linux/poky.git/meta/recipes-devtools/go, branch mickledore

go: upgrade 1.20.6 -> 1.20.7

2023-09-13T16:21:26+00:00

Upgrade to latest 1.20.x release [1]: $ git log --oneline go1.20.6..go1.20.7 origin/release-branch.go1.20 adb775e309 (tag: go1.20.7, origin/release-branch.go1.20) [release-branch.go1.20] go1.20.7 659f2a2207 [release-branch.go1.20] crypto/tls: restrict RSA keys in certificates to <= 8192 bits 10d85fa0f6 [release-branch.go1.20] cmd/asm, cmd/internal/obj: generate proper atomic ops for riscv64 bd3a1f24e7 [release-branch.go1.20] net: tolerate permission errors in interface tests 6211a024b4 [release-branch.go1.20] cmd/compile: on PPC64, fix sign/zero extension when masking [1] https://github.com/golang/go/compare/go1.20.6...go1.20.7 Upgrade include fix for CVE-2023-29409 CVE-2023-39533 (cherry picked from commit 039324d917ed124228a14ac1effdd66b27d9e82b) (From OE-Core rev: 8397964d5a8d995a06c5c2a34883047546edc077) Signed-off-by: Sakib Sajal Signed-off-by: Alexandre Belloni Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman

go: update 1.20.5 -> 1.20.6

2023-08-15T16:18:48+00:00

Upgrade to latest 1.20.x release [1]: $ git log --oneline go1.20.5..go1.20.6 origin/release-branch.go1.20 2c358ffe97 (tag: go1.20.6, origin/release-branch.go1.20) [release-branch.go1.20] go1.20.6 312920c00a [release-branch.go1.20] net/http: validate Host header before sending 4db13d762b [release-branch.go1.20] runtime: set raceignore to zero when starting a new goroutine 08a58dd8b6 [release-branch.go1.20] runtime: allow for 5 more threads in TestWindowsStackMemory* 65092835c5 [release-branch.go1.20] cmd/go: skip TestScript/gccgo_link_ldflags on aix/ppc64 bca817594c [release-branch.go1.20] crypto/x509: tolerate multiple matching chains in testVerify b8e67d1ddd [release-branch.go1.20] cmd/go/internal/test: don't wait for previous test actions when interrupted 3db4f8146c [release-branch.go1.20] runtime: resolve checkdead panic by refining `startm` lock handling in caller context 6b45fb7b73 [release-branch.go1.20] runtime: fallback to TEB arbitrary pointer when TLS slots are full be30960e58 [release-branch.go1.20] runtime: use 1-byte load for address checking in racecallatomic b59efe6c34 [release-branch.go1.20] net/mail: permit more characters in mail headers c32f1afb41 [release-branch.go1.20] all: make safe for new vet analyzer c7b145655b [release-branch.go1.20] cmd/go: fix tests for new builder environment 03063101a2 [release-branch.go1.20] text/template: set variables correctly in range assignment d51e322a3f [release-branch.go1.20] go/printer: error out of Fprint when it would write a '//line' directive with a multiline file path 49594244d3 [release-branch.go1.20] cmd/cover: error out if a requested source file contains a newline 4719048211 [release-branch.go1.20] cmd/cgo: error out if the source path used in line directives would contain a newline 6c606fc191 [release-branch.go1.20] cmd/go: fix TestScript/build_cwd_newline with CGO_ENABLED=0 63ad2b5811 [release-branch.go1.20] cmd/compile: do not report division by error during typecheck 95f377daad [release-branch.go1.20] cmd/go: retain extra roots to disambiguate imports in 'go mod tidy' a7a48fad7e [release-branch.go1.20] crypto/ecdsa: properly truncate P-521 hashes f5172dcd38 [release-branch.go1.20] go/build: check for invalid import paths again 8b3acefcbe [release-branch.go1.20] cmd/go: omit checksums for go.mod files needed for go version lines more often in pre-1.21 modules 1008486a9f [release-branch.go1.20] cmd/cgo: correct _cgo_flags output [1] https://github.com/golang/go/compare/go1.20.5...go1.20.6 (From OE-Core rev: 944b186eeb6821654ce6ef56df7ac0f2829696f5) Signed-off-by: Jose Quaresma Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 8d8216d8c4d37cc0d9508eb644653f94fff8989c) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman

go: fix CVE-2023-24531

2023-07-26T15:12:21+00:00

Backport required commits to fix CVE-2023-24531. (From OE-Core rev: 5d80e920c7ceaf091ccace8a3b6781b720abafbf) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman

go: Upgrade 1.20.4 -> 1.20.5

2023-06-30T14:07:59+00:00

Upgrade to latest 1.20.x release: go.git$ git log --oneline go1.20.4..go1.20.5 e827d41c0a (tag: go1.20.5) [release-branch.go1.20] go1.20.5 c0ed873cd8 [release-branch.go1.20] cmd/go: disallow package directories containing newlines 356a419e2f [release-branch.go1.20] cmd/go: enforce flags with non-optional arguments fa60c381ed [release-branch.go1.20] cmd/go,cmd/cgo: in _cgo_flags use one line per flag 36144ba429 [release-branch.go1.20] runtime: implement SUID/SGID protections 5036ba77eb [release-branch.go1.20] net: skip TestFileFdBlocks if the "unix" network is not supported b249ec5655 [release-branch.go1.20] cmd/go/internal: update documentation of go test and go generate 4b95fc1e6c [release-branch.go1.20] cmd/go: save checksums for go.mod files needed for go version lines 31a1e19a59 [release-branch.go1.20] net, os: net.Conn.File.Fd should return a blocking descriptor 450c8021a5 [release-branch.go1.20] runtime: change fcntl to return two values 22741120ee [release-branch.go1.20] runtime: consistently define fcntl 9270e3be8f [release-branch.go1.20] os: if descriptor is non-blocking, retain that in Fd method 600636e931 [release-branch.go1.20] crypto/rsa: use BoringCrypto for 4096 bit keys afbe101950 [release-branch.go1.20] cmd/compile: fix bswap/load rewrite rules (From OE-Core rev: 1234971eea7b07e89efaf20055ba9580fbe2cb08) Signed-off-by: Sakib Sajal Signed-off-by: Richard Purdie (cherry picked from commit 3ea1e9e9d7385c78bdd513e44cea5c36444529b2) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman

go: Use -no-pie to build target cgo

2023-06-14T14:14:25+00:00

Fixes go: ELF binary /usr/lib/go/pkg/tool/linux_arm64/pprof has relocations in .text go: ELF binary /usr/lib/go/bin/go has relocations in .text [textrel] (From OE-Core rev: 0e9f47eddf786972b409088629d0f62c6bc74448) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie (cherry picked from commit a27d39aebd5966ffffb57c20518381cb06ba8373) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman

go: Upgrade 1.20.1 -> 1.20.4

2023-06-14T14:14:25+00:00

- Remove already upstreamed patches - Brings a list of changes [1] [2] [3] [1] https://github.com/golang/go/issues?q=milestone%3AGo1.20.2+label%3ACherryPickApproved [2] https://github.com/golang/go/issues?q=milestone%3AGo1.20.3+label%3ACherryPickApproved [3] https://github.com/golang/go/issues?q=milestone%3AGo1.20.4+label%3ACherryPickApproved (From OE-Core rev: 5847869334dd6687441708e26d1c0ab0a648e7f5) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie (cherry picked from commit e043bfb42156c59c93c6a4816528a63cfdaccc3e) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman

go: backport fix for CVE-2023-24537

2023-04-22T10:05:21+00:00

(From OE-Core rev: 6b5a3cc1c8c5c6591fb02612869e6725c010ca13) Signed-off-by: Ross Burton Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie

go: fix CVE-2023-2453

2023-03-28T21:28:45+00:00

Backport a security fix, can be removed once we have 1.20.2 onwards. (From OE-Core rev: 06df8350c3bc6f56013a0bff20b64cfdbb81cfca) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

go: fix some linkshared regression introduced in go 1.20

2023-03-23T22:36:46+00:00

Since go 1.20 some packages fails to link [1][2] and only build staticaly with GO_LINKSHARED = "" [1] https://lists.yoctoproject.org/g/meta-virtualization/topic/97182310 [2] https://github.com/golang/go/issues/58966 (From OE-Core rev: eb40d6c2ef72814336365208722e2dc96322e07d) Signed-off-by: Jose Quaresma Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

go: use go as CVE product for all golang recipe veriants

2023-03-14T17:10:00+00:00

All golang vulnerabilities are reported under product 'go'. By default there is no vulnerability reported for images with golang components because none of used golang packages have correct CVE product set: * go-binary-native * go-runtime * go-cross-* (From OE-Core rev: 09f3a27a809bbec9b08c4e4a2b846b68f386c35c) Signed-off-by: Peter Marko Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie