diff --git a/go b/go index 9f236fbe3f..5d5c7ff1f0 160000 --- a/go +++ b/go @@ -1 +1 @@ -Subproject commit 9f236fbe3fa00dfe1534148d84f505ddd770d3cf +Subproject commit 5d5c7ff1f012bb70d653c1a2b282ee46161b6914 diff --git a/patches/0001-Vendor-external-dependencies.patch b/patches/0001-Vendor-external-dependencies.patch index 64dce9d5f4..003eee514e 100644 --- a/patches/0001-Vendor-external-dependencies.patch +++ b/patches/0001-Vendor-external-dependencies.patch @@ -2734,7 +2734,7 @@ index 00000000000000..d4671e1584dfa8 +// This file is here just to declare cryptobackend dependencies. +// This allows tracking their versions in a single patch file. diff --git a/src/go.mod b/src/go.mod -index 31cff08cfb0658..a77e67a1a93fe2 100644 +index 5cd65aa1cd3b98..f5bfb18d430e91 100644 --- a/src/go.mod +++ b/src/go.mod @@ -3,11 +3,17 @@ module std @@ -2742,7 +2742,7 @@ index 31cff08cfb0658..a77e67a1a93fe2 100644 require ( - golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 -- golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435 +- golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb + github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f // indirect + github.com/microsoft/go-crypto-openssl v0.5.1-0.20260702080831-779d2f80165b // indirect + github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 // indirect @@ -2755,12 +2755,12 @@ index 31cff08cfb0658..a77e67a1a93fe2 100644 - golang.org/x/text v0.40.0 // indirect + github.com/microsoft/go/cryptobackend v0.0.0 + golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 -+ golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435 ++ golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb ) + +replace github.com/microsoft/go/cryptobackend => ../../cryptobackend diff --git a/src/go.sum b/src/go.sum -index 829e8fbf4b3026..4305da5bd0ebb4 100644 +index f540571ca5387d..6fcb1c79d85259 100644 --- a/src/go.sum +++ b/src/go.sum @@ -1,3 +1,9 @@ @@ -2772,7 +2772,7 @@ index 829e8fbf4b3026..4305da5bd0ebb4 100644 +github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825/go.mod h1:a1Z07CJIuWa8WT/pzFIGNTTKS96s8o1B1TPOziAHUxw= golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 h1:vGPAn+SBeT/HVkWqXTwgapJgtGQJztG0WR0OTuHzMAI= golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= - golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435 h1:F2VkyVpi+/NElkyxEdnKyWzMLTGeSpJBbLgHJKS1rJ0= + golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb h1:4Zpnuj4Vkh1c0wOa1MvxIp+I66KR18NRN08y9bN5zL0= diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go index 4959a421892996..67627cdb93ff22 100644 --- a/src/go/build/deps_test.go @@ -45251,7 +45251,7 @@ index 00000000000000..b7ffeea07c6b8d + panic("cryptobackend: not available") +} diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt -index 3592a83513f392..0490c07ab49be1 100644 +index 6a02c35f7fafa9..615c8913d5e262 100644 --- a/src/vendor/modules.txt +++ b/src/vendor/modules.txt @@ -1,3 +1,57 @@ diff --git a/patches/0002-Add-crypto-backends.patch b/patches/0002-Add-crypto-backends.patch index 27f48ec149..fded21cbb6 100644 --- a/patches/0002-Add-crypto-backends.patch +++ b/patches/0002-Add-crypto-backends.patch @@ -328,7 +328,7 @@ index 78d55bec559987..decf356a449ba9 100644 if debug { run("", ShowOutput|CheckExit, pathf("%s/compile", tooldir), "-V=full") diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go -index 43ac003c7907c7..4daeb1a5ced0eb 100644 +index da2ebaabe5c82a..e3cb79ae4b8aed 100644 --- a/src/cmd/dist/test.go +++ b/src/cmd/dist/test.go @@ -158,10 +158,12 @@ func (t *tester) run() { @@ -358,7 +358,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644 } } -@@ -731,7 +733,7 @@ func (t *tester) registerTests() { +@@ -717,7 +719,7 @@ func (t *tester) registerTests() { }) // Check that all crypto packages compile (and test correctly, in longmode) with fips. @@ -367,7 +367,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644 // Test standard crypto packages with fips140=on. t.registerTest("GOFIPS140=latest go test crypto/...", &goTest{ variant: "gofips140", -@@ -795,7 +797,9 @@ func (t *tester) registerTests() { +@@ -781,7 +783,9 @@ func (t *tester) registerTests() { } // Test ios/amd64 for the iOS simulator. @@ -378,7 +378,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644 t.registerTest("GOOS=ios on darwin/amd64", &goTest{ variant: "amd64ios", -@@ -1044,7 +1048,9 @@ func (t *tester) registerTests() { +@@ -1018,7 +1022,9 @@ func (t *tester) registerTests() { t.registerRaceTests() } @@ -389,7 +389,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644 // Only start multiple test dir shards on builders, // where they get distributed to multiple machines. // See issues 20141 and 31834. -@@ -1401,12 +1407,11 @@ func (t *tester) registerCgoTests(heading string) { +@@ -1374,12 +1380,11 @@ func (t *tester) registerCgoTests(heading string) { // a C linker warning on Linux. // in function `bio_ip_and_port_to_socket_and_addr': // warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking @@ -403,7 +403,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644 // Static linking tests if goos != "android" && p != "netbsd/arm" && !t.msan && !t.asan { // TODO(#56629): Why does this fail on netbsd-arm? -@@ -1929,3 +1934,28 @@ func goexperiments(exps ...string) string { +@@ -1902,3 +1907,28 @@ func goexperiments(exps ...string) string { return existing + strings.Join(exps, ",") } @@ -467,7 +467,7 @@ index ed0fbf3d53d75b..a2f74c8095d449 100644 func TestBoringInternalLink(t *testing.T) { tg := testgo(t) diff --git a/src/cmd/go/go_test.go b/src/cmd/go/go_test.go -index 47839e0229b951..99ac16a3951934 100644 +index 724d446833a23d..cbc491facb3491 100644 --- a/src/cmd/go/go_test.go +++ b/src/cmd/go/go_test.go @@ -14,6 +14,7 @@ import ( @@ -492,7 +492,7 @@ index 47839e0229b951..99ac16a3951934 100644 if testGOROOT := os.Getenv("TESTGO_GOROOT"); testGOROOT != "" { // Disallow installs to the GOROOT from which testgo was built. -@@ -1779,6 +1787,9 @@ func TestGenerateUsesBuildContext(t *testing.T) { +@@ -1729,6 +1737,9 @@ func TestGenerateUsesBuildContext(t *testing.T) { } func TestGoEnv(t *testing.T) { @@ -503,7 +503,7 @@ index 47839e0229b951..99ac16a3951934 100644 tg.parallel() defer tg.cleanup() diff --git a/src/cmd/go/internal/cfg/cfg.go b/src/cmd/go/internal/cfg/cfg.go -index 78cbbb949e7c27..38bf1efb8794da 100644 +index 5c34612f5d2a95..43d9fea576d302 100644 --- a/src/cmd/go/internal/cfg/cfg.go +++ b/src/cmd/go/internal/cfg/cfg.go @@ -14,11 +14,13 @@ import ( @@ -520,7 +520,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644 "strings" "sync" "time" -@@ -229,6 +231,21 @@ func ForceHost() { +@@ -234,6 +236,21 @@ func ForceHost() { BuildContext = defaultContext() // Call SetGOROOT to properly set the GOROOT on the new context. SetGOROOT(Getenv("GOROOT"), false) @@ -542,7 +542,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644 // Recompute experiments: the settings determined depend on GOOS and GOARCH. // This will also update the BuildContext's tool tags to include the new // experiment tags. -@@ -311,10 +328,23 @@ func computeExperiment() { +@@ -316,10 +333,23 @@ func computeExperiment() { // Add build tags based on the experiments in effect. exps := Experiment.Enabled() @@ -568,7 +568,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644 } diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go -index 3d72c368b088a2..4fe28740a6e3c2 100644 +index e648110e0136a8..c8e949c5e933ec 100644 --- a/src/cmd/go/internal/envcmd/env.go +++ b/src/cmd/go/internal/envcmd/env.go @@ -124,6 +124,7 @@ func MkEnv() []cfg.EnvVar { @@ -603,7 +603,7 @@ index b305457a23d104..5154aa0be0007c 100644 Additional information available from 'go env' but not read from the environment: diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go -index 2985cff67cec0b..d345585b33be9a 100644 +index 6c1e51e1a3e0a8..99fa0aa07259a9 100644 --- a/src/cmd/go/internal/load/pkg.go +++ b/src/cmd/go/internal/load/pkg.go @@ -16,6 +16,7 @@ import ( @@ -614,7 +614,7 @@ index 2985cff67cec0b..d345585b33be9a 100644 "io/fs" "os" pathpkg "path" -@@ -934,7 +935,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath, +@@ -919,7 +920,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath, } if r.dir != "" { var buildMode build.ImportMode @@ -623,7 +623,7 @@ index 2985cff67cec0b..d345585b33be9a 100644 if !cfg.ModulesEnabled { buildMode = build.ImportComment } else { -@@ -950,7 +951,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath, +@@ -935,7 +936,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath, } if modroot != "" { if rp, err := modindex.GetPackage(modroot, r.dir); err == nil { @@ -632,7 +632,7 @@ index 2985cff67cec0b..d345585b33be9a 100644 goto Happy } else if !errors.Is(err, modindex.ErrNotIndexed) { base.Fatal(err) -@@ -998,7 +999,8 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath, +@@ -983,7 +984,8 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath, // Not vendoring, or we already found the vendored path. buildMode |= build.IgnoreVendor } @@ -642,7 +642,7 @@ index 2985cff67cec0b..d345585b33be9a 100644 } data.p.ImportPath = r.path -@@ -1023,6 +1025,42 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath, +@@ -1008,6 +1010,42 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath, return p, loaded, err } @@ -685,7 +685,7 @@ index 2985cff67cec0b..d345585b33be9a 100644 // importSpec describes an import declaration in source code. It is used as a // cache key for resolvedImportCache. type importSpec struct { -@@ -1548,6 +1586,9 @@ func disallowInternal(ld *modload.Loader, ctx context.Context, srcDir string, im +@@ -1533,6 +1571,9 @@ func disallowInternal(ld *modload.Loader, ctx context.Context, srcDir string, im } goto Error } @@ -695,7 +695,7 @@ index 2985cff67cec0b..d345585b33be9a 100644 if p.Module == nil { parent := p.Dir[:i+len(p.Dir)-len(p.ImportPath)] -@@ -2458,6 +2499,9 @@ func (p *Package) setBuildInfo(ctx context.Context, f *modfetch.Fetcher, autoVCS +@@ -2447,6 +2488,9 @@ func (p *Package) setBuildInfo(ctx context.Context, f *modfetch.Fetcher, autoVCS buildmode = "archive" } } @@ -706,10 +706,10 @@ index 2985cff67cec0b..d345585b33be9a 100644 appendSetting("-compiler", cfg.BuildContext.Compiler) if gccgoflags := BuildGccgoflags.String(); gccgoflags != "" && cfg.BuildContext.Compiler == "gccgo" { diff --git a/src/cmd/go/internal/tool/tool.go b/src/cmd/go/internal/tool/tool.go -index 97c27c8caa44d6..bb18bb112a314a 100644 +index afc50d9b2d9177..cfa89ae75621ef 100644 --- a/src/cmd/go/internal/tool/tool.go +++ b/src/cmd/go/internal/tool/tool.go -@@ -335,6 +335,10 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t +@@ -336,6 +336,10 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t // Override GOOS and GOARCH for the build to build the tool using // the same GOOS and GOARCH as this go command. cfg.ForceHost() @@ -720,7 +720,7 @@ index 97c27c8caa44d6..bb18bb112a314a 100644 // Ignore go.mod and go.work: we don't need them, and we want to be able // to run the tool even if there's an issue with the module or workspace the -@@ -342,8 +346,11 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t +@@ -343,8 +347,11 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t ld.RootMode = modload.NoRoot runFunc := func(b *work.Builder, ctx context.Context, a *work.Action) error { @@ -734,7 +734,7 @@ index 97c27c8caa44d6..bb18bb112a314a 100644 buildAndRunTool(ld, ctx, tool, args, runFunc) diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go -index 6033ec420b8452..a8374234a3f0a5 100644 +index e9b386ec660cd0..7166e102d837ae 100644 --- a/src/cmd/go/script_test.go +++ b/src/cmd/go/script_test.go @@ -300,6 +300,9 @@ var extraEnvKeys = []string{ @@ -1239,7 +1239,7 @@ index acbebf28598a9c..6ef32735ddfd57 100644 *mode = BuildModePIE default: diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go -index 9cbc12919f1d00..e64a9c5299e95a 100644 +index b7ff79c0958bab..c86ccff3e325b2 100644 --- a/src/cmd/link/internal/ld/lib.go +++ b/src/cmd/link/internal/ld/lib.go @@ -1177,6 +1177,12 @@ var hostobj []Hostobj @@ -2898,7 +2898,7 @@ index a4c9fc977bc136..116106bd0a4cfb 100644 // MustMinimumFIPS140ModuleVersion skips the test if compiled against a lower diff --git a/src/crypto/internal/cryptotest/hash.go b/src/crypto/internal/cryptotest/hash.go -index 37fd96a2d9d0b9..6d4b190831d57d 100644 +index 3e2efa84db720c..4e631a32de56da 100644 --- a/src/crypto/internal/cryptotest/hash.go +++ b/src/crypto/internal/cryptotest/hash.go @@ -5,7 +5,6 @@ @@ -2909,10 +2909,10 @@ index 37fd96a2d9d0b9..6d4b190831d57d 100644 "crypto/internal/fips140" "hash" "internal/testhash" -@@ -20,7 +19,7 @@ type MakeHash func() hash.Hash - // TestHash performs a set of tests on hash.Hash implementations, checking the - // documented requirements of Write, Sum, Reset, Size, and BlockSize. - func TestHash(t *testing.T, mh MakeHash) { +@@ -34,7 +33,7 @@ func TestHash(t *testing.T, mh MakeHash) { + h.Sum(end[:0]) + }) + - if boring.Enabled || fips140.Version() == "v1.0.0" { + if fips140.Version() == "v1.0.0" { testhash.TestHashWithoutClone(t, testhash.MakeHash(mh)) @@ -3254,7 +3254,7 @@ index 403ff2881f4b68..9cf1efbbeed819 100644 func maybeCloner(h hash.Hash) any { diff --git a/src/crypto/mldsa/mldsa_fips140v1.26.go b/src/crypto/mldsa/mldsa_fips140v1.26.go -index 2c36fe191e9149..24308c7391ee67 100644 +index d3ee1f0daec096..c37363dd9d2662 100644 --- a/src/crypto/mldsa/mldsa_fips140v1.26.go +++ b/src/crypto/mldsa/mldsa_fips140v1.26.go @@ -9,8 +9,13 @@ package mldsa @@ -3423,8 +3423,8 @@ index 2c36fe191e9149..24308c7391ee67 100644 var errInvalidSignerOpts = errors.New("mldsa: invalid SignerOpts") // Sign returns a signature of the given message using this private key. -@@ -112,9 +227,21 @@ func (sk *PrivateKey) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts) - if opts, ok := opts.(*Options); ok { +@@ -115,9 +230,21 @@ func (sk *PrivateKey) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts) + if opts, ok := opts.(*Options); ok && opts != nil { context = opts.Context } + if sk.boring != nil { @@ -3446,7 +3446,7 @@ index 2c36fe191e9149..24308c7391ee67 100644 default: return nil, errInvalidSignerOpts } -@@ -126,15 +253,21 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts) +@@ -132,15 +259,21 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts) if opts == nil { opts = &Options{} } @@ -3459,7 +3459,7 @@ index 2c36fe191e9149..24308c7391ee67 100644 switch opts.HashFunc() { case 0: var context string - if opts, ok := opts.(*Options); ok { + if opts, ok := opts.(*Options); ok && opts != nil { context = opts.Context } - return mldsa.SignDeterministic(&sk.k, message, context) @@ -3470,7 +3470,7 @@ index 2c36fe191e9149..24308c7391ee67 100644 default: return nil, errInvalidSignerOpts } -@@ -146,6 +279,12 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts) +@@ -152,6 +285,12 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts) // A PublicKey is safe for concurrent use. type PublicKey struct { p mldsa.PublicKey @@ -3483,7 +3483,7 @@ index 2c36fe191e9149..24308c7391ee67 100644 } // NewPublicKey creates a new ML-DSA public key from the given encoding. -@@ -154,6 +293,14 @@ func NewPublicKey(params Parameters, encoding []byte) (*PublicKey, error) { +@@ -160,6 +299,14 @@ func NewPublicKey(params Parameters, encoding []byte) (*PublicKey, error) { } func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKey, error) { @@ -3498,7 +3498,7 @@ index 2c36fe191e9149..24308c7391ee67 100644 var err error var pk *mldsa.PublicKey switch params { -@@ -175,6 +322,9 @@ func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKe +@@ -181,6 +328,9 @@ func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKe // Bytes returns the public key encoding. func (pk *PublicKey) Bytes() []byte { @@ -3508,7 +3508,7 @@ index 2c36fe191e9149..24308c7391ee67 100644 return pk.p.Bytes() } -@@ -187,11 +337,29 @@ func (pk *PublicKey) Equal(x crypto.PublicKey) bool { +@@ -193,11 +343,29 @@ func (pk *PublicKey) Equal(x crypto.PublicKey) bool { if !ok || other == nil { return false } @@ -3538,7 +3538,7 @@ index 2c36fe191e9149..24308c7391ee67 100644 switch pk.p.Parameters() { case "ML-DSA-44": return MLDSA44() -@@ -213,5 +381,8 @@ func Verify(pk *PublicKey, message []byte, signature []byte, opts *Options) erro +@@ -222,5 +390,8 @@ func Verify(pk *PublicKey, message []byte, signature []byte, opts *Options) erro if opts == nil { opts = &Options{} } @@ -3548,7 +3548,7 @@ index 2c36fe191e9149..24308c7391ee67 100644 return mldsa.Verify(&pk.p, message, signature, opts.Context) } diff --git a/src/crypto/mldsa/mldsa_test.go b/src/crypto/mldsa/mldsa_test.go -index 375333a70cf686..c319bfe3d98f42 100644 +index 0a2fc4edf11183..9c27ff51b27a4f 100644 --- a/src/crypto/mldsa/mldsa_test.go +++ b/src/crypto/mldsa/mldsa_test.go @@ -18,6 +18,9 @@ import ( @@ -4892,7 +4892,7 @@ index 46e47df1d32cf2..48e9bd510cf92e 100644 d.Reset() d.Write(data) diff --git a/src/crypto/sha1/sha1_test.go b/src/crypto/sha1/sha1_test.go -index ef6e5ddcbb2d97..b1af8757599a9d 100644 +index 8b4618df556271..ae4abc9edfa7c1 100644 --- a/src/crypto/sha1/sha1_test.go +++ b/src/crypto/sha1/sha1_test.go @@ -8,10 +8,11 @@ package sha1 diff --git a/patches/0007-Add-appinsights-telemetry.patch b/patches/0007-Add-appinsights-telemetry.patch index 89a3bd1059..f1f40d9948 100644 --- a/patches/0007-Add-appinsights-telemetry.patch +++ b/patches/0007-Add-appinsights-telemetry.patch @@ -192,7 +192,7 @@ index 00000000000000..010270fb6ad4cf + return appInsightsRequests.Load() +} diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go -index c66d0179529637..38beab83d06401 100644 +index 82f2569817ad04..425c7442e201b4 100644 --- a/src/cmd/go/script_test.go +++ b/src/cmd/go/script_test.go @@ -62,6 +62,7 @@ func TestScript(t *testing.T) { @@ -214,7 +214,7 @@ index c66d0179529637..38beab83d06401 100644 "newline=\n", } -@@ -412,6 +417,11 @@ func checkCounters(t *testing.T, telemetryDir string) { +@@ -412,4 +417,9 @@ func checkCounters(t *testing.T, telemetryDir string) { t.Fatal("go was invoked but no counters were incremented") } } @@ -224,8 +224,6 @@ index c66d0179529637..38beab83d06401 100644 + } + } } - - // Copied from https://go.googlesource.com/telemetry/+/5f08a0cbff3f/internal/telemetry/mode.go#122 diff --git a/src/cmd/go/scriptcmds_test.go b/src/cmd/go/scriptcmds_test.go index 8195e830caa31b..882aeecfa562b9 100644 --- a/src/cmd/go/scriptcmds_test.go