Repository: gohugoio/hugo (language: go)

Issue:
`fatal: unable to find remote helper for 'https'` due to snap confinement
<!-- Please answer these questions before submitting your issue. Thanks! -->

### What version of Hugo are you using (`hugo version`)?

<pre>
$ hugo version
hugo v0.115.0-67caf50698783d3b3d78559ac81483d83e5e1a35+extended linux/amd64 BuildDate=2023-06-29T15:56:39Z VendorInfo=snap:0.115.0
</pre>

### Does this issue reproduce with the latest release?

Yes, it happens with the following build too:
```
$ hugo version
hugo v0.116.0-DEV-0ff8e13c1cb603109204f88116746067f0344f77+extended linux/amd64 BuildDate=2023-06-30T13:57:46Z VendorInfo=snap:0.115.0+git4.0ff8e13c
```

### How to reproduce

On Ubuntu 22.04.2 LTS,

```
$ sudo snap install --channel extended/stable hugo

$ git clone https://github.com/wowchemy/starter-hugo-academic.git
$ cd starter-hugo-academic/

$ hugo
```

Then, the following error happens.
```
go: github.com/wowchemy/wowchemy-hugo-themes/modules/wowchemy-plugin-netlify@v1.0.0: invalid version: git ls-remote -q origin in /tmp/hugo_cache_nobuto/modules/filecache/modules/pkg/mod/cache/vcs/0c88995f39c54fe356dd74460b6359b56b0fb376c52289c9656c86270b2c006d: exit status 128:
	fatal: unable to find remote helper for 'https'
go: github.com/wowchemy/wowchemy-hugo-themes/modules/wowchemy-plugin-netlify-cms@v1.0.0: invalid version: git ls-remote -q origin in /tmp/hugo_cache_nobuto/modules/filecache/modules/pkg/mod/cache/vcs/0c88995f39c54fe356dd74460b6359b56b0fb376c52289c9656c86270b2c006d: exit status 128:
	fatal: unable to find remote helper for 'https'
go: github.com/wowchemy/wowchemy-hugo-themes/modules/wowchemy-plugin-reveal@v1.0.0: invalid version: git ls-remote -q origin in /tmp/hugo_cache_nobuto/modules/filecache/modules/pkg/mod/cache/vcs/0c88995f39c54fe356dd74460b6359b56b0fb376c52289c9656c86270b2c006d: exit status 128:
	fatal: unable to find remote helper for 'https'
go: github.com/wowchemy/wowchemy-hugo-themes/modules/wowchemy/v5@v5.7.1-0.20230420205746-951c7b6f709d: invalid version: git ls-remote -q origin in /tmp/hugo_cache_nobuto/modules/filecache/modules/pkg/mod/cache/vcs/0c88995f39c54fe356dd74460b6359b56b0fb376c52289c9656c86270b2c006d: exit status 128:
	fatal: unable to find remote helper for 'https'
hugo: collected modules in 897 ms
Total in 906 ms
Error: failed to load modules: failed to download modules: failed to execute 'go [mod download]': failed to execute binary "go" with args [mod download]: go: github.com/wowchemy/wowchemy-hugo-themes/modules/wowchemy-plugin-netlify@v1.0.0: invalid version: git ls-remote -q origin in /tmp/hugo_cache_nobuto/modules/filecache/modules/pkg/mod/cache/vcs/0c88995f39c54fe356dd74460b6359b56b0fb376c52289c9656c86270b2c006d: exit status 128:
	fatal: unable to find remote helper for 'https'
go: github.com/wowchemy/wowchemy-hugo-themes/modules/wowchemy-plugin-netlify-cms@v1.0.0: invalid version: git ls-remote -q origin in /tmp/hugo_cache_nobuto/modules/filecache/modules/pkg/mod/cache/vcs/0c88995f39c54fe356dd74460b6359b56b0fb376c52289c9656c86270b2c006d: exit status 128:
	fatal: unable to find remote helper for 'https'
go: github.com/wowchemy/wowchemy-hugo-themes/modules/wowchemy-plugin-reveal@v1.0.0: invalid version: git ls-remote -q origin in /tmp/hugo_cache_nobuto/modules/filecache/modules/pkg/mod/cache/vcs/0c88995f39c54fe356dd74460b6359b56b0fb376c52289c9656c86270b2c006d: exit status 128:
	fatal: unable to find remote helper for 'https'
go: github.com/wowchemy/wowchemy-hugo-themes/modules/wowchemy/v5@v5.7.1-0.20230420205746-951c7b6f709d: invalid version: git ls-remote -q origin in /tmp/hugo_cache_nobuto/modules/filecache/modules/pkg/mod/cache/vcs/0c88995f39c54fe356dd74460b6359b56b0fb376c52289c9656c86270b2c006d: exit status 128:
	fatal: unable to find remote helper for 'https'
 *errors.errorString
```

It's likely from the snap confinement because I see the following kernel messages:

```
Jul 01 21:34:13 t14 kernel: audit: type=1400 audit(1688214853.951:2485): apparmor="DENIED" operation="open" profile="snap.hugo.hugo" name="/proc/334993/mountinfo" pid=334993 comm="hugo" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Jul 01 21:34:13 t14 kernel: audit: type=1400 audit(1688214853.955:2486): apparmor="DENIED" operation="open" profile="snap.hugo.hugo" name="/snap/core20/1950/usr/lib/x86_64-linux-gnu/libpthread-2.31.so" pid=335035 comm="go" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jul 01 21:34:13 t14 kernel: audit: type=1400 audit(1688214853.955:2487): apparmor="DENIED" operation="open" profile="snap.hugo.hugo" name="/snap/core20/1950/usr/lib/x86_64-linux-gnu/libc-2.31.so" pid=335035 comm="go" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jul 01 21:34:13 t14 kernel: audit: type=1400 audit(1688214853.963:2488): apparmor="DENIED" operation="open" profile="snap.hugo.hugo" name="/snap/core20/1950/usr/lib/x86_64-linux-gnu/libnss_files-2.31.so" pid=335035 comm="go" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jul 01 21:34:13 t14 kernel: audit: type=1400 audit(1688214853.963:2489): apparmor="DENIED" operation="open" profile="snap.hugo.hugo" name="/snap/core20/1950/usr/lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2" pid=335035 comm="go" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jul 01 21:34:13 t14 kernel: audit: type=1400 audit(1688214853.963:2490): apparmor="DENIED" operation="open" profile="snap.hugo.hugo" name="/snap/core20/1950/usr/lib/x86_64-linux-gnu/libresolv-2.31.so" pid=335035 comm="go" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jul 01 21:34:13 t14 kernel: audit: type=1400 audit(1688214853.963:2491): apparmor="DENIED" operation="open" profile="snap.hugo.hugo" name="/snap/core20/1950/usr/lib/x86_64-linux-gnu/libnss_dns-2.31.so" pid=335035 comm="go" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
```

And it's not reproducible if I by-pass the confinement.

```
$ /snap/hugo/current/bin/hugo 
hugo: downloading modules …
hugo: collected modules in 6550 ms
Start building sites … 
hugo v0.115.0-67caf50698783d3b3d78559ac81483d83e5e1a35+extended linux/amd64 BuildDate=2023-06-29T15:56:39Z VendorInfo=snap:0.115.0


                   | EN  
-------------------+-----
  Pages            | 55  
  Paginator pages  |  0  
  Non-page files   | 16  
  Static files     |  9  
  Processed images | 69  
  Aliases          | 15  
  Sitemaps         |  1  
  Cleaned          |  0  

Total in 8944 ms
```

For the record, I didn't see this issue on June 17, 2023 so it might be a new issue with snap builds since then.


Discussion / hints:
Unable to reproduce with hugo v0.115.0-67caf50698783d3b3d78559ac81483d83e5e1a35+extended linux/amd64 BuildDate=2023-06-29T15:56:39Z VendorInfo=snap:0.115.0.
@jmooring Thank you for trying to reproduce it. May I ask what host OS version did you run the hugo snap on?
Ubuntu 22.04.2 LTS for x86_64


Somehow it's reliably reproducible on a clean VM.

At least in my case, there is a clear difference between:

[known to fail - fatal: unable to find remote helper for 'https']
>   extended/stable:    0.115.0               2023-06-29 (16457) 103MB -

> hugo v0.115.0-67caf50698783d3b3d78559ac81483d83e5e1a35+extended linux/amd64 BuildDate=2023-06-29T15:56:39Z VendorInfo=snap:0.115.0


[known to work]
```
$ sudo snap refresh --channel extended/stable --revision 16307 hugo
```

> installed:            0.114.1                          (16307) 103MB -

> hugo v0.114.1-e9b716ad9869b79e7c374bbdae4daf5ee6406bd4+extended linux/amd64 BuildDate=2023-06-23T11:02:58Z VendorInfo=snap:0.114.1

So on my env, it looks like the update on Jun 30 started to see the failure.

```
$ grep hugo /var/log/syslog | grep revision
Jun 26 10:38:21 t14 systemd[1]: Mounting Mount unit for hugo, revision 16307...
Jun 26 10:38:21 t14 systemd[1]: Mounted Mount unit for hugo, revision 16307.
Jun 26 14:01:41 t14 systemd[1]: Mounting Mount unit for hugo, revision 16238...
Jun 26 14:01:41 t14 systemd[1]: Mounting Mount unit for hugo, revision 16307...
Jun 26 14:01:41 t14 systemd[1]: Mounted Mount unit for hugo, revision 16238.
Jun 26 14:01:41 t14 systemd[1]: Mounted Mount unit for hugo, revision 16307.
Jun 30 17:42:03 t14 systemd[1]: Mounting Mount unit for hugo, revision 16457...
Jun 30 17:42:03 t14 systemd[1]: Mounted Mount unit for hugo, revision 16457.
```
What host OS version did you run the hugo snap on?
> What host OS version did you run the hugo snap on?

Ubuntu 22.04.2 LTS with amd64 so it should be the same as your version so I'm wondering what's a difference on my side.
I'll spin up a virgin VM and repeat the test.
I can reproduce on a virgin VM, and am trying to track down the cause. 
Experiencing the same issue with 
```
$ hugo version
hugo v0.115.0-67caf50698783d3b3d78559ac81483d83e5e1a35+extended linux/amd64 BuildDate=2023-06-29T15:56:39Z VendorInfo=snap:0.115.0
```
on ubuntu 20.04 (worked yesterday, before I did the update)

Fix patch:
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
index a3a9c00e08c..fc5ef99416f 100644
--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@@ -98,7 +98,7 @@ parts:
       echo "   - pandoc_datadir to be passed to pandoc"
       echo "   - PYTHONHOME and SNAP to be passed to rst2html"
       echo "   - RUBYLIB to be passed to asciidoctor"
-      sed -i '/OsEnv: NewWhitelist/s/)\$/|GIT_EXEC_PATH|LD_LIBRARY_PATH|npm_config_(cache|init_module|userconfig)|pandoc_datadir|PYTHONHOME|RUBYLIB|SNAP&/' config/security/securityConfig.go
+      sed -i '/OsEnv: MustNewWhitelist/s/)\$/|GIT_EXEC_PATH|LD_LIBRARY_PATH|npm_config_(cache|init_module|userconfig)|pandoc_datadir|PYTHONHOME|RUBYLIB|SNAP&/' config/security/securityConfig.go
       git diff config/security/securityConfig.go
 
       HUGO_BUILD_TAGS="extended"


Test patch: