Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go
Submodule go updated 176 files
12 changes: 6 additions & 6 deletions patches/0001-Vendor-external-dependencies.patch
Original file line number Diff line number Diff line change
Expand Up @@ -2734,15 +2734,15 @@ index 00000000000000..d4671e1584dfa8
+// This file is here just to declare cryptobackend dependencies.
+// This allows tracking their versions in a single patch file.
diff --git a/src/go.mod b/src/go.mod
index 31cff08cfb0658..a77e67a1a93fe2 100644
index 5cd65aa1cd3b98..f5bfb18d430e91 100644
--- a/src/go.mod
+++ b/src/go.mod
@@ -3,11 +3,17 @@ module std
go 1.28

require (
- golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1
- golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435
- golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb
+ github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f // indirect
+ github.com/microsoft/go-crypto-openssl v0.5.1-0.20260702080831-779d2f80165b // indirect
+ github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 // indirect
Expand All @@ -2755,12 +2755,12 @@ index 31cff08cfb0658..a77e67a1a93fe2 100644
- golang.org/x/text v0.40.0 // indirect
+ github.com/microsoft/go/cryptobackend v0.0.0
+ golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1
+ golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435
+ golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb
)
+
+replace github.com/microsoft/go/cryptobackend => ../../cryptobackend
diff --git a/src/go.sum b/src/go.sum
index 829e8fbf4b3026..4305da5bd0ebb4 100644
index f540571ca5387d..6fcb1c79d85259 100644
--- a/src/go.sum
+++ b/src/go.sum
@@ -1,3 +1,9 @@
Expand All @@ -2772,7 +2772,7 @@ index 829e8fbf4b3026..4305da5bd0ebb4 100644
+github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825/go.mod h1:a1Z07CJIuWa8WT/pzFIGNTTKS96s8o1B1TPOziAHUxw=
golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 h1:vGPAn+SBeT/HVkWqXTwgapJgtGQJztG0WR0OTuHzMAI=
golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/net v0.57.1-0.20260714001123-e7e2eb826435 h1:F2VkyVpi+/NElkyxEdnKyWzMLTGeSpJBbLgHJKS1rJ0=
golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb h1:4Zpnuj4Vkh1c0wOa1MvxIp+I66KR18NRN08y9bN5zL0=
diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
index 4959a421892996..67627cdb93ff22 100644
--- a/src/go/build/deps_test.go
Expand Down Expand Up @@ -45251,7 +45251,7 @@ index 00000000000000..b7ffeea07c6b8d
+ panic("cryptobackend: not available")
+}
diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
index 3592a83513f392..0490c07ab49be1 100644
index 6a02c35f7fafa9..615c8913d5e262 100644
--- a/src/vendor/modules.txt
+++ b/src/vendor/modules.txt
@@ -1,3 +1,57 @@
Expand Down
82 changes: 41 additions & 41 deletions patches/0002-Add-crypto-backends.patch
Original file line number Diff line number Diff line change
Expand Up @@ -328,7 +328,7 @@ index 78d55bec559987..decf356a449ba9 100644
if debug {
run("", ShowOutput|CheckExit, pathf("%s/compile", tooldir), "-V=full")
diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
index 43ac003c7907c7..4daeb1a5ced0eb 100644
index da2ebaabe5c82a..e3cb79ae4b8aed 100644
--- a/src/cmd/dist/test.go
+++ b/src/cmd/dist/test.go
@@ -158,10 +158,12 @@ func (t *tester) run() {
Expand Down Expand Up @@ -358,7 +358,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
}
}

@@ -731,7 +733,7 @@ func (t *tester) registerTests() {
@@ -717,7 +719,7 @@ func (t *tester) registerTests() {
})

// Check that all crypto packages compile (and test correctly, in longmode) with fips.
Expand All @@ -367,7 +367,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
// Test standard crypto packages with fips140=on.
t.registerTest("GOFIPS140=latest go test crypto/...", &goTest{
variant: "gofips140",
@@ -795,7 +797,9 @@ func (t *tester) registerTests() {
@@ -781,7 +783,9 @@ func (t *tester) registerTests() {
}

// Test ios/amd64 for the iOS simulator.
Expand All @@ -378,7 +378,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
t.registerTest("GOOS=ios on darwin/amd64",
&goTest{
variant: "amd64ios",
@@ -1044,7 +1048,9 @@ func (t *tester) registerTests() {
@@ -1018,7 +1022,9 @@ func (t *tester) registerTests() {
t.registerRaceTests()
}

Expand All @@ -389,7 +389,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
// Only start multiple test dir shards on builders,
// where they get distributed to multiple machines.
// See issues 20141 and 31834.
@@ -1401,12 +1407,11 @@ func (t *tester) registerCgoTests(heading string) {
@@ -1374,12 +1380,11 @@ func (t *tester) registerCgoTests(heading string) {
// a C linker warning on Linux.
// in function `bio_ip_and_port_to_socket_and_addr':
// warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
Expand All @@ -403,7 +403,7 @@ index 43ac003c7907c7..4daeb1a5ced0eb 100644
// Static linking tests
if goos != "android" && p != "netbsd/arm" && !t.msan && !t.asan {
// TODO(#56629): Why does this fail on netbsd-arm?
@@ -1929,3 +1934,28 @@ func goexperiments(exps ...string) string {
@@ -1902,3 +1907,28 @@ func goexperiments(exps ...string) string {
return existing + strings.Join(exps, ",")

}
Expand Down Expand Up @@ -467,7 +467,7 @@ index ed0fbf3d53d75b..a2f74c8095d449 100644
func TestBoringInternalLink(t *testing.T) {
tg := testgo(t)
diff --git a/src/cmd/go/go_test.go b/src/cmd/go/go_test.go
index 47839e0229b951..99ac16a3951934 100644
index 724d446833a23d..cbc491facb3491 100644
--- a/src/cmd/go/go_test.go
+++ b/src/cmd/go/go_test.go
@@ -14,6 +14,7 @@ import (
Expand All @@ -492,7 +492,7 @@ index 47839e0229b951..99ac16a3951934 100644

if testGOROOT := os.Getenv("TESTGO_GOROOT"); testGOROOT != "" {
// Disallow installs to the GOROOT from which testgo was built.
@@ -1779,6 +1787,9 @@ func TestGenerateUsesBuildContext(t *testing.T) {
@@ -1729,6 +1737,9 @@ func TestGenerateUsesBuildContext(t *testing.T) {
}

func TestGoEnv(t *testing.T) {
Expand All @@ -503,7 +503,7 @@ index 47839e0229b951..99ac16a3951934 100644
tg.parallel()
defer tg.cleanup()
diff --git a/src/cmd/go/internal/cfg/cfg.go b/src/cmd/go/internal/cfg/cfg.go
index 78cbbb949e7c27..38bf1efb8794da 100644
index 5c34612f5d2a95..43d9fea576d302 100644
--- a/src/cmd/go/internal/cfg/cfg.go
+++ b/src/cmd/go/internal/cfg/cfg.go
@@ -14,11 +14,13 @@ import (
Expand All @@ -520,7 +520,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644
"strings"
"sync"
"time"
@@ -229,6 +231,21 @@ func ForceHost() {
@@ -234,6 +236,21 @@ func ForceHost() {
BuildContext = defaultContext()
// Call SetGOROOT to properly set the GOROOT on the new context.
SetGOROOT(Getenv("GOROOT"), false)
Expand All @@ -542,7 +542,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644
// Recompute experiments: the settings determined depend on GOOS and GOARCH.
// This will also update the BuildContext's tool tags to include the new
// experiment tags.
@@ -311,10 +328,23 @@ func computeExperiment() {
@@ -316,10 +333,23 @@ func computeExperiment() {

// Add build tags based on the experiments in effect.
exps := Experiment.Enabled()
Expand All @@ -568,7 +568,7 @@ index 78cbbb949e7c27..38bf1efb8794da 100644
}

diff --git a/src/cmd/go/internal/envcmd/env.go b/src/cmd/go/internal/envcmd/env.go
index 3d72c368b088a2..4fe28740a6e3c2 100644
index e648110e0136a8..c8e949c5e933ec 100644
--- a/src/cmd/go/internal/envcmd/env.go
+++ b/src/cmd/go/internal/envcmd/env.go
@@ -124,6 +124,7 @@ func MkEnv() []cfg.EnvVar {
Expand Down Expand Up @@ -603,7 +603,7 @@ index b305457a23d104..5154aa0be0007c 100644
Additional information available from 'go env' but not read from the environment:

diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
index 2985cff67cec0b..d345585b33be9a 100644
index 6c1e51e1a3e0a8..99fa0aa07259a9 100644
--- a/src/cmd/go/internal/load/pkg.go
+++ b/src/cmd/go/internal/load/pkg.go
@@ -16,6 +16,7 @@ import (
Expand All @@ -614,7 +614,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
"io/fs"
"os"
pathpkg "path"
@@ -934,7 +935,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
@@ -919,7 +920,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
}
if r.dir != "" {
var buildMode build.ImportMode
Expand All @@ -623,7 +623,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
if !cfg.ModulesEnabled {
buildMode = build.ImportComment
} else {
@@ -950,7 +951,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
@@ -935,7 +936,7 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
}
if modroot != "" {
if rp, err := modindex.GetPackage(modroot, r.dir); err == nil {
Expand All @@ -632,7 +632,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
goto Happy
} else if !errors.Is(err, modindex.ErrNotIndexed) {
base.Fatal(err)
@@ -998,7 +999,8 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
@@ -983,7 +984,8 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
// Not vendoring, or we already found the vendored path.
buildMode |= build.IgnoreVendor
}
Expand All @@ -642,7 +642,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
}
data.p.ImportPath = r.path

@@ -1023,6 +1025,42 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
@@ -1008,6 +1010,42 @@ func loadPackageData(ld *modload.Loader, ctx context.Context, path, parentPath,
return p, loaded, err
}

Expand Down Expand Up @@ -685,7 +685,7 @@ index 2985cff67cec0b..d345585b33be9a 100644
// importSpec describes an import declaration in source code. It is used as a
// cache key for resolvedImportCache.
type importSpec struct {
@@ -1548,6 +1586,9 @@ func disallowInternal(ld *modload.Loader, ctx context.Context, srcDir string, im
@@ -1533,6 +1571,9 @@ func disallowInternal(ld *modload.Loader, ctx context.Context, srcDir string, im
}
goto Error
}
Expand All @@ -695,7 +695,7 @@ index 2985cff67cec0b..d345585b33be9a 100644

if p.Module == nil {
parent := p.Dir[:i+len(p.Dir)-len(p.ImportPath)]
@@ -2458,6 +2499,9 @@ func (p *Package) setBuildInfo(ctx context.Context, f *modfetch.Fetcher, autoVCS
@@ -2447,6 +2488,9 @@ func (p *Package) setBuildInfo(ctx context.Context, f *modfetch.Fetcher, autoVCS
buildmode = "archive"
}
}
Expand All @@ -706,10 +706,10 @@ index 2985cff67cec0b..d345585b33be9a 100644
appendSetting("-compiler", cfg.BuildContext.Compiler)
if gccgoflags := BuildGccgoflags.String(); gccgoflags != "" && cfg.BuildContext.Compiler == "gccgo" {
diff --git a/src/cmd/go/internal/tool/tool.go b/src/cmd/go/internal/tool/tool.go
index 97c27c8caa44d6..bb18bb112a314a 100644
index afc50d9b2d9177..cfa89ae75621ef 100644
--- a/src/cmd/go/internal/tool/tool.go
+++ b/src/cmd/go/internal/tool/tool.go
@@ -335,6 +335,10 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
@@ -336,6 +336,10 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
// Override GOOS and GOARCH for the build to build the tool using
// the same GOOS and GOARCH as this go command.
cfg.ForceHost()
Expand All @@ -720,7 +720,7 @@ index 97c27c8caa44d6..bb18bb112a314a 100644

// Ignore go.mod and go.work: we don't need them, and we want to be able
// to run the tool even if there's an issue with the module or workspace the
@@ -342,8 +346,11 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
@@ -343,8 +347,11 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
ld.RootMode = modload.NoRoot

runFunc := func(b *work.Builder, ctx context.Context, a *work.Action) error {
Expand All @@ -734,7 +734,7 @@ index 97c27c8caa44d6..bb18bb112a314a 100644

buildAndRunTool(ld, ctx, tool, args, runFunc)
diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go
index 6033ec420b8452..a8374234a3f0a5 100644
index e9b386ec660cd0..7166e102d837ae 100644
--- a/src/cmd/go/script_test.go
+++ b/src/cmd/go/script_test.go
@@ -300,6 +300,9 @@ var extraEnvKeys = []string{
Expand Down Expand Up @@ -1239,7 +1239,7 @@ index acbebf28598a9c..6ef32735ddfd57 100644
*mode = BuildModePIE
default:
diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
index 9cbc12919f1d00..e64a9c5299e95a 100644
index b7ff79c0958bab..c86ccff3e325b2 100644
--- a/src/cmd/link/internal/ld/lib.go
+++ b/src/cmd/link/internal/ld/lib.go
@@ -1177,6 +1177,12 @@ var hostobj []Hostobj
Expand Down Expand Up @@ -2898,7 +2898,7 @@ index a4c9fc977bc136..116106bd0a4cfb 100644

// MustMinimumFIPS140ModuleVersion skips the test if compiled against a lower
diff --git a/src/crypto/internal/cryptotest/hash.go b/src/crypto/internal/cryptotest/hash.go
index 37fd96a2d9d0b9..6d4b190831d57d 100644
index 3e2efa84db720c..4e631a32de56da 100644
--- a/src/crypto/internal/cryptotest/hash.go
+++ b/src/crypto/internal/cryptotest/hash.go
@@ -5,7 +5,6 @@
Expand All @@ -2909,10 +2909,10 @@ index 37fd96a2d9d0b9..6d4b190831d57d 100644
"crypto/internal/fips140"
"hash"
"internal/testhash"
@@ -20,7 +19,7 @@ type MakeHash func() hash.Hash
// TestHash performs a set of tests on hash.Hash implementations, checking the
// documented requirements of Write, Sum, Reset, Size, and BlockSize.
func TestHash(t *testing.T, mh MakeHash) {
@@ -34,7 +33,7 @@ func TestHash(t *testing.T, mh MakeHash) {
h.Sum(end[:0])
})

- if boring.Enabled || fips140.Version() == "v1.0.0" {
+ if fips140.Version() == "v1.0.0" {
testhash.TestHashWithoutClone(t, testhash.MakeHash(mh))
Expand Down Expand Up @@ -3254,7 +3254,7 @@ index 403ff2881f4b68..9cf1efbbeed819 100644

func maybeCloner(h hash.Hash) any {
diff --git a/src/crypto/mldsa/mldsa_fips140v1.26.go b/src/crypto/mldsa/mldsa_fips140v1.26.go
index 2c36fe191e9149..24308c7391ee67 100644
index d3ee1f0daec096..c37363dd9d2662 100644
--- a/src/crypto/mldsa/mldsa_fips140v1.26.go
+++ b/src/crypto/mldsa/mldsa_fips140v1.26.go
@@ -9,8 +9,13 @@ package mldsa
Expand Down Expand Up @@ -3423,8 +3423,8 @@ index 2c36fe191e9149..24308c7391ee67 100644
var errInvalidSignerOpts = errors.New("mldsa: invalid SignerOpts")

// Sign returns a signature of the given message using this private key.
@@ -112,9 +227,21 @@ func (sk *PrivateKey) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts)
if opts, ok := opts.(*Options); ok {
@@ -115,9 +230,21 @@ func (sk *PrivateKey) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts)
if opts, ok := opts.(*Options); ok && opts != nil {
context = opts.Context
}
+ if sk.boring != nil {
Expand All @@ -3446,7 +3446,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
default:
return nil, errInvalidSignerOpts
}
@@ -126,15 +253,21 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts)
@@ -132,15 +259,21 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts)
if opts == nil {
opts = &Options{}
}
Expand All @@ -3459,7 +3459,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
switch opts.HashFunc() {
case 0:
var context string
if opts, ok := opts.(*Options); ok {
if opts, ok := opts.(*Options); ok && opts != nil {
context = opts.Context
}
- return mldsa.SignDeterministic(&sk.k, message, context)
Expand All @@ -3470,7 +3470,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
default:
return nil, errInvalidSignerOpts
}
@@ -146,6 +279,12 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts)
@@ -152,6 +285,12 @@ func (sk *PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts)
// A PublicKey is safe for concurrent use.
type PublicKey struct {
p mldsa.PublicKey
Expand All @@ -3483,7 +3483,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
}

// NewPublicKey creates a new ML-DSA public key from the given encoding.
@@ -154,6 +293,14 @@ func NewPublicKey(params Parameters, encoding []byte) (*PublicKey, error) {
@@ -160,6 +299,14 @@ func NewPublicKey(params Parameters, encoding []byte) (*PublicKey, error) {
}

func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKey, error) {
Expand All @@ -3498,7 +3498,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
var err error
var pk *mldsa.PublicKey
switch params {
@@ -175,6 +322,9 @@ func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKe
@@ -181,6 +328,9 @@ func newPublicKey(pub *PublicKey, params Parameters, encoding []byte) (*PublicKe

// Bytes returns the public key encoding.
func (pk *PublicKey) Bytes() []byte {
Expand All @@ -3508,7 +3508,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
return pk.p.Bytes()
}

@@ -187,11 +337,29 @@ func (pk *PublicKey) Equal(x crypto.PublicKey) bool {
@@ -193,11 +343,29 @@ func (pk *PublicKey) Equal(x crypto.PublicKey) bool {
if !ok || other == nil {
return false
}
Expand Down Expand Up @@ -3538,7 +3538,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
switch pk.p.Parameters() {
case "ML-DSA-44":
return MLDSA44()
@@ -213,5 +381,8 @@ func Verify(pk *PublicKey, message []byte, signature []byte, opts *Options) erro
@@ -222,5 +390,8 @@ func Verify(pk *PublicKey, message []byte, signature []byte, opts *Options) erro
if opts == nil {
opts = &Options{}
}
Expand All @@ -3548,7 +3548,7 @@ index 2c36fe191e9149..24308c7391ee67 100644
return mldsa.Verify(&pk.p, message, signature, opts.Context)
}
diff --git a/src/crypto/mldsa/mldsa_test.go b/src/crypto/mldsa/mldsa_test.go
index 375333a70cf686..c319bfe3d98f42 100644
index 0a2fc4edf11183..9c27ff51b27a4f 100644
--- a/src/crypto/mldsa/mldsa_test.go
+++ b/src/crypto/mldsa/mldsa_test.go
@@ -18,6 +18,9 @@ import (
Expand Down Expand Up @@ -4892,7 +4892,7 @@ index 46e47df1d32cf2..48e9bd510cf92e 100644
d.Reset()
d.Write(data)
diff --git a/src/crypto/sha1/sha1_test.go b/src/crypto/sha1/sha1_test.go
index ef6e5ddcbb2d97..b1af8757599a9d 100644
index 8b4618df556271..ae4abc9edfa7c1 100644
--- a/src/crypto/sha1/sha1_test.go
+++ b/src/crypto/sha1/sha1_test.go
@@ -8,10 +8,11 @@ package sha1
Expand Down
Loading
Loading