title: Why `go get` tries to access http instead of https?
body: <p>I'm now using private repository for my collaboration projects.<br>
  I set up my personal GitLab like <code>gitlab.xity.dev/QuietJoon/testgoget</code>,<br>
  and I tried to provide it for my team.<br>
  (the repository <code>https://gitlab.xity.dev/QuietJoon/testgoget</code> is public for this question)</p>
  
  <h2>Problems</h2>
  
  <p>However, when I tried <code>go get -v gitlab.xity.dev/QuietJoon/testgoget</code>,<br>
  it says </p>
  
  <pre><code>get "gitlab.xity.dev/QuietJoon/testgoget": found meta tag get.metaImport{Prefix:"gitlab.xity.dev/QuietJoon/testgoget", VCS:"git", RepoRoot:"http://gitlab.xity.dev/QuietJoon/testgoget.git"} at //gitlab.xity.dev/QuietJoon/testgoget?go-get=1
  package gitlab.xity.dev/QuietJoon/testgoget: cannot download, http://gitlab.xity.dev/QuietJoon/testgoget.git uses insecure protocol
  </code></pre>
  
  <p>Also, I tried <code>go get -v gitlab.xity.dev/QuietJoon/testgoget.git</code> with explicit <code>.git</code> suffix
  And I get</p>
  
  <pre><code># cd .; git ls-remote https://gitlab.xity.dev/QuietJoon/testgoget
  fatal: repository 'https://gitlab.xity.dev/QuietJoon/testgoget/' not found
  # cd .; git ls-remote git+ssh://gitlab.xity.dev/QuietJoon/testgoget
  </code></pre>
  
  <p>you can see <code>go get</code> tries <code>https</code> first,<br>
  but <code>go get</code> strip suffix of <code>.git</code> therefore it says the repository not found, and advance to next <code>git+ssh</code> protocol. 
  I could get <code>git clone gitlab.xity.dev/QuietJoon/testgoget.git</code> without any authentication process,</p>
  
  <pre><code>git ls-remote https://gitlab.xity.dev/QuietJoon/testgoget.git
  c238e4b9818eabe6309a2c5cf274808ec39bf7d5        HEAD
  c238e4b9818eabe6309a2c5cf274808ec39bf7d5        refs/heads/master
  </code></pre>
  
  <h2>My Incomplete Solution</h2>
  
  <p>After I set global git redirection configuration (like <code>git config --global url."https://gitlab.xity.dev".insteadOf "http://gitlab.xity.dev"</code>)<br>
  I could get the package with <code>-insecure</code> flag </p>
  
  <pre><code>$ go get -v -insecure gitlab.xity.dev/QuietJoon/testgoget
  get "gitlab.xity.dev/QuietJoon/testgoget": found meta tag get.metaImport{Prefix:"gitlab.xity.dev/QuietJoon/testgoget", VCS:"git", RepoRoot:"http://gitlab.xity.dev/QuietJoon/testgoget.git"} at //gitlab.xity.dev/QuietJoon/testgoget?go-get=1
  gitlab.xity.dev/QuietJoon/testgoget (download)
  gitlab.xity.dev/QuietJoon/testgoget
  </code></pre>
  
  <p>When I does not provide <code>http://gitlab.xity.dev/QuietJoon/testgoget</code> like</p>
  
  <pre><code>$ curl -I http://gitlab.xity.dev/QuietJoon/testgoget
  HTTP/1.1 404 Not Found
  Server: nginx/1.16.0
  Date: Tue, 09 Jun 2020 06:16:25 GMT
  Content-Type: text/html
  Content-Length: 153
  Connection: keep-alive
  $ curl -I http://gitlab.xity.dev/QuietJoon/testgoget.git
  HTTP/1.1 404 Not Found
  Server: nginx/1.16.0
  Date: Tue, 09 Jun 2020 06:17:30 GMT
  Content-Type: text/html
  Content-Length: 153
  Connection: keep-alive
  $ git clone http://gitlab.xity.dev/QuietJoon/testgoget
  Cloning into 'testgoget'...
  fatal: repository 'http://gitlab.xity.dev/QuietJoon/testgoget/' not found
  $ git clone http://gitlab.xity.dev/QuietJoon/testgoget.git
  Cloning into 'testgoget'...
  fatal: repository 'http://gitlab.xity.dev/QuietJoon/testgoget.git/' not found
  </code></pre>
  
  <p>Yes, this may work because <code>go get</code> uses <code>git clone</code>, and <code>go get</code> adds <code>.git</code> suffix to given url when the protocol is insecure.</p>
  
  <h2>Other solutions</h2>
  
  <p>I could solve this by using <code>git clone</code> it at <code>%GOPATH%/src</code> manually.</p>
  
  <p>However, this is not my personal project, but collaborative project.<br>
  Therefore, I can't tell everyone to do it above. (because me and everyone else are Golang beginners)<br>
  I want to using this only with regular Golang manner 
  * only with <code>import "gitlab.xity.dev/XXX/YYY"</code>. (<code>import "gitlab.xity.dev/XXX/YYY.git"</code> also seems to be bad manner for Golang), 
  * not manual git redirection configuration and <code>go get -insecure</code> by oneself</p>
  
  <h2>Questions</h2>
  
  <h3>1. How can I help <code>go get</code> to access <code>https</code> instead of <code>http</code>?</h3>
  
  <p>I've surveyed many helps like Q&amp;A like <a href="https://stackoverflow.com/questions/27500861/whats-the-proper-way-to-go-get-a-private-repository">this</a>, and add global git configuration like</p>
  
  <pre><code>[url "https://gitlab.xity.dev"]
          insteadOf = http://gitlab.xity.dev
  </code></pre>
  
  <p>but this does not help <code>go get</code> properly without <code>-insecure</code> flag.<br>
  I understand that <code>go get</code> never realize that there is such git configuration.</p>
  
  <p>Then, How can I help <code>go get</code> to prefer trying <code>https</code> instead of <code>http</code>?</p>
  
  <h3>2. Why <code>go get</code> prefer to access <code>http</code> instead of <code>https</code> even it says it does not like to access insecure protocol?</h3>
  
  <p>Even <code>go get</code> complains about insecure protocol, why it does not try to access <code>https</code> at first instead of <code>http</code>?<br>
  I'm not sure that this is bug of <code>go get</code> or not.</p>
  
  <h3>3. Why <code>go get</code> strip the suffix <code>.git</code> even I give it explicitly?</h3>
  
  <p>When I give <code>.git</code> suffix explicitly, <code>go get</code> drops given suffix and says that it couldn't found repository properly.</p>
  
  <pre><code>$ go get -v gitlab.xity.dev/QuietJoon/testgoget.git
  # cd .; git ls-remote https://gitlab.xity.dev/QuietJoon/testgoget
  fatal: repository 'https://gitlab.xity.dev/QuietJoon/testgoget/' not found
  </code></pre>
  
  <p>But you can see that <code>go get</code> does not need explicit <code>.git</code> when it tries insecure protocol like</p>
  
  <pre><code>$ go get -v gitlab.xity.dev/QuietJoon/testgoget
  get "gitlab.xity.dev/QuietJoon/testgoget": found meta tag get.metaImport{Prefix:"gitlab.xity.dev/QuietJoon/testgoget", VCS:"git", RepoRoot:"http://gitlab.xity.dev/QuietJoon/testgoget.git"} at //gitlab.xity.dev/QuietJoon/testgoget?go-get=1
  package gitlab.xity.dev/QuietJoon/testgoget: cannot download, http://gitlab.xity.dev/QuietJoon/testgoget.git uses insecure protocol
  </code></pre>
  
  <p>What makes the difference?</p>
  
  <h2>Conditions &amp; Environment</h2>
  
  <p>I tried this with 
  * go version go1.14.4 windows/amd64
  * go version go1.14.3 darwin/amd64
  * go version go1.12.7 linux/amd64
  * go version go1.14.4 linux/amd64</p>
  
  <p>I've set <code>GOPRIVATE</code> for <code>gitlab.xity.dev</code> like</p>
  
  <pre><code>go env
  ...
  set GOEXE=.exe
  set GOFLAGS=
  set GOHOSTARCH=amd64
  set GOHOSTOS=windows
  set GOINSECURE=
  set GONOPROXY=gitlab.xity.dev
  set GONOSUMDB=gitlab.xity.dev
  set GOOS=windows
  set GOPATH=t:\go
  set GOPRIVATE=gitlab.xity.dev
  set GOPROXY=https://proxy.golang.org,direct
  set GOSUMDB=sum.golang.org
  ...
  </code></pre>
  
  <p>I think that <code>GOPRIVATE</code> is not used yet in this situation.</p>