commit 1ca77e199081f40d4f4dcbb8999e53eff9cd5825 [browse]
Author: Sergey Matveev
Date: 2024-05-07 19:48:57 +03:00

Autogenerated TLS-related strings

go install golang.org/x/tools/cmd/stringer@latest
cd src/crypto/tls ; go generate

commit c488f8f36636ed7e279efce115a1034a18127d28 [browse]
Author: Sergey Matveev
Date: 2023-02-02 00:19:57 +03:00

GOST X.509 and TLS 1.3 support via GoGOST

commit adbfb672ba485630d75f8b5598228a63f4af08a4 [browse]
Author: Gopher Robot
Date: 2024-05-07 15:34:35 Z

[release-branch.go1.22] go1.22.3

Change-Id: Ie006d71637a9fa66c225f3fd6cb19dae2a403e76
Reviewed-on: https://go-review.googlesource.com/c/go/+/583856
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>

commit fa0292d252c762ff3de92b87d13417c50704f3a0 [browse]
Author: Roland Shoemaker
Date: 2024-04-25 13:09:54 -07:00

[release-branch.go1.22] cmd/go: disallow -lto_library in LDFLAGS

The darwin linker allows setting the LTO library with the -lto_library
flag. This wasn't caught by our "safe linker flags" check because it
was covered by the -lx flag used for linking libraries. This change
adds a specific check for excluded flags which otherwise satisfy our
existing checks.

Loading a mallicious LTO library would allow an attacker to cause the
linker to execute abritrary code when "go build" was called.

Thanks to Juho Forsén of Mattermost for reporting this issue.

Fixes #67119
Fixes #67122
Fixes CVE-2024-24787

Change-Id: I77ac8585efbdbdfd5f39c39ed623b9408a0f9eaf
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1380
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 9a79141fbbca1105e5c786f15e38741ca7843290)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1420
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/583796
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

commit 947e43e3711948aa3f4d2bbb55ae51ccf54e7638 [browse]
Author: Cherry Mui
Date: 2024-05-06 20:16:53 Z

[release-branch.go1.22] Revert "cmd/compile: don't combine loads in generated equality functions"

This reverts CL 583417.

Reason for revert: release branch is currently frozen.

Change-Id: Ia6223911e0e124f14509c4bf978d7e37688e3d4c
Reviewed-on: https://go-review.googlesource.com/c/go/+/582960
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>