This is probably not relevant, but I’d like to cross if off the list…
In the past we had some trouble with private repositories if Hugo didn’t have access to certain environment variables, but that was fixed with 6c9ea02.
Let’s check your config:
Please type this and paste the output: hugo config | grep security.exec -A2
You can allow Hugo to access all environment variables by placing this in your site config:
That actually did the trick! I added the following to my yaml file
security:
exec:
osenv: '.*'
Just like that, hugo mod get works.
So, because you said “probably not relevant”, is there some way I can provide you with debug information if you think this is a bug in the codebase? Even if my hugo file can only be edited by me, I’d still rather not have that security exception in my config.
I’m running hugo v0.149.0-66240338f1b908ca3b163384c8229943e74eb290+extended windows/amd64 BuildDate=2025-08-27T15:37:16Z VendorInfo=gohugoio.
import os
import subprocess
import shutil
from sys import argv
cfg_name = argv[1]
git_url = argv[2]
def try_var(name):
shutil.copy(cfg_name, f"{cfg_name}.bak")
try:
with open(cfg_name) as f:
cfg = f.read()
cfg = cfg.replace("REPLACEME", name)
with open(cfg_name, "w") as f:
f.write(cfg)
run = subprocess.run(
["hugo", "mod", "get", git_url],
capture_output=True,
text=True
)
return run.returncode == 0
finally:
shutil.move(f"{cfg_name}.bak", cfg_name)
if __name__ == "__main__":
vars = list(os.environ.keys())
for v in vars:
print(f"Trying {v}")
if try_var(v):
print(f"\n{v} works!")
exit()
print("Nothing worked :(")
Depending on your OS, you might need to change “hugo” to “hugo.exe” or change it to an absolute path.
Run it with python script.py <hugo config file name> <git url of private repo>
For example: python script.py config.yaml git.myserver.tld/myuser/myrepo.git