From e9e18074b369fc543361b28c4e2cbbefe84211ee Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Mar 28 2023 10:10:39 +0000 Subject: import golang-1.19.4-1.el9 --- diff --git a/.gitignore b/.gitignore index 1b2c26f..a4a244e 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ -SOURCES/go1.18.4-1-openssl-fips.tar.gz +SOURCES/go1.19.4-1-openssl-fips.tar.gz +SOURCES/go1.19.4.tar.gz diff --git a/.golang.metadata b/.golang.metadata index a07c38b..2d6b49a 100644 --- a/.golang.metadata +++ b/.golang.metadata @@ -1 +1,2 @@ -3798a6b5b37624922f5da08860f39da457caa856 SOURCES/go1.18.4-1-openssl-fips.tar.gz +9463e718b1a8daa61009caa6c113197cbefbe9eb SOURCES/go1.19.4-1-openssl-fips.tar.gz +6debf76aa6fb97daff4d49502153a47093883c28 SOURCES/go1.19.4.tar.gz diff --git a/SOURCES/disable_static_tests_part1.patch b/SOURCES/disable_static_tests_part1.patch new file mode 100644 index 0000000..5b99e48 --- /dev/null +++ b/SOURCES/disable_static_tests_part1.patch @@ -0,0 +1,288 @@ +diff --git a/src/crypto/internal/backend/nobackend.go b/src/crypto/internal/backend/nobackend.go +index 5f258a2..5dbbc42 100644 +--- a/src/crypto/internal/backend/nobackend.go ++++ b/src/crypto/internal/backend/nobackend.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl +-// +build !linux !cgo android cmd_go_bootstrap msan no_openssl ++//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl || static ++// +build !linux !cgo android cmd_go_bootstrap msan no_openssl static + + package backend + +diff --git a/src/crypto/internal/boring/goboringcrypto.h b/src/crypto/internal/boring/goboringcrypto.h +index d6d99b1..f2fe332 100644 +--- a/src/crypto/internal/boring/goboringcrypto.h ++++ b/src/crypto/internal/boring/goboringcrypto.h +@@ -1,4 +1,5 @@ + // Copyright 2017 The Go Authors. All rights reserved. ++// +build !static + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +diff --git a/src/crypto/internal/boring/syso/syso.go b/src/crypto/internal/boring/syso/syso.go +index b338754..db5ea1e 100644 +--- a/src/crypto/internal/boring/syso/syso.go ++++ b/src/crypto/internal/boring/syso/syso.go +@@ -2,7 +2,7 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build boringcrypto ++//go:build boringcrypto && !static + + // This package only exists with GOEXPERIMENT=boringcrypto. + // It provides the actual syso file. +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go +index 079fc3c..e826d0b 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go +index 0b61e79..94d0c98 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go +index afec529..d822152 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h b/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h +index 6d6a562..17cc314 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h +@@ -1,4 +1,5 @@ + // Copyright 2017 The Go Authors. All rights reserved. ++// +build !static + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + // +build linux +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go +index ae40b93..17bc075 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go +index 6f00177..f466b18 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go +index 7c0b5d6..262af07 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl +-// +build !linux !cgo android cmd_go_bootstrap msan no_openssl ++//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl || static ++// +build !linux !cgo android cmd_go_bootstrap msan no_openssl static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go +index d49194d..ff15054 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c +index 2349db1..57fbb04 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c +@@ -1,4 +1,5 @@ + // +build linux ++// +build !static + // +build !android + // +build !no_openssl + // +build !cmd_go_bootstrap +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c +index 4379019..5034c46 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c +@@ -1,4 +1,5 @@ + // +build linux ++// +build !static + // +build !android + // +build !no_openssl + // +build !cmd_go_bootstrap +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c +index 49d40a7..3b3dbf8 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c +@@ -1,4 +1,5 @@ + // +build linux ++// +build !static + // +build !android + // +build !no_openssl + // +build !cmd_go_bootstrap +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c +index 7eb645e..1c3225a 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c +@@ -1,4 +1,5 @@ + // This file contains a port of the BoringSSL AEAD interface. ++// +build !static + // +build linux + // +build !android + // +build !no_openssl +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c +index df4ebe3..876393b 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c +@@ -1,4 +1,5 @@ + // +build linux ++// +build !static + // +build !android + // +build !no_openssl + // +build !cmd_go_bootstrap +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c +index 2eedd5b..04510d3 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c +@@ -1,4 +1,5 @@ + // This file contains a backport of the EVP_md5_sha1 method. ++// +build !static + // +build linux + // +build !android + // +build !no_openssl +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c +index 362d9e5..bebafef 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c +@@ -1,4 +1,5 @@ + // This file contains HMAC portability wrappers. ++// +build !static + // +build linux + // +build !android + // +build !no_openssl +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c +index 2824147..8bc1d85 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c +@@ -1,4 +1,5 @@ + // This file contains RSA portability wrappers. ++// +build !static + // +build linux + // +build !android + // +build !no_openssl +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c +index 22bd865..b7aa26b 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c +@@ -1,4 +1,5 @@ + // +build linux ++// +build !static + // +build !android + // +build !no_openssl + // +build !cmd_go_bootstrap +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go +index b3668b8..dcdae70 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go +index 915c840..8623d9d 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + +diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go +index 0b55ced..57309c0 100644 +--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go ++++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go +@@ -2,8 +2,8 @@ + // Use of this source code is governed by a BSD-style + // license that can be found in the LICENSE file. + +-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl +-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl ++//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static ++// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static + + package openssl + diff --git a/SOURCES/disable_static_tests_part2.patch b/SOURCES/disable_static_tests_part2.patch new file mode 100644 index 0000000..6ad4e62 --- /dev/null +++ b/SOURCES/disable_static_tests_part2.patch @@ -0,0 +1,36 @@ +diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go +index da5b179..6a772df 100644 +--- a/src/cmd/dist/test.go ++++ b/src/cmd/dist/test.go +@@ -1247,18 +1247,20 @@ func (t *tester) cgoTest(dt *distTest) error { + fmt.Println("No support for static linking found (lacks libc.a?), skip cgo static linking test.") + } else { + if goos != "android" { +- t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".") ++ t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, "-tags=no_openssl") + } + t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), ".") + t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external`, ".") + if goos != "android" { +- t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".") ++ t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, "-tags=no_openssl") ++ /* + t.addCmd(dt, "misc/cgo/test", t.goTest(), "-tags=static", "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".") + // -static in CGO_LDFLAGS triggers a different code path + // than -static in -extldflags, so test both. + // See issue #16651. + cmd := t.addCmd(dt, "misc/cgo/test", t.goTest(), "-tags=static", ".") + setEnv(cmd, "CGO_LDFLAGS", "-static -pthread") ++ */ + } + } + +@@ -1268,7 +1270,7 @@ func (t *tester) cgoTest(dt *distTest) error { + t.addCmd(dt, "misc/cgo/test", t.goTest(), "-buildmode=pie", "-ldflags=-linkmode=internal", "-tags=internal,internal_pie", ".") + } + t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-buildmode=pie", ".") +- t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie", ".") ++ t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie", "-tags=no_openssl") + } + } + } diff --git a/SOURCES/go1.5-zoneinfo_testing_only.patch b/SOURCES/go1.5-zoneinfo_testing_only.patch deleted file mode 100644 index 5f0046e..0000000 --- a/SOURCES/go1.5-zoneinfo_testing_only.patch +++ /dev/null @@ -1,73 +0,0 @@ -diff --git a/src/time/internal_test.go b/src/time/internal_test.go -index f0dddb7..415949a 100644 ---- a/src/time/internal_test.go -+++ b/src/time/internal_test.go -@@ -4,13 +4,15 @@ - - package time - -+import "runtime" -+ - func init() { - // force US/Pacific for time zone tests - ForceUSPacificForTesting() - } - - func initTestingZone() { -- z, err := loadLocation("America/Los_Angeles", zoneSources[len(zoneSources)-1:]) -+ z, err := loadLocation("America/Los_Angeles", zoneSources) - if err != nil { - panic("cannot load America/Los_Angeles for testing: " + err.Error() + "; you may want to use -tags=timetzdata") - } -@@ -21,8 +23,9 @@ func initTestingZone() { - var OrigZoneSources = zoneSources - - func forceZipFileForTesting(zipOnly bool) { -- zoneSources = make([]string, len(OrigZoneSources)) -+ zoneSources = make([]string, len(OrigZoneSources)+1) - copy(zoneSources, OrigZoneSources) -+ zoneSources = append(zoneSources, runtime.GOROOT()+"/lib/time/zoneinfo.zip") - if zipOnly { - zoneSources = zoneSources[len(zoneSources)-1:] - } -diff --git a/src/time/zoneinfo_test.go b/src/time/zoneinfo_test.go -index f032aa7..e3e5547 100644 ---- a/src/time/zoneinfo_test.go -+++ b/src/time/zoneinfo_test.go -@@ -9,6 +9,7 @@ import ( - "fmt" - "os" - "reflect" -+ "runtime" - "testing" - "time" - ) -@@ -137,7 +138,7 @@ func TestLoadLocationFromTZData(t *testing.T) { - t.Fatal(err) - } - -- tzinfo, err := time.LoadTzinfo(locationName, time.OrigZoneSources[len(time.OrigZoneSources)-1]) -+ tzinfo, err := time.LoadTzinfo(locationName, runtime.GOROOT()+"/lib/time/zoneinfo.zip") - if err != nil { - t.Fatal(err) - } -diff --git a/src/time/zoneinfo_unix.go b/src/time/zoneinfo_unix.go -index 23f8b3c..228db1b 100644 ---- a/src/time/zoneinfo_unix.go -+++ b/src/time/zoneinfo_unix.go -@@ -12,7 +12,6 @@ - package time - - import ( -- "runtime" - "syscall" - ) - -@@ -22,7 +21,6 @@ var zoneSources = []string{ - "/usr/share/zoneinfo/", - "/usr/share/lib/zoneinfo/", - "/usr/lib/locale/TZ/", -- runtime.GOROOT() + "/lib/time/zoneinfo.zip", - } - - func initLocal() { diff --git a/SOURCES/openssl_deprecated_algorithm_tests.patch b/SOURCES/openssl_deprecated_algorithm_tests.patch deleted file mode 100644 index 23c55a8..0000000 --- a/SOURCES/openssl_deprecated_algorithm_tests.patch +++ /dev/null @@ -1,124 +0,0 @@ -diff --git a/src/crypto/rsa/pkcs1v15_test.go b/src/crypto/rsa/pkcs1v15_test.go -index a4f2e2dbbe..76701d2e2b 100644 ---- a/src/crypto/rsa/pkcs1v15_test.go -+++ b/src/crypto/rsa/pkcs1v15_test.go -@@ -52,6 +52,7 @@ var decryptPKCS1v15Tests = []DecryptPKCS1v15Test{ - } - - func TestDecryptPKCS1v15(t *testing.T) { -+ t.Skip("not supported in FIPS mode") - decryptionFuncs := []func([]byte) ([]byte, error){ - func(ciphertext []byte) (plaintext []byte, err error) { - return DecryptPKCS1v15(nil, testRSA2048PrivateKey, ciphertext) -@@ -76,6 +77,7 @@ func TestDecryptPKCS1v15(t *testing.T) { - } - - func TestEncryptPKCS1v15(t *testing.T) { -+ t.Skip("not supported in FIPS mode") - random := rand.Reader - k := (testRSA2048PrivateKey.N.BitLen() + 7) / 8 - -@@ -137,6 +139,7 @@ var decryptPKCS1v15SessionKeyTests = []DecryptPKCS1v15Test{ - } - - func TestEncryptPKCS1v15SessionKey(t *testing.T) { -+ t.Skip("not supported in FIPS mode") - for i, test := range decryptPKCS1v15SessionKeyTests { - key := []byte("FAIL") - err := DecryptPKCS1v15SessionKey(nil, testRSA2048PrivateKey, decodeBase64(test.in), key) -@@ -151,6 +154,7 @@ func TestEncryptPKCS1v15SessionKey(t *testing.T) { - } - - func TestEncryptPKCS1v15DecrypterSessionKey(t *testing.T) { -+ t.Skip("not supported in FIPS mode") - for i, test := range decryptPKCS1v15SessionKeyTests { - plaintext, err := testRSA2048PrivateKey.Decrypt(rand.Reader, decodeBase64(test.in), &PKCS1v15DecryptOptions{SessionKeyLen: 4}) - if err != nil { -@@ -270,6 +274,7 @@ func TestUnpaddedSignature(t *testing.T) { - } - - func TestShortSessionKey(t *testing.T) { -+ t.Skip("not supported in FIPS mode") - // This tests that attempting to decrypt a session key where the - // ciphertext is too small doesn't run outside the array bounds. - ciphertext, err := EncryptPKCS1v15(rand.Reader, &testRSA2048PrivateKey.PublicKey, []byte{1}) -diff --git a/src/crypto/rsa/pss_test.go b/src/crypto/rsa/pss_test.go -index b547a87c71..99e7882866 100644 ---- a/src/crypto/rsa/pss_test.go -+++ b/src/crypto/rsa/pss_test.go -@@ -77,6 +77,7 @@ func TestEMSAPSS(t *testing.T) { - // TestPSSGolden tests all the test vectors in pss-vect.txt from - // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip - func TestPSSGolden(t *testing.T) { -+ t.Skip("SHA1 not supported in boring mode") - inFile, err := os.Open("testdata/pss-vect.txt.bz2") - if err != nil { - t.Fatalf("Failed to open input file: %s", err) -diff --git a/src/crypto/rsa/rsa_test.go b/src/crypto/rsa/rsa_test.go -index 9aa67655ab..2f4e666abb 100644 ---- a/src/crypto/rsa/rsa_test.go -+++ b/src/crypto/rsa/rsa_test.go -@@ -123,28 +123,29 @@ func testKeyBasics(t *testing.T, priv *PrivateKey) { - t.Errorf("private exponent too large") - } - -- if boring.Enabled() { -- // Cannot call encrypt/decrypt directly. Test via PKCS1v15. -- msg := []byte("hi!") -- if priv.Size() >= 256 { -- enc, err := EncryptPKCS1v15(rand.Reader, &priv.PublicKey, msg) -- if err != nil { -- t.Errorf("EncryptPKCS1v15: %v", err) -- return -- } -- dec, err := DecryptPKCS1v15(rand.Reader, priv, enc) -- if err != nil { -- t.Errorf("DecryptPKCS1v15: %v", err) -- return -- } -- if !bytes.Equal(dec, msg) { -- t.Errorf("got:%x want:%x (%+v)", dec, msg, priv) -- } -- } else { -- t.Logf("skipping check for unsupported key less than 2048 bits") -- } -- return -- } -+ if boring.Enabled() { -+ // Cannot call encrypt/decrypt directly. Test via EncryptOAEP. -+ sha256 := sha256.New() -+ msg := []byte("hi!") -+ if priv.Size() >= 256 { -+ enc, err := EncryptOAEP(sha256, rand.Reader, &priv.PublicKey, msg, nil) -+ if err != nil { -+ t.Errorf("EncryptOAEP: %v", err) -+ return -+ } -+ dec, err := DecryptOAEP(sha256, rand.Reader, priv, enc, nil) -+ if err != nil { -+ t.Errorf("DecryptOAEP: %v", err) -+ return -+ } -+ if !bytes.Equal(dec, msg) { -+ t.Errorf("got:%x want:%x (%+v)", dec, msg, priv) -+ } -+ } else { -+ t.Logf("skipping check for unsupported key less than 2048 bits") -+ } -+ return -+ } - - pub := &priv.PublicKey - m := big.NewInt(42) -@@ -312,6 +312,11 @@ func TestDecryptOAEP(t *testing.T) { - private.PublicKey = PublicKey{N: n, E: test.e} - private.D = d - -+ if boring.Enabled() && private.PublicKey.Size() < 256 { -+ t.Logf("skipping check for unsupported key less than 2048 bits") -+ continue -+ } -+ t.Logf("running check for supported key size") - for j, message := range test.msgs { - out, err := DecryptOAEP(sha1, nil, private, message.out, nil) - if err != nil { diff --git a/SOURCES/ppc64le-internal-linker-fix.patch b/SOURCES/ppc64le-internal-linker-fix.patch new file mode 100644 index 0000000..f54a83b --- /dev/null +++ b/SOURCES/ppc64le-internal-linker-fix.patch @@ -0,0 +1,122 @@ +diff --git a/src/cmd/go/testdata/script/trampoline_reuse_test.txt b/src/cmd/go/testdata/script/trampoline_reuse_test.txt +new file mode 100644 +index 0000000000000..bca897c16d054 +--- /dev/null ++++ b/src/cmd/go/testdata/script/trampoline_reuse_test.txt +@@ -0,0 +1,100 @@ ++# Verify PPC64 does not reuse a trampoline which is too far away. ++# This tests an edge case where the direct call relocation addend should ++# be ignored when computing the distance from the direct call to the ++# already placed trampoline ++[short] skip ++[!ppc64] [!ppc64le] skip ++[aix] skip ++ ++# Note, this program does not run. Presumably, 'DWORD $0' is simpler to ++# assembly 2^26 or so times. ++# ++# We build something which should be laid out as such: ++# ++# bar.Bar ++# main.Func1 ++# bar.Bar+400-tramp0 ++# main.BigAsm ++# main.Func2 ++# bar.Bar+400-tramp1 ++# ++# bar.Bar needs to be placed far enough away to generate relocations ++# from main package calls. and main.Func1 and main.Func2 are placed ++# a bit more than the direct call limit apart, but not more than 0x400 ++# bytes beyond it (to verify the reloc calc). ++ ++go build ++ ++-- go.mod -- ++ ++module foo ++ ++go 1.19 ++ ++-- main.go -- ++ ++package main ++ ++import "foo/bar" ++ ++func Func1() ++ ++func main() { ++ Func1() ++ bar.Bar2() ++} ++ ++-- foo.s -- ++ ++TEXT main·Func1(SB),0,$0-0 ++ CALL bar·Bar+0x400(SB) ++ CALL main·BigAsm(SB) ++// A trampoline will be placed here to bar.Bar ++ ++// This creates a gap sufficiently large to prevent trampoline reuse ++#define NOP64 DWORD $0; DWORD $0; DWORD $0; DWORD $0; DWORD $0; DWORD $0; DWORD $0; DWORD $0; ++#define NOP256 NOP64 NOP64 NOP64 NOP64 ++#define NOP2S10 NOP256 NOP256 NOP256 NOP256 ++#define NOP2S12 NOP2S10 NOP2S10 NOP2S10 NOP2S10 ++#define NOP2S14 NOP2S12 NOP2S12 NOP2S12 NOP2S12 ++#define NOP2S16 NOP2S14 NOP2S14 NOP2S14 NOP2S14 ++#define NOP2S18 NOP2S16 NOP2S16 NOP2S16 NOP2S16 ++#define NOP2S20 NOP2S18 NOP2S18 NOP2S18 NOP2S18 ++#define NOP2S22 NOP2S20 NOP2S20 NOP2S20 NOP2S20 ++#define NOP2S24 NOP2S22 NOP2S22 NOP2S22 NOP2S22 ++#define BIGNOP NOP2S24 NOP2S24 ++TEXT main·BigAsm(SB),0,$0-0 ++ // Fill to the direct call limit so Func2 must generate a new trampoline. ++ // As the implicit trampoline above is just barely unreachable. ++ BIGNOP ++ MOVD $main·Func2(SB), R3 ++ ++TEXT main·Func2(SB),0,$0-0 ++ CALL bar·Bar+0x400(SB) ++// Another trampoline should be placed here. ++ ++-- bar/bar.s -- ++ ++#define NOP64 DWORD $0; DWORD $0; DWORD $0; DWORD $0; DWORD $0; DWORD $0; DWORD $0; DWORD $0; ++#define NOP256 NOP64 NOP64 NOP64 NOP64 ++#define NOP2S10 NOP256 NOP256 NOP256 NOP256 ++#define NOP2S12 NOP2S10 NOP2S10 NOP2S10 NOP2S10 ++#define NOP2S14 NOP2S12 NOP2S12 NOP2S12 NOP2S12 ++#define NOP2S16 NOP2S14 NOP2S14 NOP2S14 NOP2S14 ++#define NOP2S18 NOP2S16 NOP2S16 NOP2S16 NOP2S16 ++#define NOP2S20 NOP2S18 NOP2S18 NOP2S18 NOP2S18 ++#define NOP2S22 NOP2S20 NOP2S20 NOP2S20 NOP2S20 ++#define NOP2S24 NOP2S22 NOP2S22 NOP2S22 NOP2S22 ++#define BIGNOP NOP2S24 NOP2S24 NOP2S10 ++// A very big not very interesting function. ++TEXT bar·Bar(SB),0,$0-0 ++ BIGNOP ++ ++-- bar/bar.go -- ++ ++package bar ++ ++func Bar() ++ ++func Bar2() { ++} +diff --git a/src/cmd/link/internal/ppc64/asm.go b/src/cmd/link/internal/ppc64/asm.go +index 5d5fbe2a97735..6313879da083c 100644 +--- a/src/cmd/link/internal/ppc64/asm.go ++++ b/src/cmd/link/internal/ppc64/asm.go +@@ -900,8 +900,9 @@ func trampoline(ctxt *ld.Link, ldr *loader.Loader, ri int, rs, s loader.Sym) { + if ldr.SymValue(tramp) == 0 { + break + } +- +- t = ldr.SymValue(tramp) + r.Add() - (ldr.SymValue(s) + int64(r.Off())) ++ // Note, the trampoline is always called directly. The addend of the original relocation is accounted for in the ++ // trampoline itself. ++ t = ldr.SymValue(tramp) - (ldr.SymValue(s) + int64(r.Off())) + + // With internal linking, the trampoline can be used if it is not too far. + // With external linking, the trampoline must be in this section for it to be reused. diff --git a/SOURCES/remove_ed25519vectors_test.patch b/SOURCES/remove_ed25519vectors_test.patch deleted file mode 100644 index 45e3182..0000000 --- a/SOURCES/remove_ed25519vectors_test.patch +++ /dev/null @@ -1,128 +0,0 @@ -From d7cad65ab9179804e9f089ce97bc124e9ef79494 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= -Date: Wed, 15 Dec 2021 16:02:15 +0100 -Subject: [PATCH] Remove ed25519vectors_test.go - ---- - src/crypto/ed25519/ed25519vectors_test.go | 109 ---------------------- - 1 file changed, 109 deletions(-) - delete mode 100644 src/crypto/ed25519/ed25519vectors_test.go - -diff --git a/src/crypto/ed25519/ed25519vectors_test.go b/src/crypto/ed25519/ed25519vectors_test.go -deleted file mode 100644 -index 74fcdcdf4e..0000000000 ---- a/src/crypto/ed25519/ed25519vectors_test.go -+++ /dev/null -@@ -1,109 +0,0 @@ --// Copyright 2021 The Go Authors. All rights reserved. --// Use of this source code is governed by a BSD-style --// license that can be found in the LICENSE file. -- --package ed25519_test -- --import ( -- "crypto/ed25519" -- "encoding/hex" -- "encoding/json" -- "internal/testenv" -- "os" -- "os/exec" -- "path/filepath" -- "testing" --) -- --// TestEd25519Vectors runs a very large set of test vectors that exercise all --// combinations of low-order points, low-order components, and non-canonical --// encodings. These vectors lock in unspecified and spec-divergent behaviors in --// edge cases that are not security relevant in most contexts, but that can --// cause issues in consensus applications if changed. --// --// Our behavior matches the "classic" unwritten verification rules of the --// "ref10" reference implementation. --// --// Note that although we test for these edge cases, they are not covered by the --// Go 1 Compatibility Promise. Applications that need stable verification rules --// should use github.com/hdevalence/ed25519consensus. --// --// See https://hdevalence.ca/blog/2020-10-04-its-25519am for more details. --func TestEd25519Vectors(t *testing.T) { -- jsonVectors := downloadEd25519Vectors(t) -- var vectors []struct { -- A, R, S, M string -- Flags []string -- } -- if err := json.Unmarshal(jsonVectors, &vectors); err != nil { -- t.Fatal(err) -- } -- for i, v := range vectors { -- expectedToVerify := true -- for _, f := range v.Flags { -- switch f { -- // We use the simplified verification formula that doesn't multiply -- // by the cofactor, so any low order residue will cause the -- // signature not to verify. -- // -- // This is allowed, but not required, by RFC 8032. -- case "LowOrderResidue": -- expectedToVerify = false -- // Our point decoding allows non-canonical encodings (in violation -- // of RFC 8032) but R is not decoded: instead, R is recomputed and -- // compared bytewise against the canonical encoding. -- case "NonCanonicalR": -- expectedToVerify = false -- } -- } -- -- publicKey := decodeHex(t, v.A) -- signature := append(decodeHex(t, v.R), decodeHex(t, v.S)...) -- message := []byte(v.M) -- -- didVerify := ed25519.Verify(publicKey, message, signature) -- if didVerify && !expectedToVerify { -- t.Errorf("#%d: vector with flags %s unexpectedly verified", i, v.Flags) -- } -- if !didVerify && expectedToVerify { -- t.Errorf("#%d: vector with flags %s unexpectedly rejected", i, v.Flags) -- } -- } --} -- --func downloadEd25519Vectors(t *testing.T) []byte { -- testenv.MustHaveExternalNetwork(t) -- -- // Download the JSON test file from the GOPROXY with `go mod download`, -- // pinning the version so test and module caching works as expected. -- goTool := testenv.GoToolPath(t) -- path := "filippo.io/mostly-harmless/ed25519vectors@v0.0.0-20210322192420-30a2d7243a94" -- cmd := exec.Command(goTool, "mod", "download", "-json", path) -- // TODO: enable the sumdb once the TryBots proxy supports it. -- cmd.Env = append(os.Environ(), "GONOSUMDB=*") -- output, err := cmd.Output() -- if err != nil { -- t.Fatalf("failed to run `go mod download -json %s`, output: %s", path, output) -- } -- var dm struct { -- Dir string // absolute path to cached source root directory -- } -- if err := json.Unmarshal(output, &dm); err != nil { -- t.Fatal(err) -- } -- -- jsonVectors, err := os.ReadFile(filepath.Join(dm.Dir, "ed25519vectors.json")) -- if err != nil { -- t.Fatalf("failed to read ed25519vectors.json: %v", err) -- } -- return jsonVectors --} -- --func decodeHex(t *testing.T, s string) []byte { -- t.Helper() -- b, err := hex.DecodeString(s) -- if err != nil { -- t.Errorf("invalid hex: %v", err) -- } -- return b --} --- -2.33.1 - diff --git a/SOURCES/skip_test_rhbz1939923.patch b/SOURCES/skip_test_rhbz1939923.patch new file mode 100644 index 0000000..555ed3b --- /dev/null +++ b/SOURCES/skip_test_rhbz1939923.patch @@ -0,0 +1,12 @@ +diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go +index b1cdabb..09eaace 100644 +--- a/src/crypto/x509/x509_test.go ++++ b/src/crypto/x509/x509_test.go +@@ -2993,6 +2993,7 @@ func (bs *brokenSigner) Sign(_ io.Reader, _ []byte, _ crypto.SignerOpts) ([]byte + } + + func TestCreateCertificateBrokenSigner(t *testing.T) { ++ t.Skip("TODO Fix me: rhbz#1939923") + template := &Certificate{ + SerialNumber: big.NewInt(10), + DNSNames: []string{"example.com"}, diff --git a/SPECS/golang.spec b/SPECS/golang.spec index 1d9ceb7..acc4947 100644 --- a/SPECS/golang.spec +++ b/SPECS/golang.spec @@ -56,7 +56,7 @@ %endif # Controls what ever we fail on failed tests -%ifarch x86_64 %{arm} aarch64 ppc64le +%ifarch x86_64 %{arm} aarch64 ppc64le s390x %global fail_on_tests 1 %else %global fail_on_tests 0 @@ -95,20 +95,28 @@ %global gohostarch s390x %endif -%global go_api 1.18 -%global go_version 1.18.4 +%global go_api 1.19 +%global go_version 1.19.4 +%global version %{go_version} %global pkg_release 1 Name: golang -Version: %{go_version} -Release: 3%{?dist} +Version: %{version} +Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain License: BSD and Public Domain URL: http://golang.org/ -Source0: https://github.com/golang-fips/go/archive/refs/tags/go%{go_version}-%{pkg_release}-openssl-fips.tar.gz +Source0: https://github.com/golang/go/archive/refs/tags/go%{version}.tar.gz +# Go's FIPS mode bindings are now provided as a standalone +# module instead of in tree. This makes it easier to see +# the actual changes vs upstream Go. The module source is +# located at https://github.com/golang-fips/openssl-fips, +# And pre-genetated patches to set up the module for a given +# Go release are located at https://github.com/golang-fips/go. +Source1: https://github.com/golang-fips/go/archive/refs/tags/go%{version}-%{pkg_release}-openssl-fips.tar.gz # make possible to override default traceback level at build time by setting build tag rpm_crashtraceback -Source1: fedora.go +Source2: fedora.go # The compiler is written in Go. Needs go(1.4+) compiler for build. # Actual Go based bootstrap compiler provided by above source. @@ -124,10 +132,6 @@ BuildRequires: net-tools %endif # For OpenSSL FIPS BuildRequires: openssl-devel - -# For openssl-fipsinstall -BuildRequires: openssl - # for tests BuildRequires: pcre-devel, glibc-static, perl @@ -137,16 +141,21 @@ Requires: %{name}-src = %{version}-%{release} Requires: openssl-devel Requires: diffutils -# we had been just removing the zoneinfo.zip, but that caused tests to fail for users that -# later run `go test -a std`. This makes it only use the zoneinfo.zip where needed in tests. -Patch215: go1.5-zoneinfo_testing_only.patch # Proposed patch by jcajka https://golang.org/cl/86541 Patch221: fix_TestScript_list_std.patch -Patch223: remove_ed25519vectors_test.patch +Patch1939923: skip_test_rhbz1939923.patch + + +# Disables libc static linking tests which +# are incompatible with dlopen in golang-fips +Patch2: disable_static_tests_part1.patch +Patch3: disable_static_tests_part2.patch -Patch224: openssl_deprecated_algorithm_tests.patch +# https://github.com/golang/go/issues/56834 +# https://github.com/golang/go/commit/1b4db7e46365bbbba479d0689c5699e6c0ba1142 +Patch4: ppc64le-internal-linker-fix.patch # Having documentation separate was broken Obsoletes: %{name}-docs < 1.1-4 @@ -235,14 +244,23 @@ Requires: %{name} = %{version}-%{release} %endif %prep -%setup -q -n go-go%{go_version}-%{pkg_release}-openssl-fips +%setup -q -n go-go%{version} + +pushd .. +tar -xf %{SOURCE1} +popd +patch -p1 < ../go-go%{version}-%{pkg_release}-openssl-fips/patches/000-initial-setup.patch +patch -p1 < ../go-go%{version}-%{pkg_release}-openssl-fips/patches/001-initial-openssl-for-fips.patch + +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 -%patch215 -p1 %patch221 -p1 -%patch223 -p1 -%patch224 -p1 -cp %{SOURCE1} ./src/runtime/ +%patch1939923 -p1 + +cp %{SOURCE2} ./src/runtime/ %build set -xe @@ -398,6 +416,8 @@ cp -av %{SOURCE100} $RPM_BUILD_ROOT%{_sysconfdir}/gdbinit.d/golang.gdb # prelink blacklist mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d cp -av %{SOURCE101} $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d/golang.conf + +# Quick fix for the rhbz#2014704 sed -i 's/const defaultGO_LDSO = `.*`/const defaultGO_LDSO = ``/' $RPM_BUILD_ROOT%{goroot}/src/internal/buildcfg/zbootstrap.go %check @@ -436,31 +456,26 @@ export GO_TEST_RUN="" ./run.bash --no-rebuild -v -v -v -k $GO_TEST_RUN -# tests timeout on ppc64le due to -# https://bugzilla.redhat.com/show_bug.cgi?id=2118776 -%ifnarch ppc64le -export OPENSSL_FORCE_FIPS_MODE=1 # Run tests with FIPS enabled. -pushd crypto - # Run all crypto tests but skip TLS, we will run FIPS specific TLS tests later - GOLANG_FIPS=1 go test $(go list ./... | grep -v tls) -v - # Check that signature functions have parity between boring and notboring - CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v -popd -# Run all FIPS specific TLS tests -pushd crypto/tls - GOLANG_FIPS=1 go test -v -run "Boring" -popd -%endif - +export GOLANG_FIPS=1 +#pushd crypto +# # Run all crypto tests but skip TLS, we will run FIPS specific TLS tests later +# go test $(go list ./... | grep -v tls) -v +# # Check that signature functions have parity between boring and notboring +# CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v +#popd +## Run all FIPS specific TLS tests +#pushd crypto/tls +# go test -v -run "Boring" +#popd %else -./run.bash --no-rebuild -v -v -v -k || : +#./run.bash --no-rebuild -v -v -v -k || : %endif cd .. %files -%doc AUTHORS CONTRIBUTORS LICENSE PATENTS +%doc LICENSE PATENTS # VERSION has to be present in the GOROOT, for `go install std` to work %doc %{goroot}/VERSION %dir %{goroot}/doc @@ -514,9 +529,26 @@ cd .. %endif %changelog -* Tue Aug 16 2022 David Benoit - 1.18.4-3 -- Temporarily disable crypto tests on ppc64le -- Related: rhbz#2109180 +* Wed Dec 21 2022 David Benoit - 1.19.4-1 +- Rebase to Go 1.19.4 +- Fix ppc64le linker issue +- Remove defunct patches +- Remove downstream generated FIPS mode patches +- Add golang-fips/go as the source for FIPS mode patches +- Resolves: rhbz#2144539 + +* Wed Nov 30 2022 David Benoit - 1.19.2-2 +- Fix endian issue in FIPS mode +- Resolves: rhbz#1966992 + +* Fri Oct 21 2022 David Benoit - 1.19.2-1 +- Update go to version 1.19.2 +- Resolves: rhbz#2134407 + +* Wed Sep 14 2022 David Benoit - 1.19.1-2 +- Rebase to Go 1.19.1 +- Temporarily disable crypto tests +- Resolves: rhbz#2131028 * Wed Aug 10 2022 Alejandro Sáez - 1.18.4-2 - Update to Go 1.18.4