Shengjing Zhu [Wed, 6 Dec 2023 07:32:23 +0000 (15:32 +0800)]
golang-1.21 (1.21.5-1) unstable; urgency=medium
* Team upload
* New upstream version 1.21.5
+ CVE-2023-39326: net/http: limit chunked data overhead
+ CVE-2023-45285: cmd/go: go get may unexpectedly fallback to insecure git
+ CVE-2023-45283: path/filepath: retain trailing \ when cleaning paths
like \\?\c:\
Shengjing Zhu [Tue, 7 Nov 2023 19:40:30 +0000 (03:40 +0800)]
golang-1.21 (1.21.4-1) unstable; urgency=medium
* Team upload
* New upstream version 1.21.4
+ CVE-2023-45283: path/filepath: recognize \??\ as a Root Local Device
path prefix.
+ CVE-2023-45284: path/filepath: recognize device names with trailing
spaces and superscripts.
* Team upload
* New upstream version 1.21.1
+ CVE-2023-39320: cmd/go: go.mod toolchain directive allows arbitrary
execution
+ CVE-2023-39318: html/template: improper handling of HTML-like comments
within script contexts
+ CVE-2023-39319: html/template: improper handling of special tags within
script contexts
+ CVE-2023-39321/CVE-2023-39322: crypto/tls: panic when processing
post-handshake message on QUIC connections
Most developers use (faster) amd64 machines setting the test timeouts,
but test may run on slower arm ones and also different tests may suffer
different relative slowdown on the arm CPUs.
Due to those two varying factors it is safer to allow a higher timeout
scale on arm to avoid tests timing out.
Gbp-Pq: Name 0006-cmd-dist-increase-default-timeout-scale-for-arm.patch
Xiangdong Ji [Wed, 5 Aug 2020 06:02:58 +0000 (06:02 +0000)]
cmd/dist: fix build failure of misc/cgo/test on arm64
Test7978 of misc/cgo/test fails in 'dist test' on arm64 if the C compiler
is of GCC-9.4 or above and its 'outline atomics' feature is enabled, since
the internal linking hasn't yet supported "__attribute__((constructor))"
and also mis-handles hidden visibility.
Two changes are made for 'misc/cgo/test' to fix the issue:
1. passing "-tags=internal" for the internal linking PIE case.
2. skipping Test7978 on arm64 for the internal linking cases.
This CL fixes 'dist test' failure only, user is expected to pass the option
'-mno-outline-atomics' via CGO_CFLAGS if running into the same problem when
building cgo program using internal linking.
YunQiang Su [Tue, 9 Jun 2020 04:09:58 +0000 (04:09 +0000)]
cmd/go, cmd/cgo: pass -mfp32 and -mhard/soft-float to MIPS GCC
For mips32 currently, we are using FP32, while the gcc may be FPXX,
which may generate .MIPS.abiflags and .gnu.attributes section with
value as FPXX. So the kernel will treat the exe as FPXX, and may
choose to use FR=1 FPU mode for it.
Currently, in Go, we use 2 lwc1 to load both half of a double value
to a pair of even-odd FPR. This behavior can only work with FR=0 mode.
In FR=1 mode, all of 32 FPR are 64bit. If we lwc1 the high-half of a double
value to an odd FPR, and try to use the previous even FPR to compute, the
real high-half of even FPR will be unpredicatable.
We set -mfp32 to force the gcc generate FP32 code and section value.
More details about FP32/FPXX/FP64 are explained in:
https://web.archive.org/web/20180828210612/https://dmz-portal.mips.com/wiki/MIPS_O32_ABI_-_FR0_and_FR1_Interlinking
When GOMIPS/GOMIPS64 is set as softfloat, we should also pass
-msoft-float to gcc.
Here we also add -mno-odd-spreg option, since Loongson's CPU cannot use
odd-number FR in FR=0 mode.
Most developers use (faster) amd64 machines setting the test timeouts,
but test may run on slower arm ones and also different tests may suffer
different relative slowdown on the arm CPUs.
Due to those two varying factors it is safer to allow a higher timeout
scale on arm to avoid tests timing out.
Gbp-Pq: Name 0006-cmd-dist-increase-default-timeout-scale-for-arm.patch
Xiangdong Ji [Wed, 5 Aug 2020 06:02:58 +0000 (06:02 +0000)]
cmd/dist: fix build failure of misc/cgo/test on arm64
Test7978 of misc/cgo/test fails in 'dist test' on arm64 if the C compiler
is of GCC-9.4 or above and its 'outline atomics' feature is enabled, since
the internal linking hasn't yet supported "__attribute__((constructor))"
and also mis-handles hidden visibility.
Two changes are made for 'misc/cgo/test' to fix the issue:
1. passing "-tags=internal" for the internal linking PIE case.
2. skipping Test7978 on arm64 for the internal linking cases.
This CL fixes 'dist test' failure only, user is expected to pass the option
'-mno-outline-atomics' via CGO_CFLAGS if running into the same problem when
building cgo program using internal linking.
YunQiang Su [Tue, 9 Jun 2020 04:09:58 +0000 (04:09 +0000)]
cmd/go, cmd/cgo: pass -mfp32 and -mhard/soft-float to MIPS GCC
For mips32 currently, we are using FP32, while the gcc may be FPXX,
which may generate .MIPS.abiflags and .gnu.attributes section with
value as FPXX. So the kernel will treat the exe as FPXX, and may
choose to use FR=1 FPU mode for it.
Currently, in Go, we use 2 lwc1 to load both half of a double value
to a pair of even-odd FPR. This behavior can only work with FR=0 mode.
In FR=1 mode, all of 32 FPR are 64bit. If we lwc1 the high-half of a double
value to an odd FPR, and try to use the previous even FPR to compute, the
real high-half of even FPR will be unpredicatable.
We set -mfp32 to force the gcc generate FP32 code and section value.
More details about FP32/FPXX/FP64 are explained in:
https://web.archive.org/web/20180828210612/https://dmz-portal.mips.com/wiki/MIPS_O32_ABI_-_FR0_and_FR1_Interlinking
When GOMIPS/GOMIPS64 is set as softfloat, we should also pass
-msoft-float to gcc.
Here we also add -mno-odd-spreg option, since Loongson's CPU cannot use
odd-number FR in FR=0 mode.
Ian Lance Taylor [Fri, 13 Nov 2020 19:05:37 +0000 (11:05 -0800)]
cmd/go: permit CGO_LDFLAGS to appear in //go:ldflag
For #42565
Fixes #42567
Change-Id: If7cf39905d124dbd54dfac6a53ee38270498efed
Reviewed-on: https://go-review.googlesource.com/c/go/+/269818
Trust: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>
(cherry picked from commit 782cf560db4c919790fdb476d1bbe18e5ddf5ffd)
Reviewed-on: https://go-review.googlesource.com/c/go/+/270137
Gbp-Pq: Name 0005-cmd-go-permit-CGO_LDFLAGS-to-appear-in-go-ldflag.patch
Xiangdong Ji [Wed, 5 Aug 2020 06:02:58 +0000 (06:02 +0000)]
cmd/dist: fix build failure of misc/cgo/test on arm64
Test7978 of misc/cgo/test fails in 'dist test' on arm64 if the C compiler
is of GCC-9.4 or above and its 'outline atomics' feature is enabled, since
the internal linking hasn't yet supported "__attribute__((constructor))"
and also mis-handles hidden visibility.
Two changes are made for 'misc/cgo/test' to fix the issue:
1. passing "-tags=internal" for the internal linking PIE case.
2. skipping Test7978 on arm64 for the internal linking cases.
This CL fixes 'dist test' failure only, user is expected to pass the option
'-mno-outline-atomics' via CGO_CFLAGS if running into the same problem when
building cgo program using internal linking.
YunQiang Su [Tue, 9 Jun 2020 04:09:58 +0000 (04:09 +0000)]
cmd/go, cmd/cgo: pass -mfp32 and -mhard/soft-float to MIPS GCC
For mips32 currently, we are using FP32, while the gcc may be FPXX,
which may generate .MIPS.abiflags and .gnu.attributes section with
value as FPXX. So the kernel will treat the exe as FPXX, and may
choose to use FR=1 FPU mode for it.
Currently, in Go, we use 2 lwc1 to load both half of a double value
to a pair of even-odd FPR. This behavior can only work with FR=0 mode.
In FR=1 mode, all of 32 FPR are 64bit. If we lwc1 the high-half of a double
value to an odd FPR, and try to use the previous even FPR to compute, the
real high-half of even FPR will be unpredicatable.
We set -mfp32 to force the gcc generate FP32 code and section value.
More details about FP32/FPXX/FP64 are explained in:
https://web.archive.org/web/20180828210612/https://dmz-portal.mips.com/wiki/MIPS_O32_ABI_-_FR0_and_FR1_Interlinking
When GOMIPS/GOMIPS64 is set as softfloat, we should also pass
-msoft-float to gcc.
Here we also add -mno-odd-spreg option, since Loongson's CPU cannot use
odd-number FR in FR=0 mode.
Shengjing Zhu [Tue, 17 Nov 2020 16:46:08 +0000 (16:46 +0000)]
golang-1.15 (1.15.5-2) unstable; urgency=medium
* Team upload.
* Backport patch to fix usability regression in go1.15.5
cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist
https://github.com/golang/go/issues/42567
Xiangdong Ji [Wed, 5 Aug 2020 06:02:58 +0000 (06:02 +0000)]
cmd/dist: fix build failure of misc/cgo/test on arm64
Test7978 of misc/cgo/test fails in 'dist test' on arm64 if the C compiler
is of GCC-9.4 or above and its 'outline atomics' feature is enabled, since
the internal linking hasn't yet supported "__attribute__((constructor))"
and also mis-handles hidden visibility.
Two changes are made for 'misc/cgo/test' to fix the issue:
1. passing "-tags=internal" for the internal linking PIE case.
2. skipping Test7978 on arm64 for the internal linking cases.
This CL fixes 'dist test' failure only, user is expected to pass the option
'-mno-outline-atomics' via CGO_CFLAGS if running into the same problem when
building cgo program using internal linking.
YunQiang Su [Tue, 9 Jun 2020 04:09:58 +0000 (04:09 +0000)]
cmd/go, cmd/cgo: pass -mfp32 and -mhard/soft-float to MIPS GCC
For mips32 currently, we are using FP32, while the gcc may be FPXX,
which may generate .MIPS.abiflags and .gnu.attributes section with
value as FPXX. So the kernel will treat the exe as FPXX, and may
choose to use FR=1 FPU mode for it.
Currently, in Go, we use 2 lwc1 to load both half of a double value
to a pair of even-odd FPR. This behavior can only work with FR=0 mode.
In FR=1 mode, all of 32 FPR are 64bit. If we lwc1 the high-half of a double
value to an odd FPR, and try to use the previous even FPR to compute, the
real high-half of even FPR will be unpredicatable.
We set -mfp32 to force the gcc generate FP32 code and section value.
More details about FP32/FPXX/FP64 are explained in:
https://web.archive.org/web/20180828210612/https://dmz-portal.mips.com/wiki/MIPS_O32_ABI_-_FR0_and_FR1_Interlinking
When GOMIPS/GOMIPS64 is set as softfloat, we should also pass
-msoft-float to gcc.
Here we also add -mno-odd-spreg option, since Loongson's CPU cannot use
odd-number FR in FR=0 mode.
cmd/go/internal/modload: suppress the 'go mod init' hint for GOROOT more aggressively
Previously, we suppressed a `to create a module there, run: … go mod
init' warning only if the config file itself (such as .git/config) was
found in GOROOT. However, our release tarballs don't include the
.git/config, so that case was not encountered, and the warning could
occur based on a config file found in some parent directory (outside
of GOROOT entirely).
Instead, skip the directory walk completely if the working directory
is anywhere in GOROOT.
Fixes #34191
Change-Id: I9f774901bfbb53b700407c4882f37d6339d023fe
Reviewed-on: https://go-review.googlesource.com/c/go/+/223340
Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com>
Gbp-Pq: Name 0003-Fix-FTBFS-on-HOME-managed-with-git.patch
cmd/go/internal/modload: suppress the 'go mod init' hint for GOROOT more aggressively
Previously, we suppressed a `to create a module there, run: … go mod
init' warning only if the config file itself (such as .git/config) was
found in GOROOT. However, our release tarballs don't include the
.git/config, so that case was not encountered, and the warning could
occur based on a config file found in some parent directory (outside
of GOROOT entirely).
Instead, skip the directory walk completely if the working directory
is anywhere in GOROOT.
Fixes #34191
Change-Id: I9f774901bfbb53b700407c4882f37d6339d023fe
Reviewed-on: https://go-review.googlesource.com/c/go/+/223340
Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com>
Gbp-Pq: Name 0003-Fix-FTBFS-on-HOME-managed-with-git.patch
* Increase the test timeout that made some builds succeed
there on slow hardware (such as emulated riscv64).
Thanks to Gianfranco Costamagna (Closes: #960759)
cmd/go/internal/modload: suppress the 'go mod init' hint for GOROOT more aggressively
Previously, we suppressed a `to create a module there, run: … go mod
init' warning only if the config file itself (such as .git/config) was
found in GOROOT. However, our release tarballs don't include the
.git/config, so that case was not encountered, and the warning could
occur based on a config file found in some parent directory (outside
of GOROOT entirely).
Instead, skip the directory walk completely if the working directory
is anywhere in GOROOT.
Fixes #34191
Change-Id: I9f774901bfbb53b700407c4882f37d6339d023fe
Reviewed-on: https://go-review.googlesource.com/c/go/+/223340
Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com>
Gbp-Pq: Name 0003-Fix-FTBFS-on-HOME-managed-with-git.patch
cmd/go/internal/modload: suppress the 'go mod init' hint for GOROOT more aggressively
Previously, we suppressed a `to create a module there, run: … go mod
init' warning only if the config file itself (such as .git/config) was
found in GOROOT. However, our release tarballs don't include the
.git/config, so that case was not encountered, and the warning could
occur based on a config file found in some parent directory (outside
of GOROOT entirely).
Instead, skip the directory walk completely if the working directory
is anywhere in GOROOT.
Fixes #34191
Change-Id: I9f774901bfbb53b700407c4882f37d6339d023fe
Reviewed-on: https://go-review.googlesource.com/c/go/+/223340
Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Jay Conrod <jayconrod@google.com>
Gbp-Pq: Name 0003-Fix-FTBFS-on-HOME-managed-with-git.patch
* Fix FTBFS if built twice in a row.
Some paths of autogenerated files have been changed upstream,
so that the removal of those files after the build did no
longer succeed.
Thanks to Guillem Jover (Closes: #953277)
* Update Standards-Version to 4.5.0, no changes needed
projects / golang-1.21.git / log