diff --git a/.gitignore b/.gitignore index 93d78ad..fbfd2ed 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ -go1.23.9-1-openssl-fips.tar.gz -go1.23.9.src.tar.gz +compiler-rt-18.1.8.src.tar.xz +go1.24.4-1-openssl-fips.tar.gz +go1.24.4.src.tar.gz diff --git a/fedora.go b/fedora.go index 81b28ba..60e460d 100644 --- a/fedora.go +++ b/fedora.go @@ -1,5 +1,10 @@ +//go:build rpm_crashtraceback // +build rpm_crashtraceback + +// Copyright 2017 The Fedora Project Contributors. All rights reserved. +// Use of this source code is governed by the MIT license. + package runtime func init() { diff --git a/golang.spec b/golang.spec index acd5000..a31752a 100644 --- a/golang.spec +++ b/golang.spec @@ -56,14 +56,14 @@ %endif # Build golang using external/internal(close to cgo disabled) linking. -%ifarch %{ix86} x86_64 ppc64le %{arm} aarch64 s390x +%ifarch %{ix86} x86_64 ppc64le %{arm} aarch64 s390x riscv64 %global external_linker 1 %else %global external_linker 0 %endif # Build golang with cgo enabled/disabled(later equals more or less to internal linking). -%ifarch %{ix86} x86_64 ppc64le %{arm} aarch64 s390x +%ifarch %{ix86} x86_64 ppc64le %{arm} aarch64 s390x riscv64 %global cgo_enabled 1 %else %global cgo_enabled 0 @@ -110,11 +110,14 @@ %ifarch s390x %global gohostarch s390x %endif +%ifarch riscv64 +%global gohostarch riscv64 +%endif -%global go_api 1.23 +%global go_api 1.24 # Use only for prerelease versions #global go_prerelease rc3 -%global go_patch 9 +%global go_patch 4 %global go_version %{go_api}%{?go_patch:.%{go_patch}}%{?go_prerelease:~%{go_prerelease}} %global go_source %{go_api}%{?go_patch:.%{go_patch}}%{?go_prerelease} # Go FIPS package release @@ -123,8 +126,11 @@ # For rpmdev-bumpspec and releng automation. %global baserelease 1 +# LLVM compiler-rt version for race detector +%global llvm_compiler_rt_version 18.1.8 + Name: golang -Version: %{go_version} +Version: %{go_version} Release: %autorelease Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -141,6 +147,7 @@ Source0: https://go.dev/dl/go%{go_source}.src.tar.gz Source1: https://github.com/golang-fips/go/archive/refs/tags/go%{go_source}-%{pkg_release}-openssl-fips.tar.gz # make possible to override default traceback level at build time by setting build tag rpm_crashtraceback Source2: fedora.go +Source3: https://github.com/llvm/llvm-project/releases/download/llvmorg-%{llvm_compiler_rt_version}/compiler-rt-%{llvm_compiler_rt_version}.src.tar.xz # The compiler is written in Go. Needs go(1.4+) compiler for build. %if !%{golang_bootstrap} @@ -173,29 +180,30 @@ BuildRequires: perl-interpreter, procps-ng %if 0%{?rhel} BuildRequires: perl %endif +# For building llvm address sanitizer for Go race detector +BuildRequires: libstdc++-devel +BuildRequires: clang Provides: go = %{version}-%{release} %if 0%{?fedora} # Bundled/Vendored provides generated by bundled-deps.sh based on the in tree module data -Provides: bundled(golang(github.com/google/pprof)) = 0.0.0.20240528025155.186aa0362fba -Provides: bundled(golang(github.com/ianlancetaylor/demangle)) = 0.0.0.20240312041847.bd984b5ce465 -Provides: bundled(golang(golang.org/x/arch)) = 0.8.0 -Provides: bundled(golang(golang.org/x/build)) = 0.0.0.20240603162849.5dfbda438323 -Provides: bundled(golang(golang.org/x/crypto)) = 0.23.1.0.20240603234054.0b431c7de36a -Provides: bundled(golang(golang.org/x/mod)) = 0.19.0 -Provides: bundled(golang(golang.org/x/net)) = 0.25.1.0.20250304182835.b70a9e3eaa27 -Provides: bundled(golang(golang.org/x/sync)) = 0.7.0 -Provides: bundled(golang(golang.org/x/sys)) = 0.22.0 -Provides: bundled(golang(golang.org/x/telemetry)) = 0.0.0.20240828213427.40b6b7fe7147 -Provides: bundled(golang(golang.org/x/term)) = 0.20.0 -Provides: bundled(golang(golang.org/x/text)) = 0.16.0 -Provides: bundled(golang(golang.org/x/tools)) = 0.22.1.0.20240618181713.f2d2ebe43e72 -Provides: bundled(golang(rsc.io/markdown)) = 0.0.0.20240306144322.0bf8f97ee8ef +Provides: bundled(golang(github.com/google/pprof)) = 0.0.0.20221118152302.e6195bd50e26 +Provides: bundled(golang(github.com/ianlancetaylor/demangle)) = 0.0.0.20220319035150.800ac71e25c2 +Provides: bundled(golang(golang.org/x/arch)) = 0.4.0 +Provides: bundled(golang(golang.org/x/crypto)) = 0.11.1.0.20230711161743.2e82bdd1719d +Provides: bundled(golang(golang.org/x/mod)) = 0.12.0 +Provides: bundled(golang(golang.org/x/net)) = 0.12.1.0.20230712162946.57553cbff163 +Provides: bundled(golang(golang.org/x/sync)) = 0.3.0 +Provides: bundled(golang(golang.org/x/sys)) = 0.10.0 +Provides: bundled(golang(golang.org/x/term)) = 0.10.0 +Provides: bundled(golang(golang.org/x/text)) = 0.11.0 +Provides: bundled(golang(golang.org/x/tools)) = 0.11.1.0.20230712164437.1ca21856af7b %endif Requires: %{name}-bin = %{version}-%{release} Requires: %{name}-src = %{version}-%{release} +Requires: %{name}-race = %{version}-%{release} Patch1: 0001-Modify-go.env.patch Patch6: 0006-Default-to-ld.bfd-on-ARM64.patch @@ -326,11 +334,21 @@ Requires: delve %description -n go-toolset This is the main package for go-toolset. +%package race +Summary: Race detetector library object files. +Requires: %{name} = %{version}-%{release} + +%description race +Binary library objects for Go's race detector. + + %prep %autosetup -p1 -n go # Copy fedora.go to ./src/runtime/ cp %{SOURCE2} ./src/runtime/ sed -i '1s/$/ (%{?rhel:Red Hat} %{version}-%{release})/' VERSION +# Delete the bundled race detector objects. +find ./src/runtime/race/ -name "race_*.syso" -exec rm {} \; # Delete the boring binary blob. We use the system OpenSSL instead. rm -rf src/crypto/internal/boring/syso @@ -372,6 +390,39 @@ uname -a cat /proc/cpuinfo cat /proc/meminfo +# Build race detector .syso's from llvm sources +# The race detector requests a -fno-exceptions build. +%global tsan_buildflags %(rpm -D 'toolchain clang' -E '%{optflags}' | sed 's/-fexceptions//') +%global tsan_optflag -O1 +mkdir ../llvm + +tar -xf %{SOURCE3} -C ../llvm +tsan_go_dir="../llvm/compiler-rt-%{llvm_compiler_rt_version}.src/lib/tsan/go" + +# The script uses uname -a and grep to set the GOARCH. This +# is unreliable and can get the wrong architecture in +# circumstances like cross-architecture emulation. We fix it +# by just reading GOARCH directly from Go. +export GOARCH=$(go env GOARCH) + +%ifarch x86_64 +pushd "${tsan_go_dir}" + CFLAGS="%{tsan_buildflags} %{tsan_optflag}" CC=clang GOAMD64=v3 ./buildgo.sh +popd +cp "${tsan_go_dir}"/race_linux_amd64.syso ./src/runtime/race/internal/amd64v3/race_linux.syso + +pushd "${tsan_go_dir}" + CFLAGS="%{tsan_buildflags} %{tsan_optflag}" CC=clang GOAMD64=v1 ./buildgo.sh +popd +cp "${tsan_go_dir}"/race_linux_amd64.syso ./src/runtime/race/internal/amd64v1/race_linux.syso + +%else +pushd "${tsan_go_dir}" + CFLAGS="%{tsan_buildflags} %{tsan_optflag}" CC=clang ./buildgo.sh +popd +cp "${tsan_go_dir}"/race_linux_%{gohostarch}.syso ./src/runtime/race/race_linux_%{gohostarch}.syso +%endif + # bootstrap compiler GOROOT %if !%{golang_bootstrap} export GOROOT_BOOTSTRAP=/ @@ -416,6 +467,8 @@ popd GOROOT=$(pwd) PATH=$(pwd)/bin:$PATH go install -buildmode=shared -v -x std %endif +GOROOT=$(pwd) PATH=$(pwd)/bin:$PATH go install -race std + %install rm -rf $RPM_BUILD_ROOT # remove GC build cache @@ -567,9 +620,9 @@ echo "=== Start testing ===" echo "=== Run all crypto test skipping tls ===" pushd crypto # run all crypto tests but skip tls, we will run fips specific tls tests later - go test $(go list ./... | grep -v tls) -v + go test $(go list ./... | grep -v tls) -v -skip="TestEd25519Vectors|TestACVP" # check that signature functions have parity between boring and notboring - CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v + CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v -skip="TestEd25519Vectors|TestACVP" popd echo "=== Run tls tests ===" # run all fips specific tls tests @@ -622,6 +675,12 @@ fi %{_sysconfdir}/prelink.conf.d %files src -f go-src.list +%ifarch x86_64 +%exclude %{goroot}/src/runtime/race/internal/amd64v1/race_linux.syso +%exclude %{goroot}/src/runtime/race/internal/amd64v3/race_linux.syso +%else +%exclude %{goroot}/src/runtime/race/race_linux_%{gohostarch}.syso +%endif %files docs -f go-docs.list @@ -642,11 +701,26 @@ fi %files -n go-toolset +%files race +%ifarch x86_64 +%{goroot}/src/runtime/race/internal/amd64v1/race_linux.syso +%{goroot}/src/runtime/race/internal/amd64v3/race_linux.syso +%else +%{goroot}/src/runtime/race/race_linux_%{gohostarch}.syso +%endif + %changelog -* Wed Jun 04 2025 Eduard Abdullin - 1.23.9-1.alma.1 +* Thu Jul 10 2025 Eduard Abdullin - 1.24.4-1.alma.1 - Update env var for v2 ## START: Generated by rpmautospec +* Tue Jul 01 2025 David Benoit - 1.24.4-1 +- Update to Go 1.24.4 + +* Thu Jun 12 2025 Archana - 1.23.10-1 +- Update to Go 1.23.10 - Fix for CVE-2025-4673, CVE-2025-0913, and + CVE-2025-22874 - Resolves: RHEL-95999 + * Thu May 29 2025 Alejandro Sáez - 1.23.9-1 - Update to Go 1.23.9 diff --git a/sources b/sources index e9a0e86..0b338ab 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ -SHA512 (go1.23.9-1-openssl-fips.tar.gz) = 6c8713bcdffa7d6a53d99d0ffcaa5936da25ac6d6254d92f7e93cf1ca8b2d235eaea74f1c732638ddabde1ace8fcf3e337629bc52e750712b0032633dc0a5c24 -SHA512 (go1.23.9.src.tar.gz) = 0f80680caabbf50a4f55555d0515530c55e297f38bf193a9da531e640f069719e3c7a5670b72f7629fada8162f978305ae1e4e6398369b8021cfe6dc9157254a +SHA512 (compiler-rt-18.1.8.src.tar.xz) = fb8795bd51c9b005c2ad1975591e9e2715740d6407ccad41379f136ef2e8d24ded8b97b01165a3ae4bd377119a6a1049ca05d3220404fc12bee86114ff2bff0d +SHA512 (go1.24.4-1-openssl-fips.tar.gz) = d62905d51090a99b20d294e5e23cf2c8d807e620309602364ad30379e65d13ef69ef82666be891f1743c46608a8aa1ab95121db92f38ae5a7b933d242fa7c582 +SHA512 (go1.24.4.src.tar.gz) = b785583fc53d62094b2de793a0e3281a26d2de17897a35b378fc2d13cb912ca473c37a7bae54a50660141809d5d0a70a97663d406cf30d7f0221ecbb5ffddec6