summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/go
Commit message (Collapse)AuthorAgeFilesLines
* go: fix CVE-2023-29406 net/http insufficient sanitization of Host headerVivek Kumbhar2023-08-022-0/+211
| | | | | | | (From OE-Core rev: 5dc74138649ab7a2c0158a43225dc7a8fd732355) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29400 html/template improper handling of empty HTML attributesVivek Kumbhar2023-07-122-0/+100
| | | | | | | (From OE-Core rev: 3224084a1ca301ff4fb4735ccc80d24aaec13257) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29402Archana Polampalli2023-07-012-0/+195
| | | | | | | | | | | | | | | | | | | | The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). References: https://nvd.nist.gov/vuln/detail/CVE-2023-29402 Upstream patches: https://github.com/golang/go/commit/4dae3bbe0e6a5700037bb996ae84d6f457c4f58a (From OE-Core rev: aeb0829e52c60a77a2135af8332435b6e2db5b3d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29405Archana Polampalli2023-07-012-0/+110
| | | | | | | | | | | | | | | | | | | | | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29405 Upstream patches: https://github.com/golang/go/commit/6d8af00a630aa51134e54f0f321658621c6410f0 (From OE-Core rev: 7ce6d0029effc06cff500271a124150f1a7db7b3) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29404Archana Polampalli2023-07-012-0/+79
| | | | | | | | | | | | | | | | | | | | | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29404 Upstream patches: https://github.com/golang/go/commit/bbeb55f5faf93659e1cfd6ab073ab3c9d126d195 (From OE-Core rev: 3e51122f8e2b4a7cd2a1c711175e6daf59b8368b) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24539 html/template improper sanitization of CSS valuesVivek Kumbhar2023-06-142-0/+54
| | | | | | | | | | | | | | | | | | Angle brackets should not appear in CSS contexts, as they may affect token boundaries (such as closing a <style> tag, resulting in injection). Instead emit filterFailsafe, matching the behavior for other dangerous characters. Thanks to Juho Nurminen of Mattermost for reporting this issue. For #59720 Fixes #59811 Fixes CVE-2023-24539 (From OE-Core rev: 0a09194f3d4ad98d0cf0d070ec0c99e7a6c8a158) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24540Sakib Sajal2023-05-302-0/+94
| | | | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2023-24540 Upstream patch: https://github.com/golang/go/commit/ce7bd33345416e6d8cac901792060591cafc2797 (go 1.19.9) (From OE-Core rev: 5defed7d5dc8bc6f68f021d19c4f42832d33472b) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Security fix for CVE-2023-24538Shubham Kulkarni2023-05-102-0/+209
| | | | | | | | | | | html/template: disallow actions in JS template literals Backport from https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b (From OE-Core rev: 835462d697a5f294900843b8bcd628709c256605) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24534 denial of service from excessive memory allocationVivek Kumbhar2023-05-102-0/+201
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A parsed MIME header is a map[string][]string. In the common case, a header contains many one-element []string slices. To avoid allocating a separate slice for each key, ReadMIMEHeader looks ahead in the input to predict the number of keys that will be parsed, and allocates a single []string of that length. The individual slices are then allocated out of the larger one. The prediction of the number of header keys was done by counting newlines in the input buffer, which does not take into account header continuation lines (where a header key/value spans multiple lines) or the end of the header block and the start of the body. This could lead to a substantial amount of overallocation, for example when the body consists of nothing but a large block of newlines. Fix header key count prediction to take into account the end of the headers (indicated by a blank line) and continuation lines (starting with whitespace). Thanks to Jakob Ackermann (@das7pad) for reporting this issue. Fixes CVE-2023-24534 For #58975 Fixes #59267 (From OE-Core rev: 28bfa033ce965d7316a8b4296d10f3ad74d711db) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24537 Infinite loop in parsingVivek Kumbhar2023-04-262-0/+76
| | | | | | | | | | | | | | | | | Setting a large line or column number using a //line directive can cause integer overflow even in small source files. Limit line and column numbers in //line directives to 2^30-1, which is small enough to avoid int32 overflow on all reasonbly-sized files. Fixes CVE-2023-24537 Fixes #59273 For #59180 (From OE-Core rev: 15c07dff384ce4fb0e90f4f32c182a82101a1c82) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2022-41716Peter Marko2023-04-261-0/+3
| | | | | | | | | | | | | | This CVE is specific to Microsoft Windows, ignore it. Patch fixing it (https://go-review.googlesource.com/c/go/+/446916) also adds a redundant check to generic os/exec which could be backported but it should not be necessary as backport always takes a small risk to break old code. (From OE-Core rev: ae8167754ff1c02f2d92af03de804754ea77a3e5) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-runtime: Security fix for CVE-2022-41722Shubham Kulkarni2023-04-262-0/+104
| | | | | | | | | | | path/filepath: do not Clean("a/../c:/b") into c:\b on Windows Backport from https://github.com/golang/go/commit/bdf07c2e168baf736e4c057279ca12a4d674f18c (From OE-Core rev: f60637b3c9045656047d6ffcfaadbef5ad1d3d06) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2022-41724, 41725Joe Slater2023-04-194-1/+3131
| | | | | | | | | | | | | Backport from go-1.19. The godebug package is needed by the fix to CVE-2022-41725. Mostly a cherry-pick but exceptions are noted in comments marked "backport". (From OE-Core rev: e5cf04f55b4849ae6db1253b39ad8b037cf01af4) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-runtime: Security fix for CVE-2022-41723Shubham Kulkarni2023-04-112-0/+157
| | | | | | | | | | | | | Disable cmd/internal/moddeps test, since this update includes PRIVATE track fixes. Backport from https://github.com/golang/go/commit/5c3e11bd0b5c0a86e5beffcd4339b86a902b21c3 (From OE-Core rev: 7440ebac50813e5df73da2d660a50fa97de650de) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-2879 and CVE-2022-41720Sakib Sajal2023-04-113-0/+693
| | | | | | | | | | | | | | Backport appropriate patches to fix CVE-2022-2879 and CVE-2022-41720. Modified the original fix for CVE-2022-2879 to remove a testdata tarball and any references to it since git binary diffs are not supported in quilt. (From OE-Core rev: a896cebe1ce2363b501723475154350acf0e0783) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: remove True option to getVar and getVarFlag calls (again)Martin Jansa2023-02-151-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * True is default since 2016 and most layers were already updated not to pass this parameter where not necessary, e.g. oe-core was updated couple times, first in: https://git.openembedded.org/openembedded-core/commit/?id=7c552996597faaee2fbee185b250c0ee30ea3b5f Updated with the same regexp as later oe-core update: https://git.openembedded.org/openembedded-core/commit/?id=9f551d588693328e4d99d33be94f26684eafcaba with small modification to replace not only d.getVar, but also data.getVar as in e.g.: e.data.getVar('ERR_REPORT_USERNAME', True) and for getVarFlag: sed -e 's|\(d\.getVarFlag \?\)( \?\([^,()]*, \?[^,()]*\), \?True)|\1(\2)|g' \ -i $(git grep -E 'getVarFlag ?\( ?([^,()]*), ?([^,()]*), ?True\)' \ | cut -d':' -f1 \ | sort -u) (From OE-Core rev: de7bf6689a19dc614ce4b39c84ffd825bee1b962) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 26c74fd10614582e177437608908eb43688ab510) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 24a86d0c55ee89ae0dc77975e1d0ee02898d2289) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-41717 Excessive memory use in got serverHitendra Prajapati2023-01-262-0/+90
| | | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/618120c165669c00a1606505defea6ca755cdc27 (From OE-Core rev: f4d179aab7c8f55669ac652a0668644859ec2eb7) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go-crosssdk: avoid host contamination by GOCACHERobert Andersson2023-01-061-0/+2
| | | | | | | | | | | | | | | | | | By default GOCACHE is set to $HOME/.cache. Same issue for all other go recipes had been fixed by commit 9a6d208b: [ go: avoid host contamination by GOCACHE ] but that commit missed go-crosssdk recipe. (From OE-Core rev: 803b754c64c8ee923cc02c17cf80798c93e3811c) Signed-off-by: Robert Andersson <robert.m.andersson@atlascopco.com> Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit e5fd10c647ac4baad65f9efa964c3380aad7dd10) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: CVE-2022-41715 regexp/syntax: limit memory used by parsing regexpsHitendra Prajapati2022-12-232-0/+271
| | | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/e9017c2416ad0ef642f5e0c2eab2dbf3cba4d997 (From OE-Core rev: d5a533b86ce68b4c3cd2d3c3dd198c2897d37587) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-2880Sakib Sajal2022-12-012-0/+179
| | | | | | | | | | Backport patch to fix CVE-2022-2880. (From OE-Core rev: a38f8316fdd0c9fc6fc7af195973028370935ba3) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go-native: switch from SRC_URI:append to SRC_URI +=Mikko Rapeli2022-09-281-1/+1
| | | | | | | | | | | | | | The :append can not be removed if needed in other layers. (From OE-Core rev: e129d2f7e3ba312ab5383397eeabf7273d23a529) (From OE-Core rev: 905062ef53c016091c36690b36ed9ed5203175e5) Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 09ed655c2a8a0a246e7dcc745ec89f7a1d13813d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-27664Teoh Jay Shen2022-09-282-0/+103
| | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/5bc9106458fc07851ac324a4157132a91b1f3479] (From OE-Core rev: fecad1b8e0f006c0186941706219d39c6c8ba5eb) Signed-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: update v1.17.12 -> v1.17.13Sakib Sajal2022-08-288-3/+3
| | | | | | | | | | | | | | | | | | | | Update to latest v1.17.x release. Contains fix for CVE-2022-32189. go.git$ git log --oneline go1.17.12^..go1.17.13 15da892a49 (tag: go1.17.13, origin/release-branch.go1.17) [release-branch.go1.17] go1.17.13 703c8ab7e5 [release-branch.go1.17] math/big: check buffer lengths in GobDecode d9242f7a8c [release-branch.go1.17] cmd/compile: do not use special literal assignment if LHS is address-taken 489c148578 [release-branch.go1.17] cmd/compile: fix prove pass when upper condition is <= maxint 66c60f076c [release-branch.go1.17] runtime: clear timerModifiedEarliest when last timer is deleted c25b12fb81 [release-branch.go1.17] runtime: use saved LR when unwinding through morestack 1ed3c127da (tag: go1.17.12) [release-branch.go1.17] go1.17.12 (From OE-Core rev: 5acea6ee55d36987609bfa38b579ba86ca1879d1) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: update v1.17.10 -> v1.17.12Sakib Sajal2022-08-018-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | go.git$ git log --oneline go1.17.10..go1.17.12 1ed3c127da (tag: go1.17.12) [release-branch.go1.17] go1.17.12 cd54600b86 [release-branch.go1.17] encoding/gob: add a depth limit for ignored fields 76f8b7304d [release-branch.go1.17] path/filepath: fix stack exhaustion in Glob 8c1d8c8362 [release-branch.go1.17] io/fs: fix stack exhaustion in Glob 0117dee7dc [release-branch.go1.17] compress/gzip: fix stack exhaustion bug in Reader.Read ba8788ebce [release-branch.go1.17] go/parser: limit recursion depth 2678d0c957 [release-branch.go1.17] encoding/xml: limit depth of nesting in unmarshal 58facfbe7d [release-branch.go1.17] encoding/xml: use iterative Skip, rather than recursive ed2f33e1a7 [release-branch.go1.17] net/http: preserve nil values in Header.Clone d13431c37a [release-branch.go1.17] net/http: don't strip whitespace from Transfer-Encoding headers ae2dfcc1c8 [release-branch.go1.17] runtime: add race annotations to cbs.lock fc07039e23 [release-branch.go1.17] runtime: add race annotations to metricsSema 9ef614f5aa [release-branch.go1.17] cmd/compile: allow 128-bit values to be spilled b1be664d64 [release-branch.go1.17] runtime: store consistent total allocation stats as uint64 77cc1c0def [release-branch.go1.17] cmd/go: pass --no-decorate when listing git tags for a commit 8d2935ab7c [release-branch.go1.17] cmd/dist: test cgo internal linking on darwin-arm64 651a8d81ba [release-branch.go1.17] cmd/dist: skip internal linking tests on arm64 26cdea3acc (tag: go1.17.11) [release-branch.go1.17] go1.17.11 4c69fd51a9 [release-branch.go1.17] path/filepath: do not remove prefix "." when following path contains ":". 909881db03 [release-branch.go1.17] misc/cgo/testsanitizers: buffer the signal channel in TestTSAN/tsan11 03c2e56f68 [release-branch.go1.17] crypto/tls: avoid extra allocations in steady-state Handshake calls c15a8e2dbb [release-branch.go1.17] crypto/tls: randomly generate ticket_age_add 590b53fac9 [release-branch.go1.17] os/exec: return clear error for missing cmd.Path 2be03d789d [release-branch.go1.17] crypto/rand: properly handle large Read on windows 65701ad2b4 [release-branch.go1.17] misc/cgo/testsanitizers: use buffered channel in tsan12.go e846f3f2d6 [release-branch.go1.17] runtime: skip TestGdbBacktrace flakes matching a known GDB internal error a9003376d5 [release-branch.go1.17] cmd/dist: consistently set PWD when executing a command in a different directory 0e7138a102 [release-branch.go1.17] runtime: mark TestGcSys as flaky (From OE-Core rev: 4c3591cd31b61c4008af80701dfc1bcd6339e0e8) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.17.8 -> 1.17.10Steve Sakoman2022-05-288-3/+3
| | | | | | | | | | | | | | go1.17.9 (released 2022-04-12) includes security fixes to the crypto/elliptic and encoding/pem packages, as well as bug fixes to the linker and runtime. go1.17.10 (released 2022-05-10) includes security fixes to the syscall package, as well as bug fixes to the compiler, runtime, and the crypto/x509 and net/http/httptest packages. (From OE-Core rev: bcbfff47e212627b355c54ab782f38708ed12d4c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Remove three unnecessary paths from do_compile[dirs]Peter Kjellerstedt2022-03-156-6/+0
| | | | | | | | | | There is no reason to include a path in foo[dirs] if it is also in foo[cleandirs] (except if it is the last path in foo[dirs]). (From OE-Core rev: 9f610748f760b2d58d5250b55ae4b268909f33ef) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.17.7 -> 1.17.8wangmy2022-03-0919-4/+4
| | | | | | | (From OE-Core rev: c375fcae8fd4c21a9f240440f9d7f31dde415e30) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta/scripts: Automated conversion of OE renamed variablesRichard Purdie2022-02-211-1/+1
| | | | | | (From OE-Core rev: aa52af4518604b5bf13f3c5e885113bf868d6c81) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.17.6 -> 1.17.7wangmy2022-02-188-3/+3
| | | | | | | (From OE-Core rev: e1a1b201c4a850ae116d88975df3fdab4dea6945) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.17.5 -> 1.17.6Alexander Kanavin2022-01-208-3/+3
| | | | | | | (From OE-Core rev: f48e276ec340acc1c086dff3d18f92d822e31351) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix building without SECURITY_LDFLAGSDmitry Baryshkov2022-01-142-2/+4
| | | | | | | | | | | | | | | | | | | | | | | Commit 9985b17a30bb ("go: correctly set debug-prefix-map and build directory") has changed CGO_LDFLAGS to the manually crafted version of LDFLAGS to strip out DEBUG_PREFIX_MAP contents. However this manually crafted version includes ${SECURITY_LDFLAGS}. If security_flags.inc is not included, the variable is not defined, thus CGO_LDFLAGS will include the '${SECURITY_LDFLAGS}' literally. When building the recipe, the build would break with the follwing message: aarch64-linaro-linux-gcc: error: ${SECURITY_LDFLAGS}: No such file or directory So, instead of manually specifying variable contents, perform the expected action: filter offending arguments out of LDFLAGS. Cc: Alexander Kanavin <alex.kanavin@gmail.com> (From OE-Core rev: e7d2d68679c1980d9e889d96c3eab49589f5b832) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: additional patches to help reproducibilityAlexander Kanavin2022-01-053-0/+84
| | | | | | | (From OE-Core rev: c7299f4e1cd38856885a2451c7c448c99d94b781) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: correctly set debug-prefix-map and build directoryAlexander Kanavin2022-01-053-2/+17
| | | | | | | | | | | | | | | | | Go has its own system for creating temporary build sub-directories with randomized names, and setting up debug-prefix-map on the fly to prevent those directories leaking into target binaries. OE's own settings were clashing with it, so this change carefully avoids the two stepping on each other. Additionally, the top level build directory cannot be named 'go-something'. (From OE-Core rev: 9985b17a30bb9b9f1bc82a44662687db5cead66e) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: log build id computationsAlexander Kanavin2022-01-051-0/+2
| | | | | | | | | | | | | | | go writes build-specific ids into binaries it produces and has a custom system for calculating them from file hashes, environment variables and other inputs (not that dissimilar to sstate cache, actually). This can go wrong :) in various ways (for purposes of reproducibility in particular), so this enables useful logs to see what happens and why. (From OE-Core rev: a587be1d18fc55fe57d1aa5aa7c9e26af887109e) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.17.4 -> 1.17.5Alexander Kanavin2021-12-178-3/+3
| | | | | | | (From OE-Core rev: 00da24376f4214f30d3eb775d990080b49bb5d3c) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: update 1.17.3 -> 1.17.4Alexander Kanavin2021-12-088-3/+3
| | | | | | | (From OE-Core rev: aa1dd053503f464dcc920e064a6d8ead6772cab2) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: update 1.16.10 -> 1.17.3Alexander Kanavin2021-11-2917-81/+112
| | | | | | | | | | | This was additionally verified with meta-virtualization: $ bitbake packagegroup-container packagegroup-kubernetes $ bitbake container-base kvm-image-minimal xen-guest-image-minimal (From OE-Core rev: 7acfadc2ef96cd205a85713624ce96129b679b28) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.16.8 -> 1.16.10Pavel Zhukov2021-11-248-4/+4
| | | | | | | | | The release includes fixes for CVE-2021-41771 and CVE-2021-41772 (From OE-Core rev: 69c68f470e8e12456a4d9abf2d1c33b857e4ea37) Signed-off-by: Pavel Zhukov <pavel.zhukov@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.16.7 -> 1.16.8Sakib Sajal2021-10-118-4/+4
| | | | | | | | (From OE-Core rev: 97a2f406635f51bad1ab070f018a6466209f257b) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Exclude CVE-2021-29923 from report listRichard Purdie2021-09-071-0/+5
| | | | | | | | | | | Upstream don't believe it is a signifiant real world issue and will only fix in 1.17 onwards. Therefore exclude it from our reports. https://github.com/golang/go/issues/30999#issuecomment-910470358 (From OE-Core rev: 5bd5faf0c34b47b2443975d66b71482d2380a01a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.16.5 -> 1.16.7Sakib Sajal2021-09-048-4/+4
| | | | | | | | (From OE-Core rev: dd26135ba4e23ead3a9998087cb60d9e93399e48) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Convert to new override syntaxRichard Purdie2021-08-026-17/+17
| | | | | | | | | | | | This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.16.4 -> 1.16.5wangmy2021-06-128-4/+4
| | | | | | | (From OE-Core rev: c0c567ed2fb092cde97d03cb658d8bae93d9b28c) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.16.3 -> 1.16.4wangmy2021-05-148-4/+4
| | | | | | | (From OE-Core rev: 1e280a596293976ac835b557dcaaa56972682480) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "go: Use dl.google.com for SRC_URI"Alexander Kanavin2021-05-121-1/+1
| | | | | | | | | | | This reverts commit 4118415d4bc6243c98a1440195826be7cbad24f1. This was found to be unnecessary, and broke upstream version checks. (From OE-Core rev: cee436d1eb94663f3604c80b6ad87292f6901498) Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Use dl.google.com for SRC_URIKhem Raj2021-04-231-1/+1
| | | | | | | | | golang.org/dl is resolving to this anyway (From OE-Core rev: 8470e38ac1d9f9bb6d8a4ee43724af452d080057) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: update SRC_URI to use https protocolwangmy2021-04-181-1/+1
| | | | | | | (From OE-Core rev: 2a1eb731ed3bcb049192550e362b771c3a9ea6eb) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.16.2 -> 1.16.3wangmy2021-04-188-4/+4
| | | | | | | | | | | | This is bugfix release in 1.16 series [1] [1] https://github.com/golang/go/issues?q=milestone%3AGo1.16.3+label%3ACherryPickApproved (From OE-Core rev: 84188e7b78aa40b168b526fa5d681a8a21d3b77c) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go-dep: RemoveKhem Raj2021-03-154-145691/+0
| | | | | | | | | | | | | go-dep was an effort for dependency management before go modules, which since 2020 has been deprecated in favor of go modules. Since its not developed any longer and go mdules is officially supported, this should be retired from OE-core as well. (From OE-Core rev: 1e7ed44d87034446f1d07692c9378c3b0a8a9dd3) Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Otavio Salvador <otavio.salvador@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Update to 1.16.2Khem Raj2021-03-158-4/+4
| | | | | | | | | | | This is bugfix release in 1.16 series [1] [1] https://golang.org/doc/devel/release.html#go1.16.minor (From OE-Core rev: 25627fb304bbd26d994f68e29fb18802144149b2) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-24 04:05:45 +0000