linux/poky.git/meta/recipes-devtools/go/go-common.inc, branch walnascar

go: set status of CVE-2024-3566

2025-06-26T13:46:29+00:00

NVD ([1]) tracks this as: cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Running on/with cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Yocto cve-check ignores the "Running on/with", so it needs to be ignored explicitly. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-3566 (From OE-Core rev: c43a9f7ca85f1c25a72f7b1efa494e30d6cf4906) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

go: remove support for GOROOT_FINAL

2025-03-03T18:01:29+00:00

After upstream go applied commit [cmd: remove support for GOROOT_FINAL][1], GOROOT_FINAL variable is dropped and use option -trimpath to instead [2] The option -trimpath has already been added to GOBUILDFLAGS in go.bbclass [1] https://github.com/golang/go/commit/507d1b22f4b58ac68841582d0c2c0ab6b20e5a98 [2] https://github.com/golang/go/issues/62047 (From OE-Core rev: 791ab77ac05f658ecd61525a3d9b1afaf8ac6e06) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

go: set vendor in CVE_PRODUCT

2023-12-13T11:34:27+00:00

It's not uncommon for specific third party modules to use "go" as the product[1]. However, the canonical CPE for the official Go language/runtime is always golang:go[2], so use that explicitly. [1] e.g. https://nvd.nist.gov/vuln/detail/CVE-2023-49292 [2] e.g. https://nvd.nist.gov/vuln/detail/CVE-2023-39320 (From OE-Core rev: fc3e9cce9e1a5aa5dc9a5ad4abdd4eb61f868d37) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

go: use go as CVE product for all golang recipe veriants

2023-03-14T17:10:00+00:00

All golang vulnerabilities are reported under product 'go'. By default there is no vulnerability reported for images with golang components because none of used golang packages have correct CVE product set: * go-binary-native * go-runtime * go-cross-* (From OE-Core rev: 09f3a27a809bbec9b08c4e4a2b846b68f386c35c) Signed-off-by: Peter Marko Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

go: correctly set debug-prefix-map and build directory

2022-01-05T17:18:15+00:00

Go has its own system for creating temporary build sub-directories with randomized names, and setting up debug-prefix-map on the fly to prevent those directories leaking into target binaries. OE's own settings were clashing with it, so this change carefully avoids the two stepping on each other. Additionally, the top level build directory cannot be named 'go-something'. (From OE-Core rev: 9985b17a30bb9b9f1bc82a44662687db5cead66e) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

go: log build id computations

2022-01-05T17:18:15+00:00

go writes build-specific ids into binaries it produces and has a custom system for calculating them from file hashes, environment variables and other inputs (not that dissimilar to sstate cache, actually). This can go wrong :) in various ways (for purposes of reproducibility in particular), so this enables useful logs to see what happens and why. (From OE-Core rev: a587be1d18fc55fe57d1aa5aa7c9e26af887109e) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

Convert to new override syntax

2021-08-02T14:44:10+00:00

This is the result of automated script conversion: scripts/contrib/convert-overrides.py converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie

Revert "go: Use dl.google.com for SRC_URI"

2021-05-12T22:06:03+00:00

This reverts commit 4118415d4bc6243c98a1440195826be7cbad24f1. This was found to be unnecessary, and broke upstream version checks. (From OE-Core rev: cee436d1eb94663f3604c80b6ad87292f6901498) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

go: Use dl.google.com for SRC_URI

2021-04-23T09:12:10+00:00

golang.org/dl is resolving to this anyway (From OE-Core rev: 8470e38ac1d9f9bb6d8a4ee43724af452d080057) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

go: update SRC_URI to use https protocol

2021-04-18T10:37:26+00:00

(From OE-Core rev: 2a1eb731ed3bcb049192550e362b771c3a9ea6eb) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie