, it fails after trying out the first proxy and the second and never uses the direct option as a fallback. Is this a known issue or am I doing something wrong here?

Is there a better way to do this? Are the corporate internal proxies expected to host the publicly available go modules are well? Is this the general expectation?

I get that feeling after reading the docs. Here are the references.

As mentioned in the Proposal: Secure the Public Go Module Ecosystem

We expect that corporate environments may fetch all modules, public and private, through an internal proxy;

Also, in the go docs example for a corporate proxy

For example, if a company ran a module proxy serving private modules, users would configure go using:

GOPRIVATE=*.corp.example.com 
GOPROXY=proxy.example.com 
GONOPROXY=none

This would tell the go command and other tools that modules beginning with a corp.example.com subdomain are private but that the company proxy should be used for downloading both public and private modules, because GONOPROXY has been set to a pattern that won't match any modules, overriding GOPRIVATE.

Answer 1

Go 1.15 added a feature which now allows you to set up GOPROXY to skips proxies.

From Go 1.15 Release Notes:

The GOPROXY environment variable now supports skipping proxies that return errors. Proxy URLs may now be separated with either commas (,) or pipe characters (|). If a proxy URL is followed by a comma, the go command will only try the next proxy in the list after a 404 or 410 HTTP response. If a proxy URL is followed by a pipe character, the go command will try the next proxy in the list after any error. Note that the default value of GOPROXY remains https://proxy.golang.org,direct, which does not fall back to direct in case of errors.

This should allow you to set up GOPROXY as you're indicating in your question.