From 44da27fc74b8f027679a47248bff645904eb7eae Mon Sep 17 00:00:00 2001 From: George Adams Date: Thu, 23 Jul 2026 09:44:11 +0100 Subject: [PATCH 1/2] write go 1.27 release notes --- docs/go1.27.md | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/docs/go1.27.md b/docs/go1.27.md index 03f2881c71c..f9a350372c8 100644 --- a/docs/go1.27.md +++ b/docs/go1.27.md @@ -1,3 +1,48 @@ # Microsoft build of Go 1.27 release notes After the release of 1.27, 1.25 is no longer supported, per the [Go release policy](https://go.dev/doc/devel/release). + +## Systemcrypto + +See the [FIPS documentation Go 1.27 changelog](https://github.com/microsoft/go/blob/microsoft/main/eng/doc/fips/README.md#go-127-aug-2026) for more information. + +### Configuration + +`systemcrypto` is no longer a `GOEXPERIMENT` setting. +It is enabled automatically on supported platforms and no longer appears in `go env GOEXPERIMENT`, `goexperiment.Flags`, or other GOEXPERIMENT-derived output. +`GOEXPERIMENT=systemcrypto` and `GOEXPERIMENT=nosystemcrypto` have been removed and are now rejected with an error. +To disable `systemcrypto`, set the environment variable `MS_GO_NOSYSTEMCRYPTO` to `1`. +The `goexperiment.systemcrypto` build tag is still emitted when `systemcrypto` is enabled, and its behavior has not changed. + +The per-platform GOEXPERIMENTs `opensslcrypto`, `cngcrypto`, and `darwincrypto` have been removed. +Using any of them results in a build error. +The build tags associated with the removed GOEXPERIMENTs remain supported for legacy source compatibility. + +### FIPS 140 + +`GODEBUG=fips140=only` has been added. +It acts as `fips140=on`, but also panics if a non-FIPS-approved algorithm is used. + +`GODEBUG=fips140=off` now explicitly disables FIPS mode and skips the platform-specific FIPS detection (such as the Linux kernel FIPS flag at `/proc/sys/crypto/fips_enabled`). + +The `GOFIPS` environment variable check now matches its intended behavior: only `GOFIPS=1` enables FIPS mode, and any other value (including `0` and the empty string) is treated as if `GOFIPS` were unset. +The same applies to `GOLANG_FIPS`. + +### Backends + +#### OpenSSL + +On Linux, `systemcrypto` now supports `CGO_ENABLED=0` on supported cgo-less OpenSSL architectures by default. +The Go 1.26 `GOEXPERIMENT=ms_nocgo_opensslcrypto` experiment has been removed because this behavior is now part of the default `systemcrypto` backend selection. + +#### FreeBSD + +`systemcrypto` is now supported on FreeBSD (`amd64` and `arm64`), using the same OpenSSL backend as on Linux. + +### Supported Algorithms + +The following ML-DSA parameter sets are now implemented using the systemcrypto backends: + +- ML-DSA-44 +- ML-DSA-65 +- ML-DSA-87 From bc9e7eaebed7446dba2c4b593a1901da264fcc61 Mon Sep 17 00:00:00 2001 From: Davis Goodin Date: Thu, 23 Jul 2026 16:04:49 -0700 Subject: [PATCH 2/2] Adjust 1.27 release notes for readability --- docs/go1.27.md | 51 ++++++++++++++++++++++++-------------------------- 1 file changed, 24 insertions(+), 27 deletions(-) diff --git a/docs/go1.27.md b/docs/go1.27.md index f9a350372c8..db0d650c03c 100644 --- a/docs/go1.27.md +++ b/docs/go1.27.md @@ -4,45 +4,42 @@ After the release of 1.27, 1.25 is no longer supported, per the [Go release poli ## Systemcrypto -See the [FIPS documentation Go 1.27 changelog](https://github.com/microsoft/go/blob/microsoft/main/eng/doc/fips/README.md#go-127-aug-2026) for more information. +See the [Go 1.27 changelog in the FIPS documentation](https://github.com/microsoft/go/blob/microsoft/main/eng/doc/fips/README.md#go-127-aug-2026) for more information. -### Configuration +### Systemcrypto is no longer a GOEXPERIMENT setting -`systemcrypto` is no longer a `GOEXPERIMENT` setting. -It is enabled automatically on supported platforms and no longer appears in `go env GOEXPERIMENT`, `goexperiment.Flags`, or other GOEXPERIMENT-derived output. -`GOEXPERIMENT=systemcrypto` and `GOEXPERIMENT=nosystemcrypto` have been removed and are now rejected with an error. -To disable `systemcrypto`, set the environment variable `MS_GO_NOSYSTEMCRYPTO` to `1`. -The `goexperiment.systemcrypto` build tag is still emitted when `systemcrypto` is enabled, and its behavior has not changed. +`systemcrypto` is still enabled by default on supported platforms, as it has been since Go 1.25 (Linux and Windows) and Go 1.26 (macOS). +What's new in 1.27 is that it is now selected automatically by the toolchain instead of being configured through `GOEXPERIMENT`: -The per-platform GOEXPERIMENTs `opensslcrypto`, `cngcrypto`, and `darwincrypto` have been removed. -Using any of them results in a build error. -The build tags associated with the removed GOEXPERIMENTs remain supported for legacy source compatibility. +- Setting the environment variable `GOEXPERIMENT` to `systemcrypto` or `nosystemcrypto` is now rejected with an error. + To disable `systemcrypto`, set the environment variable `MS_GO_NOSYSTEMCRYPTO` to `1` instead. +- `systemcrypto` no longer appears in `go env GOEXPERIMENT`, `goexperiment.Flags`, or other GOEXPERIMENT-derived output. -### FIPS 140 +The per-platform GOEXPERIMENTs `opensslcrypto`, `cngcrypto`, and `darwincrypto` have also been removed and now cause a build error. -`GODEBUG=fips140=only` has been added. -It acts as `fips140=on`, but also panics if a non-FIPS-approved algorithm is used. +The `goexperiment.systemcrypto` build tag is still emitted when `systemcrypto` is enabled. +That tag, and the build tags for the removed per-platform experiments, remain supported for source compatibility, with no change in behavior. -`GODEBUG=fips140=off` now explicitly disables FIPS mode and skips the platform-specific FIPS detection (such as the Linux kernel FIPS flag at `/proc/sys/crypto/fips_enabled`). +### New platform and backend support -The `GOFIPS` environment variable check now matches its intended behavior: only `GOFIPS=1` enables FIPS mode, and any other value (including `0` and the empty string) is treated as if `GOFIPS` were unset. -The same applies to `GOLANG_FIPS`. +`systemcrypto` is now supported on FreeBSD (`amd64` and `arm64`), using the same OpenSSL backend as on Linux. -### Backends +On Linux, `systemcrypto` now supports `CGO_ENABLED=0` on architectures that have a cgo-less OpenSSL implementation. +This replaces the Go 1.26 `GOEXPERIMENT=ms_nocgo_opensslcrypto` experiment, which has been removed. -#### OpenSSL +### New algorithms -On Linux, `systemcrypto` now supports `CGO_ENABLED=0` on supported cgo-less OpenSSL architectures by default. -The Go 1.26 `GOEXPERIMENT=ms_nocgo_opensslcrypto` experiment has been removed because this behavior is now part of the default `systemcrypto` backend selection. +The `systemcrypto` backends now implement the following ML-DSA parameter sets: -#### FreeBSD +- ML-DSA-44 +- ML-DSA-65 +- ML-DSA-87 -`systemcrypto` is now supported on FreeBSD (`amd64` and `arm64`), using the same OpenSSL backend as on Linux. +### FIPS 140 -### Supported Algorithms +`GODEBUG=fips140=only` has been added. +It acts like `fips140=on`, but also panics if a non-FIPS-approved algorithm is used. -The following ML-DSA parameter sets are now implemented using the systemcrypto backends: +`GODEBUG=fips140=off` now explicitly disables FIPS mode and skips the platform-specific FIPS detection (such as the Linux kernel FIPS flag at `/proc/sys/crypto/fips_enabled`). -- ML-DSA-44 -- ML-DSA-65 -- ML-DSA-87 +The `GOFIPS` and `GOLANG_FIPS` environment variable checks now match their intended behavior: only the value `1` enables FIPS mode, and any other value (including `0` and the empty string) is treated as if the variable were unset.