From 121b6cb231b5d904c03739495fcda69152d83f88 Mon Sep 17 00:00:00 2001
From: Matt Harbison <mharbison72@gmail.com>
Date: Sat, 3 Aug 2024 00:06:30 +0000
Subject: [PATCH] cmd/go: fix the accuracy of Mercurial vcs.* stamped data

There were a few Mercurial command line uses that could cause the wrong
data to be used:

* The log command needs '-r.' to specify the currently checked out commit
* HGPLAIN is needed to disable optional output on commands
* '-S' is needed to for the 'status' command to recurse into any subrepos

The most likely issue to be seen here was the use of '-l1' instead of
'-r.', which prints the most recent commit instead of the current checkout.
Since tagging in Mercurial creates a new commit, this basically means the
data was wrong for every tagged build.

This also adds an hgrc config file to the test, with config options to
keep the time and author values fixed.  It's what's used in the Mercurial
test harness to keep the commit hashes stable, and allows the tests here to
also match the time and the revision ID, to prevent regressing.

Fixes #63532

CVE: CVE-2025-68119
Upstream-Status: Backport [https://github.com/golang/go/commit/62452bed4801]

Change-Id: I5b9971ce87c83431ec77e4a002bdc33fcf393856
GitHub-Last-Rev: 62c9db0a28fee5881d0fe49f7bbb6e1653c7ff60
GitHub-Pull-Request: golang/go#63557
Reviewed-on: https://go-review.googlesource.com/c/go/+/535377
Reviewed-by: Bryan Mills <bcmills@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Sam Thanawalla <samthanawalla@google.com>
Auto-Submit: Sam Thanawalla <samthanawalla@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>
(cherry picked from commit 62452bed480108623910feace4a5cea5448e6822)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
 src/cmd/go/internal/vcs/vcs.go                | 13 +++++--
 .../testdata/script/version_buildvcs_hg.txt   | 39 ++++++++++++++++---
 2 files changed, 43 insertions(+), 9 deletions(-)

diff --git a/src/cmd/go/internal/vcs/vcs.go b/src/cmd/go/internal/vcs/vcs.go
index 89d9f0e94e..60f76d77cf 100644
--- a/src/cmd/go/internal/vcs/vcs.go
+++ b/src/cmd/go/internal/vcs/vcs.go
@@ -37,6 +37,7 @@ import (
 type Cmd struct {
	Name      string
	Cmd       string     // name of binary to invoke command
+	Env       []string   // any environment values to set/override
	RootNames []rootName // filename and mode indicating the root of a checkout directory

	CreateCmd   []string // commands to download a fresh copy of a repository
@@ -154,6 +155,10 @@ func vcsByCmd(cmd string) *Cmd {
 var vcsHg = &Cmd{
	Name: "Mercurial",
	Cmd:  "hg",
+
+	// HGPLAIN=1 turns off additional output that a user may have enabled via
+	// config options or certain extensions.
+	Env: []string{"HGPLAIN=1"},
	RootNames: []rootName{
		{filename: ".hg", isDir: true},
	},
@@ -189,12 +194,11 @@ func hgRemoteRepo(vcsHg *Cmd, rootDir string) (remoteRepo string, err error) {

 func hgStatus(vcsHg *Cmd, rootDir string) (Status, error) {
	// Output changeset ID and seconds since epoch.
-	out, err := vcsHg.runOutputVerboseOnly(rootDir, `log -l1 -T {node}:{date|hgdate}`)
+	out, err := vcsHg.runOutputVerboseOnly(rootDir, `log -r. -T {node}:{date|hgdate}`)
	if err != nil {
		return Status{}, err
	}

-	// Successful execution without output indicates an empty repo (no commits).
	var rev string
	var commitTime time.Time
	if len(out) > 0 {
@@ -209,7 +213,7 @@ func hgStatus(vcsHg *Cmd, rootDir string) (Status, error) {
	}

	// Also look for untracked files.
-	out, err = vcsHg.runOutputVerboseOnly(rootDir, "status")
+	out, err = vcsHg.runOutputVerboseOnly(rootDir, "status -S")
	if err != nil {
		return Status{}, err
	}
@@ -689,6 +693,9 @@ func (v *Cmd) run1(dir string, cmdline string, keyval []string, verbose bool) ([

	cmd := exec.Command(v.Cmd, args...)
	cmd.Dir = dir
+	if v.Env != nil {
+		cmd.Env = append(cmd.Environ(), v.Env...)
+	}
	if cfg.BuildX {
		fmt.Fprintf(os.Stderr, "cd %s\n", dir)
		fmt.Fprintf(os.Stderr, "%s %s\n", v.Cmd, strings.Join(args, " "))
diff --git a/src/cmd/go/testdata/script/version_buildvcs_hg.txt b/src/cmd/go/testdata/script/version_buildvcs_hg.txt
index fbbd886102..13904fae12 100644
--- a/src/cmd/go/testdata/script/version_buildvcs_hg.txt
+++ b/src/cmd/go/testdata/script/version_buildvcs_hg.txt
@@ -6,6 +6,8 @@
 [short] skip
 env GOBIN=$WORK/gopath/bin
 env oldpath=$PATH
+env TZ=GMT
+env HGRCPATH=$WORK/hgrc
 cd repo/a

 # If there's no local repository, there's no VCS info.
@@ -29,24 +31,43 @@ cd ..
 env PATH=$oldpath
 rm .hg

-# If there is an empty repository in a parent directory, only "uncommitted" is tagged.
+# An empty repository or one explicitly updated to null uses the null cset ID,
+# and the time is hard set to 1/1/70, regardless of the current time.
 exec hg init
 cd a
 go install
 go version -m $GOBIN/a$GOEXE
-! stdout vcs.revision
-! stdout vcs.time
+stdout '^\tbuild\tvcs.revision=0000000000000000000000000000000000000000$'
+stdout '^\tbuild\tvcs.time=1970-01-01T00:00:00Z$'
 stdout '^\tbuild\tvcs.modified=true$'
 cd ..

 # Revision and commit time are tagged for repositories with commits.
 exec hg add a README
-exec hg commit -m 'initial commit'
+exec hg commit -m 'initial commit' --user test-user --date '2024-07-31T01:21:27+00:00'
 cd a
 go install
 go version -m $GOBIN/a$GOEXE
-stdout '^\tbuild\tvcs.revision='
-stdout '^\tbuild\tvcs.time='
+stdout '^\tbuild\tvcs.revision=71eaed52daeaafea83cb604f75b0a0336ef2c345$'
+stdout '^\tbuild\tvcs.time=2024-07-31T01:21:27Z$'
+stdout '^\tbuild\tvcs.modified=false$'
+rm $GOBIN/a$GOEXE
+
+# Add an extra commit and then back off of it to show that the hash is
+# from the checked out revision, not the tip revision.
+cp ../../outside/empty.txt .
+exec hg ci -Am 'another commit' --user test-user --date '2024-08-01T19:24:38+00:00'
+exec hg update --clean -r '.^'
+
+# Modified state is not thrown off by extra status output
+exec hg bisect -v -g .
+exec hg bisect -v -b '.^^'
+exec hg status
+stdout '^.+'
+go install
+go version -m $GOBIN/a$GOEXE
+stdout '^\tbuild\tvcs.revision=71eaed52daeaafea83cb604f75b0a0336ef2c345$'
+stdout '^\tbuild\tvcs.time=2024-07-31T01:21:27Z$'
 stdout '^\tbuild\tvcs.modified=false$'
 rm $GOBIN/a$GOEXE

@@ -88,4 +109,10 @@ go 1.18
 package main

 func main() {}
+-- $WORK/hgrc --
+[ui]
+# tweakdefaults is an opt-in that may print extra output in commands like
+# status.  That can be disabled by setting HGPLAIN=1.
+tweakdefaults = 1
+
 -- outside/empty.txt --
--
2.35.6
