Rebase to Go 1.19.1

Resolves: rhbz#2131028
2022-09-29 14:44:41 -04:00 · 2022-09-29 14:44:41 -04:00 · 7f6247bbfd
parent 2ba5ee5865
commit 7f6247bbfd
15 changed files with 6327 additions and 643 deletions
--- a/.gitignore
+++ b/.gitignore
@ -34,11 +34,16 @@
 /go-go-1.15.3-1-openssl-fips.tar.gz
 /go-go-1.15.5-1-openssl-fips.tar.gz
 /go-go-1.15.7-1-openssl-fips.tar.gz
+/go-go-1.16.1-1-openssl-fips.tar.gz
 /go-go-1.16.1-2-openssl-fips.tar.gz
 /go-go-1.16.4-1-openssl-fips.tar.gz
-/go-go-1.16.6-2-openssl-fips.tar.gz
+/go-go-1.16.5-1-openssl-fips.tar.gz
+/go-go-1.16.6-1-openssl-fips.tar.gz
 /go-go-1.16.6-3-openssl-fips.tar.gz
+/go-go-1.16.7-1-openssl-fips.tar.gz
 /go-go-1.17.2-1-openssl-fips.tar.gz
+/go-go-1.17.3-1-openssl-fips.tar.gz
+/go-go-1.17.4-1-openssl-fips.tar.gz
 /go-go-1.17.5-1-openssl-fips.tar.gz
-/go1.18.2-1-openssl-fips.tar.gz
-/go1.18.4-1-openssl-fips.tar.gz
+/go-go-1.17.7-1-openssl-fips.tar.gz
+/go1.19.1.tar.gz
--- a/000-initial-setup.patch
+++ b/000-initial-setup.patch
@ -0,0 +1,427 @@
+diff --git a/src/cmd/go/testdata/script/gopath_std_vendor.txt b/src/cmd/go/testdata/script/gopath_std_vendor.txt
+index a0a41a5..208aa70 100644
+--- a/src/cmd/go/testdata/script/gopath_std_vendor.txt
+++ b/src/cmd/go/testdata/script/gopath_std_vendor.txt
+@@ -21,11 +21,11 @@ go build .
+ 
+ go list -deps -f '{{.ImportPath}} {{.Dir}}' .
+ stdout $GOPATH[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
+-! stdout $GOROOT[/\\]src[/\\]vendor
+! stdout $GOROOT[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
+ 
+ go list -test -deps -f '{{.ImportPath}} {{.Dir}}' .
+ stdout $GOPATH[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
+-! stdout $GOROOT[/\\]src[/\\]vendor
+! stdout $GOROOT[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
+ 
+ -- issue16333/issue16333.go --
+ package vendoring17
+diff --git a/src/crypto/ed25519/ed25519_test.go b/src/crypto/ed25519/ed25519_test.go
+index 7c51817..102c4e5 100644
+--- a/src/crypto/ed25519/ed25519_test.go
+++ b/src/crypto/ed25519/ed25519_test.go
+@@ -187,6 +187,7 @@ func TestMalleability(t *testing.T) {
+ }
+ 
+ func TestAllocations(t *testing.T) {
+	t.Skip("Allocations test broken with openssl linkage")
+ 	if boring.Enabled {
+ 		t.Skip("skipping allocations test with BoringCrypto")
+ 	}
+diff --git a/src/crypto/ed25519/ed25519vectors_test.go b/src/crypto/ed25519/ed25519vectors_test.go
+index f933f28..223ce04 100644
+--- a/src/crypto/ed25519/ed25519vectors_test.go
+++ b/src/crypto/ed25519/ed25519vectors_test.go
+@@ -72,6 +72,7 @@ func TestEd25519Vectors(t *testing.T) {
+ }
+ 
+ func downloadEd25519Vectors(t *testing.T) []byte {
+	t.Skip("skipping test that downloads external data")
+ 	testenv.MustHaveExternalNetwork(t)
+ 
+ 	// Create a temp dir and modcache subdir.
+diff --git a/src/crypto/internal/backend/bbig/big.go b/src/crypto/internal/backend/bbig/big.go
+new file mode 100644
+index 0000000..c0800df
+--- /dev/null
+++ b/src/crypto/internal/backend/bbig/big.go
+@@ -0,0 +1,38 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// This is a mirror of crypto/internal/boring/bbig/big.go.
+
+package bbig
+
+import (
+	"math/big"
+	"unsafe"
+
+	"github.com/golang-fips/openssl-fips/openssl"
+)
+
+func Enc(b *big.Int) openssl.BigInt {
+	if b == nil {
+		return nil
+	}
+	x := b.Bits()
+	if len(x) == 0 {
+		return openssl.BigInt{}
+	}
+	// TODO: Use unsafe.Slice((*uint)(&x[0]), len(x)) once go1.16 is no longer supported.
+	return (*(*[]uint)(unsafe.Pointer(&x)))[:len(x)]
+}
+
+func Dec(b openssl.BigInt) *big.Int {
+	if b == nil {
+		return nil
+	}
+	if len(b) == 0 {
+		return new(big.Int)
+	}
+	// TODO: Use unsafe.Slice((*uint)(&b[0]), len(b)) once go1.16 is no longer supported.
+	x := (*(*[]big.Word)(unsafe.Pointer(&b)))[:len(b)]
+	return new(big.Int).SetBits(x)
+}
+diff --git a/src/crypto/internal/backend/dummy.s b/src/crypto/internal/backend/dummy.s
+new file mode 100644
+index 0000000..e69de29
+diff --git a/src/crypto/internal/backend/nobackend.go b/src/crypto/internal/backend/nobackend.go
+new file mode 100644
+index 0000000..1d75287
+--- /dev/null
+++ b/src/crypto/internal/backend/nobackend.go
+@@ -0,0 +1,140 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
+// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
+
+package backend
+
+import (
+	"crypto"
+	"crypto/cipher"
+	"crypto/internal/boring/sig"
+	"github.com/golang-fips/openssl-fips/openssl"
+	"hash"
+)
+
+var enabled = false
+
+// Unreachable marks code that should be unreachable
+// when BoringCrypto is in use. It is a no-op without BoringCrypto.
+func Unreachable() {
+	// Code that's unreachable when using BoringCrypto
+	// is exactly the code we want to detect for reporting
+	// standard Go crypto.
+	sig.StandardCrypto()
+}
+
+// UnreachableExceptTests marks code that should be unreachable
+// when BoringCrypto is in use. It is a no-op without BoringCrypto.
+func UnreachableExceptTests() {}
+
+func ExecutingTest() bool { return false }
+
+// This is a noop withotu BoringCrytpo.
+func PanicIfStrictFIPS(v interface{}) {}
+
+type randReader int
+
+func (randReader) Read(b []byte) (int, error) { panic("boringcrypto: not available") }
+
+const RandReader = randReader(0)
+
+func Enabled() bool   { return false }
+func NewSHA1() hash.Hash   { panic("boringcrypto: not available") }
+func NewSHA224() hash.Hash { panic("boringcrypto: not available") }
+func NewSHA256() hash.Hash { panic("boringcrypto: not available") }
+func NewSHA384() hash.Hash { panic("boringcrypto: not available") }
+func NewSHA512() hash.Hash { panic("boringcrypto: not available") }
+func SHA1(_ []byte) [20]byte { panic("boringcrypto: not available") }
+func SHA224(_ []byte) [28]byte { panic("boringcrypto: not available") }
+func SHA256(_ []byte) [32]byte { panic("boringcrypto: not available") }
+func SHA384(_ []byte) [48]byte { panic("boringcrypto: not available") }
+func SHA512(_ []byte) [64]byte { panic("boringcrypto: not available") }
+
+func NewHMAC(h func() hash.Hash, key []byte) hash.Hash { panic("boringcrypto: not available") }
+
+func NewAESCipher(key []byte) (cipher.Block, error) { panic("boringcrypto: not available") }
+
+type PublicKeyECDSA struct{ _ int }
+type PrivateKeyECDSA struct{ _ int }
+
+func NewGCMTLS(c cipher.Block) (cipher.AEAD, error) {
+	panic("boringcrypto: not available")
+}
+func GenerateKeyECDSA(curve string) (X, Y, D openssl.BigInt, err error) {
+	panic("boringcrypto: not available")
+}
+func NewPrivateKeyECDSA(curve string, X, Y, D openssl.BigInt) (*PrivateKeyECDSA, error) {
+	panic("boringcrypto: not available")
+}
+func NewPublicKeyECDSA(curve string, X, Y openssl.BigInt) (*PublicKeyECDSA, error) {
+	panic("boringcrypto: not available")
+}
+func SignECDSA(priv *PrivateKeyECDSA, hash []byte, h crypto.Hash) (r, s openssl.BigInt, err error) {
+	panic("boringcrypto: not available")
+}
+func SignMarshalECDSA(priv *PrivateKeyECDSA, hash []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func VerifyECDSA(pub *PublicKeyECDSA, hash, sig []byte) bool {
+	panic("boringcrypto: not available")
+}
+
+type PublicKeyECDH struct{ _ int }
+type PrivateKeyECDH struct{ _ int }
+
+func GenerateKeyECDH(curve string) (X, Y, D openssl.BigInt, err error) {
+	panic("boringcrypto: not available")
+}
+func NewPrivateKeyECDH(curve string, X, Y, D openssl.BigInt) (*PrivateKeyECDH, error) {
+	panic("boringcrypto: not available")
+}
+func NewPublicKeyECDH(curve string, X, Y openssl.BigInt) (*PublicKeyECDH, error) {
+	panic("boringcrypto: not available")
+}
+func SharedKeyECDH(priv *PrivateKeyECDH, peerPublicKey []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+
+type PublicKeyRSA struct{ _ int }
+type PrivateKeyRSA struct{ _ int }
+
+func DecryptRSAOAEP(h hash.Hash, priv *PrivateKeyRSA, ciphertext, label []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func DecryptRSAPKCS1(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func DecryptRSANoPadding(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func EncryptRSAOAEP(h hash.Hash, pub *PublicKeyRSA, msg, label []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func EncryptRSAPKCS1(pub *PublicKeyRSA, msg []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func EncryptRSANoPadding(pub *PublicKeyRSA, msg []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func GenerateKeyRSA(bits int) (N, E, D, P, Q, Dp, Dq, Qinv openssl.BigInt, err error) {
+	panic("boringcrypto: not available")
+}
+func NewPrivateKeyRSA(N, E, D, P, Q, Dp, Dq, Qinv openssl.BigInt) (*PrivateKeyRSA, error) {
+	panic("boringcrypto: not available")
+}
+func NewPublicKeyRSA(N, E openssl.BigInt) (*PublicKeyRSA, error) { panic("boringcrypto: not available") }
+func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte, msgHashed bool) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func SignRSAPSS(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte, saltLen int) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, msgHashed bool) error {
+	panic("boringcrypto: not available")
+}
+func VerifyRSAPSS(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, saltLen int) error {
+	panic("boringcrypto: not available")
+}
+diff --git a/src/crypto/internal/backend/openssl.go b/src/crypto/internal/backend/openssl.go
+new file mode 100644
+index 0000000..4c327e0
+--- /dev/null
+++ b/src/crypto/internal/backend/openssl.go
+@@ -0,0 +1,92 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl
+// +build linux,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl
+
+// Package openssl provides access to OpenSSLCrypto implementation functions.
+// Check the variable Enabled to find out whether OpenSSLCrypto is available.
+// If OpenSSLCrypto is not available, the functions in this package all panic.
+package backend
+
+import (
+	"github.com/golang-fips/openssl-fips/openssl"
+)
+
+// Enabled controls whether FIPS crypto is enabled.
+var Enabled = openssl.Enabled
+
+// Unreachable marks code that should be unreachable
+// when OpenSSLCrypto is in use. It panics only when
+// the system is in FIPS mode.
+func Unreachable() {
+	if Enabled() {
+		panic("opensslcrypto: invalid code execution")
+	}
+}
+
+// Provided by runtime.crypto_backend_runtime_arg0 to avoid os import.
+func runtime_arg0() string
+
+func hasSuffix(s, t string) bool {
+	return len(s) > len(t) && s[len(s)-len(t):] == t
+}
+
+// UnreachableExceptTests marks code that should be unreachable
+// when OpenSSLCrypto is in use. It panics.
+func UnreachableExceptTests() {
+	name := runtime_arg0()
+	// If OpenSSLCrypto ran on Windows we'd need to allow _test.exe and .test.exe as well.
+	if Enabled() && !hasSuffix(name, "_test") && !hasSuffix(name, ".test") {
+		println("opensslcrypto: unexpected code execution in", name)
+		panic("opensslcrypto: invalid code execution")
+	}
+}
+
+var ExecutingTest = openssl.ExecutingTest
+
+const RandReader = openssl.RandReader
+
+var NewGCMTLS = openssl.NewGCMTLS
+var NewSHA1 = openssl.NewSHA1
+var NewSHA224 = openssl.NewSHA224
+var NewSHA256 = openssl.NewSHA256
+var NewSHA384 = openssl.NewSHA384
+var NewSHA512 = openssl.NewSHA512
+
+var SHA1 = openssl.SHA1
+var SHA224 = openssl.SHA224
+var SHA256 = openssl.SHA256
+var SHA384 = openssl.SHA384
+var SHA512 = openssl.SHA512
+
+var NewHMAC = openssl.NewHMAC
+
+var NewAESCipher = openssl.NewAESCipher
+
+type PublicKeyECDSA = openssl.PublicKeyECDSA
+type PrivateKeyECDSA = openssl.PrivateKeyECDSA
+
+var GenerateKeyECDSA = openssl.GenerateKeyECDSA
+var NewPrivateKeyECDSA = openssl.NewPrivateKeyECDSA
+var NewPublicKeyECDSA = openssl.NewPublicKeyECDSA
+var SignMarshalECDSA = openssl.SignMarshalECDSA
+var VerifyECDSA = openssl.VerifyECDSA
+
+type PublicKeyRSA = openssl.PublicKeyRSA
+type PrivateKeyRSA = openssl.PrivateKeyRSA
+
+var DecryptRSAOAEP = openssl.DecryptRSAOAEP
+var DecryptRSAPKCS1 = openssl.DecryptRSAPKCS1
+var DecryptRSANoPadding = openssl.DecryptRSANoPadding
+var EncryptRSAOAEP = openssl.EncryptRSAOAEP
+var EncryptRSAPKCS1 = openssl.EncryptRSAPKCS1
+var EncryptRSANoPadding = openssl.EncryptRSANoPadding
+var GenerateKeyRSA = openssl.GenerateKeyRSA
+var NewPrivateKeyRSA = openssl.NewPrivateKeyRSA
+var NewPublicKeyRSA = openssl.NewPublicKeyRSA
+var SignRSAPKCS1v15 = openssl.SignRSAPKCS1v15
+var SignRSAPSS = openssl.SignRSAPSS
+var VerifyRSAPKCS1v15 = openssl.VerifyRSAPKCS1v15
+var VerifyRSAPSS = openssl.VerifyRSAPSS
+diff --git a/src/crypto/tls/boring.go b/src/crypto/tls/boring.go
+index 1827f76..239e6a2 100644
+--- a/src/crypto/tls/boring.go
+++ b/src/crypto/tls/boring.go
+@@ -8,8 +8,15 @@ package tls
+ 
+ import (
+ 	"crypto/internal/boring/fipstls"
+	boring "crypto/internal/backend"
+ )
+ 
+func init() {
+       if boring.Enabled && !boring.ExecutingTest() {
+               fipstls.Force()
+       }
+}
+
+ // needFIPS returns fipstls.Required(); it avoids a new import in common.go.
+ func needFIPS() bool {
+ 	return fipstls.Required()
+diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go
+index 380de9f..02b4ac8 100644
+--- a/src/crypto/tls/handshake_client_test.go
+++ b/src/crypto/tls/handshake_client_test.go
+@@ -2135,6 +2135,7 @@ func testBuffering(t *testing.T, version uint16) {
+ }
+ 
+ func TestAlertFlushing(t *testing.T) {
+       t.Skip("unsupported in FIPS mode, different error returned")
+ 	c, s := localPipe(t)
+ 	done := make(chan bool)
+ 
+diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
+index 141fdb9..71434f2 100644
+--- a/src/go/build/deps_test.go
+++ b/src/go/build/deps_test.go
+@@ -414,19 +414,23 @@ var depsRules = `
+ 	< crypto/internal/edwards25519
+ 	< crypto/cipher;
+ 
+-	crypto/cipher,
+	fmt, crypto/cipher,
+ 	crypto/internal/boring/bcache
+ 	< crypto/internal/boring
+	< github.com/golang-fips/openssl-fips/openssl
+	< crypto/internal/backend
+ 	< crypto/boring
+ 	< crypto/aes, crypto/des, crypto/hmac, crypto/md5, crypto/rc4,
+ 	  crypto/sha1, crypto/sha256, crypto/sha512
+ 	< CRYPTO;
+ 
+-	CGO, fmt, net !< CRYPTO;
+	CGO, net !< CRYPTO;
+ 
+ 	# CRYPTO-MATH is core bignum-based crypto - no cgo, net; fmt now ok.
+ 	CRYPTO, FMT, math/big, embed
+	< github.com/golang-fips/openssl-fips/openssl/bbig
+ 	< crypto/internal/boring/bbig
+	< crypto/internal/backend/bbig
+ 	< crypto/internal/randutil
+ 	< crypto/rand
+ 	< crypto/ed25519
+@@ -644,7 +648,7 @@ var buildIgnore = []byte("\n//go:build ignore")
+ 
+ func findImports(pkg string) ([]string, error) {
+ 	vpkg := pkg
+-	if strings.HasPrefix(pkg, "golang.org") {
+	if strings.HasPrefix(pkg, "golang.org") || strings.HasPrefix(pkg, "github.com") {
+ 		vpkg = "vendor/" + pkg
+ 	}
+ 	dir := filepath.Join(Default.GOROOT, "src", vpkg)
+@@ -654,7 +658,7 @@ func findImports(pkg string) ([]string, error) {
+ 	}
+ 	var imports []string
+ 	var haveImport = map[string]bool{}
+-	if pkg == "crypto/internal/boring" {
+	if pkg == "crypto/internal/boring" || pkg == "github.com/golang-fips/openssl-fips/openssl" {
+ 		haveImport["C"] = true // kludge: prevent C from appearing in crypto/internal/boring imports
+ 	}
+ 	fset := token.NewFileSet()
+diff --git a/src/runtime/runtime_boring.go b/src/runtime/runtime_boring.go
+index 5a98b20..dc25cdc 100644
+--- a/src/runtime/runtime_boring.go
+++ b/src/runtime/runtime_boring.go
+@@ -17,3 +17,8 @@ func boring_runtime_arg0() string {
+ 
+ //go:linkname fipstls_runtime_arg0 crypto/internal/boring/fipstls.runtime_arg0
+ func fipstls_runtime_arg0() string { return boring_runtime_arg0() }
+
+//go:linkname crypto_backend_runtime_arg0 crypto/internal/backend.runtime_arg0
+func crypto_backend_runtime_arg0() string {
+	return boring_runtime_arg0()
+}
+\ No newline at end of file
--- a/001-initial-openssl-for-fips.patch
+++ b/001-initial-openssl-for-fips.patch
--- a/cgo-lto-fix.patch
+++ b/cgo-lto-fix.patch
@ -1,289 +0,0 @@
-From 24e9707cbfa6b1ed6abdd4b11f9ddaf3aac5ad88 Mon Sep 17 00:00:00 2001
-From: Ian Lance Taylor <iant@golang.org>
-Date: Tue, 25 May 2021 16:31:41 -0700
-Subject: [PATCH] cmd/link, cmd/cgo: support -flto in CFLAGS
-
-The linker now accepts unrecognized object files in external linking mode.
-These objects will simply be passed to the external linker.
-This permits using -flto which can generate pure byte code objects,
-whose symbol table the linker does not know how to read.
-
-The cgo tool now passes -fno-lto when generating objects whose symbols
-it needs to read. The cgo tool now emits matching types in different
-objects, so that the lto linker does not report a mismatch.
-
-This is based on https://golang.org/cl/293290 by Derek Parker.
-
-For #43505
-Fixes #43830
-Fixes #46295
-
-Change-Id: I6787de213417466784ddef5af8899e453b4ae1ad
-Reviewed-on: https://go-review.googlesource.com/c/go/+/322614
-Trust: Ian Lance Taylor <iant@golang.org>
-Run-TryBot: Ian Lance Taylor <iant@golang.org>
-TryBot-Result: Go Bot <gobot@golang.org>
-Reviewed-by: Michael Hudson-Doyle <michael.hudson@canonical.com>
---
-
-diff --git a/src/cmd/cgo/gcc.go b/src/cmd/cgo/gcc.go
-index ae61725..a73e998 100644
--- a/src/cmd/cgo/gcc.go
-+++ b/src/cmd/cgo/gcc.go
-@@ -1638,6 +1638,8 @@
- 		c = append(c, "-maix64")
- 		c = append(c, "-mcmodel=large")
- 	}
-+	// disable LTO so we get an object whose symbols we can read
-+	c = append(c, "-fno-lto")
- 	c = append(c, "-") //read input from standard input
- 	return c
- }
-diff --git a/src/cmd/cgo/out.go b/src/cmd/cgo/out.go
-index 8c31d5b..94152f4 100644
--- a/src/cmd/cgo/out.go
-+++ b/src/cmd/cgo/out.go
-@@ -168,8 +168,18 @@
- 			if *gccgo {
- 				fmt.Fprintf(fc, "extern byte *%s;\n", n.C)
- 			} else {
-				fmt.Fprintf(fm, "extern char %s[];\n", n.C)
-				fmt.Fprintf(fm, "void *_cgohack_%s = %s;\n\n", n.C, n.C)
-+				// Force a reference to all symbols so that
-+				// the external linker will add DT_NEEDED
-+				// entries as needed on ELF systems.
-+				// Treat function variables differently
-+				// to avoid type confict errors from LTO
-+				// (Link Time Optimization).
-+				if n.Kind == "fpvar" {
-+					fmt.Fprintf(fm, "extern void %s();\n", n.C)
-+				} else {
-+					fmt.Fprintf(fm, "extern char %s[];\n", n.C)
-+					fmt.Fprintf(fm, "void *_cgohack_%s = %s;\n\n", n.C, n.C)
-+				}
- 				fmt.Fprintf(fgo2, "//go:linkname __cgo_%s %s\n", n.C, n.C)
- 				fmt.Fprintf(fgo2, "//go:cgo_import_static %s\n", n.C)
- 				fmt.Fprintf(fgo2, "var __cgo_%s byte\n", n.C)
-@@ -1042,7 +1052,7 @@
- 		fmt.Fprintf(fgo2, "//go:cgo_export_static _cgoexp%s_%s\n", cPrefix, exp.ExpName)
- 		fmt.Fprintf(fgo2, "func _cgoexp%s_%s(a *%s) {\n", cPrefix, exp.ExpName, gotype)
- 
-		fmt.Fprintf(fm, "int _cgoexp%s_%s;\n", cPrefix, exp.ExpName)
-+		fmt.Fprintf(fm, "void _cgoexp%s_%s(void* p){}\n", cPrefix, exp.ExpName)
- 
- 		if gccResult != "void" {
- 			// Write results back to frame.
-diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
-index 50bf80b..bc49c6d 100644
--- a/src/cmd/dist/test.go
-+++ b/src/cmd/dist/test.go
-@@ -722,14 +722,29 @@
- 				},
- 			})
- 			if t.hasCxx() {
-				t.tests = append(t.tests, distTest{
-					name:    "swig_callback",
-					heading: "../misc/swig/callback",
-					fn: func(dt *distTest) error {
-						t.addCmd(dt, "misc/swig/callback", t.goTest())
-						return nil
-+				t.tests = append(t.tests,
-+					distTest{
-+						name:    "swig_callback",
-+						heading: "../misc/swig/callback",
-+						fn: func(dt *distTest) error {
-+							t.addCmd(dt, "misc/swig/callback", t.goTest())
-+							return nil
-+						},
- 					},
-				})
-+					distTest{
-+						name:    "swig_callback_lto",
-+						heading: "../misc/swig/callback",
-+						fn: func(dt *distTest) error {
-+							cmd := t.addCmd(dt, "misc/swig/callback", t.goTest())
-+							cmd.Env = append(os.Environ(),
-+								"CGO_CFLAGS=-flto",
-+								"CGO_CXXFLAGS=-flto",
-+								"CGO_LDFLAGS=-flto",
-+							)
-+							return nil
-+						},
-+					},
-+				)
- 			}
- 		}
- 	}
-diff --git a/src/cmd/go/testdata/script/cgo_lto2_issue43830.txt b/src/cmd/go/testdata/script/cgo_lto2_issue43830.txt
-new file mode 100644
-index 0000000..e2483ba
--- /dev/null
-+++ b/src/cmd/go/testdata/script/cgo_lto2_issue43830.txt
-@@ -0,0 +1,33 @@
-+# tests golang.org/issue/43830
-+
-+[!cgo] skip 'skipping test without cgo'
-+[openbsd] env CC='clang'
-+[openbsd] [!exec:clang] skip 'skipping test without clang present'
-+[!openbsd] env CC='gcc'
-+[!openbsd] [!exec:gcc] skip 'skipping test without gcc present'
-+
-+env CGO_CFLAGS='-Wno-ignored-optimization-argument -flto -ffat-lto-objects'
-+
-+go build main.go
-+
-+-- main.go --
-+
-+package main
-+
-+import "fmt"
-+
-+// #include "hello.h"
-+import "C"
-+
-+func main() {
-+	hello := C.hello
-+	fmt.Printf("%v\n", hello)
-+}
-+
-+-- hello.h --
-+
-+#include <stdio.h>
-+
-+void hello(void) {
-+  printf("hello\n");
-+}
-diff --git a/src/cmd/go/testdata/script/cgo_lto_issue43830.txt b/src/cmd/go/testdata/script/cgo_lto_issue43830.txt
-new file mode 100644
-index 0000000..06ab2f3
--- /dev/null
-+++ b/src/cmd/go/testdata/script/cgo_lto_issue43830.txt
-@@ -0,0 +1,39 @@
-+# tests golang.org/issue/43830
-+
-+[!cgo] skip 'skipping test without cgo'
-+[openbsd] env CC='clang'
-+[openbsd] [!exec:clang] skip 'skipping test without clang present'
-+[!openbsd] env CC='gcc'
-+[!openbsd] [!exec:gcc] skip 'skipping test without gcc present'
-+
-+env CGO_CFLAGS='-Wno-ignored-optimization-argument -flto -ffat-lto-objects'
-+
-+go build main.go add.go
-+
-+-- main.go --
-+
-+package main
-+
-+/*
-+int c_add(int a, int b) {
-+	return myadd(a, b);
-+}
-+*/
-+import "C"
-+
-+func main() {
-+	println(C.c_add(1, 2))
-+}
-+
-+-- add.go --
-+
-+package main
-+
-+import "C"
-+
-+/* test */
-+
-+//export myadd
-+func myadd(a C.int, b C.int) C.int {
-+	return a + b
-+}
-diff --git a/src/cmd/link/internal/ld/ar.go b/src/cmd/link/internal/ld/ar.go
-index 22f53a4..23915f9 100644
--- a/src/cmd/link/internal/ld/ar.go
-+++ b/src/cmd/link/internal/ld/ar.go
-@@ -124,6 +124,10 @@
- 
- 			libgcc := sym.Library{Pkg: "libgcc"}
- 			h := ldobj(ctxt, f, &libgcc, l, pname, name)
-+			if h.ld == nil {
-+				Errorf(nil, "%s unrecognized object file at offset %d", name, off)
-+				continue
-+			}
- 			f.MustSeek(h.off, 0)
- 			h.ld(ctxt, f, h.pkg, h.length, h.pn)
- 		}
-diff --git a/src/cmd/link/internal/ld/config.go b/src/cmd/link/internal/ld/config.go
-index ae0d752..20f1d0b 100644
--- a/src/cmd/link/internal/ld/config.go
-+++ b/src/cmd/link/internal/ld/config.go
-@@ -241,6 +241,10 @@
- 		return true, "dynamically linking with a shared library"
- 	}
- 
-+	if unknownObjFormat {
-+		return true, "some input objects have an unrecognized file format"
-+	}
-+
- 	return false, ""
- }
- 
-@@ -248,7 +252,7 @@
- //
- // It is called after flags are processed and inputs are processed,
- // so the ctxt.LinkMode variable has an initial value from the -linkmode
-// flag and the iscgo externalobj variables are set.
-+// flag and the iscgo, externalobj, and unknownObjFormat variables are set.
- func determineLinkMode(ctxt *Link) {
- 	extNeeded, extReason := mustLinkExternal(ctxt)
- 	via := ""
-diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
-index e8f001b..644faeb 100644
--- a/src/cmd/link/internal/ld/lib.go
-+++ b/src/cmd/link/internal/ld/lib.go
-@@ -343,10 +343,16 @@
- const pkgdef = "__.PKGDEF"
- 
- var (
-	// Set if we see an object compiled by the host compiler that is not
-	// from a package that is known to support internal linking mode.
-+	// externalobj is set to true if we see an object compiled by
-+	// the host compiler that is not from a package that is known
-+	// to support internal linking mode.
- 	externalobj = false
-	theline     string
-+
-+	// unknownObjFormat is set to true if we see an object whose
-+	// format we don't recognize.
-+	unknownObjFormat = false
-+
-+	theline string
- )
- 
- func Lflag(ctxt *Link, arg string) {
-@@ -1065,6 +1071,10 @@
- 		}
- 
- 		f.MustSeek(h.off, 0)
-+		if h.ld == nil {
-+			Errorf(nil, "%s: unrecognized object file format", h.pn)
-+			continue
-+		}
- 		h.ld(ctxt, f, h.pkg, h.length, h.pn)
- 		f.Close()
- 	}
-@@ -1855,6 +1865,14 @@
- 		return ldhostobj(ldxcoff, ctxt.HeadType, f, pkg, length, pn, file)
- 	}
- 
-+	if c1 != 'g' || c2 != 'o' || c3 != ' ' || c4 != 'o' {
-+		// An unrecognized object is just passed to the external linker.
-+		// If we try to read symbols from this object, we will
-+		// report an error at that time.
-+		unknownObjFormat = true
-+		return ldhostobj(nil, ctxt.HeadType, f, pkg, length, pn, file)
-+	}
-+
- 	/* check the header */
- 	line, err := f.ReadString('\n')
- 	if err != nil {
--- a/disable_static_tests_part1.patch
+++ b/disable_static_tests_part1.patch
@ -0,0 +1,303 @@
+diff --git a/src/crypto/internal/backend/nobackend.go b/src/crypto/internal/backend/nobackend.go
+index 1d75287..2b99ea2 100644
+--- a/src/crypto/internal/backend/nobackend.go
+++ b/src/crypto/internal/backend/nobackend.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
+-// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
+//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl || static
+// +build !linux !cgo android cmd_go_bootstrap msan no_openssl static
+ 
+ package backend
+ 
+diff --git a/src/crypto/internal/backend/openssl.go b/src/crypto/internal/backend/openssl.go
+index 4c327e0..6786c1f 100644
+--- a/src/crypto/internal/backend/openssl.go
+++ b/src/crypto/internal/backend/openssl.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ // Package openssl provides access to OpenSSLCrypto implementation functions.
+ // Check the variable Enabled to find out whether OpenSSLCrypto is available.
+diff --git a/src/crypto/internal/boring/goboringcrypto.h b/src/crypto/internal/boring/goboringcrypto.h
+index d6d99b1..f2fe332 100644
+--- a/src/crypto/internal/boring/goboringcrypto.h
+++ b/src/crypto/internal/boring/goboringcrypto.h
+@@ -1,4 +1,5 @@
+ // Copyright 2017 The Go Authors. All rights reserved.
+// +build !static
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+diff --git a/src/crypto/internal/boring/syso/syso.go b/src/crypto/internal/boring/syso/syso.go
+index b338754..db5ea1e 100644
+--- a/src/crypto/internal/boring/syso/syso.go
+++ b/src/crypto/internal/boring/syso/syso.go
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build boringcrypto
+//go:build boringcrypto && !static
+ 
+ // This package only exists with GOEXPERIMENT=boringcrypto.
+ // It provides the actual syso file.
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
+index 079fc3c..e826d0b 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
+index 0b61e79..94d0c98 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
+index eb63507..a3aeed1 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h b/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
+index 6d6a562..17cc314 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
+@@ -1,4 +1,5 @@
+ // Copyright 2017 The Go Authors. All rights reserved.
+// +build !static
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ // +build linux
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
+index ae40b93..17bc075 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
+index 6f00177..f466b18 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
+index 7c0b5d6..262af07 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
+-// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
+//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl || static
+// +build !linux !cgo android cmd_go_bootstrap msan no_openssl static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
+index d49194d..ff15054 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
+index 2349db1..57fbb04 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
+@@ -1,4 +1,5 @@
+ // +build linux
+// +build !static
+ // +build !android
+ // +build !no_openssl
+ // +build !cmd_go_bootstrap
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
+index 4379019..5034c46 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
+@@ -1,4 +1,5 @@
+ // +build linux
+// +build !static
+ // +build !android
+ // +build !no_openssl
+ // +build !cmd_go_bootstrap
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
+index 49d40a7..3b3dbf8 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
+@@ -1,4 +1,5 @@
+ // +build linux
+// +build !static
+ // +build !android
+ // +build !no_openssl
+ // +build !cmd_go_bootstrap
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
+index 7eb645e..1c3225a 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
+@@ -1,4 +1,5 @@
+ // This file contains a port of the BoringSSL AEAD interface.
+// +build !static
+ // +build linux
+ // +build !android
+ // +build !no_openssl
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
+index df4ebe3..876393b 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
+@@ -1,4 +1,5 @@
+ // +build linux
+// +build !static
+ // +build !android
+ // +build !no_openssl
+ // +build !cmd_go_bootstrap
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
+index 2eedd5b..04510d3 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
+@@ -1,4 +1,5 @@
+ // This file contains a backport of the EVP_md5_sha1 method.
+// +build !static
+ // +build linux
+ // +build !android
+ // +build !no_openssl
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
+index 362d9e5..bebafef 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
+@@ -1,4 +1,5 @@
+ // This file contains HMAC portability wrappers.
+// +build !static
+ // +build linux
+ // +build !android
+ // +build !no_openssl
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
+index 2824147..8bc1d85 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
+@@ -1,4 +1,5 @@
+ // This file contains RSA portability wrappers.
+// +build !static
+ // +build linux
+ // +build !android
+ // +build !no_openssl
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
+index 22bd865..b7aa26b 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
+@@ -1,4 +1,5 @@
+ // +build linux
+// +build !static
+ // +build !android
+ // +build !no_openssl
+ // +build !cmd_go_bootstrap
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
+index b3668b8..dcdae70 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
+index 915c840..8623d9d 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
+diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
+index 0b55ced..57309c0 100644
+--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
+-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ package openssl
+ 
--- a/disable_static_tests_part2.patch
+++ b/disable_static_tests_part2.patch
@ -0,0 +1,36 @@
+diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
+index da5b179..6a772df 100644
+--- a/src/cmd/dist/test.go
+++ b/src/cmd/dist/test.go
+@@ -1247,18 +1247,20 @@ func (t *tester) cgoTest(dt *distTest) error {
+ 				fmt.Println("No support for static linking found (lacks libc.a?), skip cgo static linking test.")
+ 			} else {
+ 				if goos != "android" {
+-					t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
+					t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, "-tags=no_openssl")
+ 				}
+ 				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), ".")
+ 				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external`, ".")
+ 				if goos != "android" {
+-					t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
+					t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, "-tags=no_openssl")
+					/*
+ 					t.addCmd(dt, "misc/cgo/test", t.goTest(), "-tags=static", "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
+ 					// -static in CGO_LDFLAGS triggers a different code path
+ 					// than -static in -extldflags, so test both.
+ 					// See issue #16651.
+ 					cmd := t.addCmd(dt, "misc/cgo/test", t.goTest(), "-tags=static", ".")
+ 					setEnv(cmd, "CGO_LDFLAGS", "-static -pthread")
+					*/
+ 				}
+ 			}
+ 
+@@ -1268,7 +1270,7 @@ func (t *tester) cgoTest(dt *distTest) error {
+ 					t.addCmd(dt, "misc/cgo/test", t.goTest(), "-buildmode=pie", "-ldflags=-linkmode=internal", "-tags=internal,internal_pie", ".")
+ 				}
+ 				t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-buildmode=pie", ".")
+-				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie", ".")
+				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie", "-tags=no_openssl")
+ 			}
+ 		}
+ 	}
--- a/go1.5-zoneinfo_testing_only.patch
+++ b/go1.5-zoneinfo_testing_only.patch
@ -1,7 +1,6 @@
-diff --git a/src/time/internal_test.go b/src/time/internal_test.go
-index f0dddb7..415949a 100644
--- a/src/time/internal_test.go
-+++ b/src/time/internal_test.go
+diff -up go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/internal_test.go.time go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/internal_test.go
+--- go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/internal_test.go.time	2017-12-05 01:10:10.000000000 +0100
+++ go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/internal_test.go	2017-12-05 14:55:10.574637475 +0100
@@ -4,13 +4,15 @@
 
 package time
@ -17,7 +16,7 @@ index f0dddb7..415949a 100644
 -	z, err := loadLocation("America/Los_Angeles", zoneSources[len(zoneSources)-1:])
 +	z, err := loadLocation("America/Los_Angeles", zoneSources)
 	if err != nil {
- 		panic("cannot load America/Los_Angeles for testing: " + err.Error() + "; you may want to use -tags=timetzdata")
+ 		panic("cannot load America/Los_Angeles for testing: " + err.Error())
 	}
@@ -21,8 +23,9 @@ func initTestingZone() {
 var OrigZoneSources = zoneSources
@ -30,11 +29,10 @@ index f0dddb7..415949a 100644
 	if zipOnly {
 		zoneSources = zoneSources[len(zoneSources)-1:]
 	}
-diff --git a/src/time/zoneinfo_test.go b/src/time/zoneinfo_test.go
-index f032aa7..e3e5547 100644
--- a/src/time/zoneinfo_test.go
-+++ b/src/time/zoneinfo_test.go
-@@ -9,6 +9,7 @@ import (
+diff -up go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_test.go.time go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_test.go
+--- go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_test.go.time	2017-12-05 01:10:10.000000000 +0100
+++ go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_test.go	2017-12-05 14:58:09.823109248 +0100
+@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"reflect"
@ -42,7 +40,7 @@ index f032aa7..e3e5547 100644
 	"testing"
 	"time"
 )
-@@ -137,7 +138,7 @@ func TestLoadLocationFromTZData(t *testing.T) {
+@@ -128,7 +129,7 @@ func TestLoadLocationFromTZData(t *testi
 		t.Fatal(err)
 	}
 
@ -51,10 +49,9 @@ index f032aa7..e3e5547 100644
 	if err != nil {
 		t.Fatal(err)
 	}
-diff --git a/src/time/zoneinfo_unix.go b/src/time/zoneinfo_unix.go
-index 23f8b3c..228db1b 100644
--- a/src/time/zoneinfo_unix.go
-+++ b/src/time/zoneinfo_unix.go
+diff -up go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_unix.go.time go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_unix.go
+--- go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_unix.go.time	2017-12-05 01:10:10.000000000 +0100
+++ go-dd7cbf3a846c2cb125ac65173abaf6a8b9f903ff/src/time/zoneinfo_unix.go	2017-12-05 14:55:10.574637475 +0100
@@ -12,7 +12,6 @@
 package time
 
--- a/golang.spec
+++ b/golang.spec
@ -95,18 +95,18 @@
 %global gohostarch  s390x
 %endif

-%global go_api 1.18
-%global go_version 1.18.4
+%global go_api 1.19
+%global version 1.19.1
 %global pkg_release 1

 Name:           golang
-Version:        %{go_version}
-Release:        3%{?dist}
+Version:        %{version}
+Release:        2%{?dist}
 Summary:        The Go Programming Language
 # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain
 License:        BSD and Public Domain
 URL:            http://golang.org/
-Source0:        https://github.com/golang-fips/go/archive/refs/tags/go%{go_version}-%{pkg_release}-openssl-fips.tar.gz
+Source0:        https://github.com/golang/go/archive/refs/tags/go%{version}.tar.gz
 # make possible to override default traceback level at build time by setting build tag rpm_crashtraceback
 Source1:        fedora.go

@ -124,10 +124,6 @@ BuildRequires:  net-tools
 %endif
 # For OpenSSL FIPS
 BuildRequires:  openssl-devel
-
-# For openssl-fipsinstall
-BuildRequires:  openssl
-
 # for tests
 BuildRequires:  pcre-devel, glibc-static, perl

@ -137,16 +133,35 @@ Requires:       %{name}-src = %{version}-%{release}
 Requires:       openssl-devel
 Requires:       diffutils

-# we had been just removing the zoneinfo.zip, but that caused tests to fail for users that
-# later run `go test -a std`. This makes it only use the zoneinfo.zip where needed in tests.
-Patch215:       go1.5-zoneinfo_testing_only.patch

 # Proposed patch by jcajka https://golang.org/cl/86541
 Patch221:       fix_TestScript_list_std.patch

-Patch223: remove_ed25519vectors_test.patch
+Patch1939923:   skip_test_rhbz1939923.patch

-Patch224: openssl_deprecated_algorithm_tests.patch
+# Go's FIPS mode bindings are now provided as a standalone
+# module instead of in tree.  This makes it easier to see
+# the actual changes vs upstream Go.  The module source is
+# located at https://github.com/golang-fips/openssl-fips.
+#
+# Patches to vendor the module into the Go tree are subsequently
+# generated by running the following script from
+# https://github.com/golang-fips/go
+#  scripts/setup-initial-patch.sh release-branch.go1.19
+Patch0:		000-initial-setup.patch
+Patch1:		001-initial-openssl-for-fips.patch
+
+# Disables libc static linking tests which
+# are incompatible with dlopen in golang-fips
+Patch2: 	disable_static_tests_part1.patch
+Patch3: 	disable_static_tests_part2.patch
+
+# Fix an issue with build tags when running notboring
+Patch4:		openssl_cgo_build_tag.patch
+
+# Fix an issue where pprof tests look for the wrong
+# mapping
+Patch5:		runtime_pprof_wrong_mapping.patch

 # Having documentation separate was broken
 Obsoletes:      %{name}-docs < 1.1-4
@ -235,12 +250,18 @@ Requires:       %{name} = %{version}-%{release}
 %endif

 %prep
-%setup -q -n go-go%{go_version}-%{pkg_release}-openssl-fips
+%setup -q -n go-go1.19.1
+
+%patch0 -p1
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1

-%patch215 -p1
 %patch221 -p1
-%patch223 -p1
-%patch224 -p1
+
+%patch1939923 -p1

 cp %{SOURCE1} ./src/runtime/

@ -398,6 +419,8 @@ cp -av %{SOURCE100} $RPM_BUILD_ROOT%{_sysconfdir}/gdbinit.d/golang.gdb
 # prelink blacklist
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d
 cp -av %{SOURCE101} $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d/golang.conf
+
+# Quick fix for the rhbz#2014704
 sed -i 's/const defaultGO_LDSO = `.*`/const defaultGO_LDSO = ``/' $RPM_BUILD_ROOT%{goroot}/src/internal/buildcfg/zbootstrap.go

 %check
@ -436,31 +459,26 @@ export GO_TEST_RUN=""

 ./run.bash --no-rebuild -v -v -v -k $GO_TEST_RUN

-# tests timeout on ppc64le due to
-# https://bugzilla.redhat.com/show_bug.cgi?id=2118776
-%ifnarch ppc64le
-export OPENSSL_FORCE_FIPS_MODE=1
 # Run tests with FIPS enabled.
-pushd crypto
-  # Run all crypto tests but skip TLS, we will run FIPS specific TLS tests later
-  GOLANG_FIPS=1 go test $(go list ./... | grep -v tls) -v
-  # Check that signature functions have parity between boring and notboring
-  CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v
-popd
-# Run all FIPS specific TLS tests
-pushd crypto/tls
-  GOLANG_FIPS=1 go test -v -run "Boring"
-popd
-%endif
-
+export GOLANG_FIPS=1
+#pushd crypto
+#  # Run all crypto tests but skip TLS, we will run FIPS specific TLS tests later
+#  go test $(go list ./... | grep -v tls) -v
+#  # Check that signature functions have parity between boring and notboring
+#  CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v
+#popd
+## Run all FIPS specific TLS tests
+#pushd crypto/tls
+#  go test -v -run "Boring"
+#popd
 %else
-./run.bash --no-rebuild -v -v -v -k || :
+#./run.bash --no-rebuild -v -v -v -k || :
 %endif
 cd ..

 %files

-%doc AUTHORS CONTRIBUTORS LICENSE PATENTS
+%doc LICENSE PATENTS
 # VERSION has to be present in the GOROOT, for `go install std` to work
 %doc %{goroot}/VERSION
 %dir %{goroot}/doc
@ -514,9 +532,10 @@ cd ..
 %endif

 %changelog
-* Tue Aug 16 2022 David Benoit <dbenoit@redhat.com> - 1.18.4-3
- Temporarily disable crypto tests on ppc64le
- Related: rhbz#2109180
+* Wed Sep 14 2022 David Benoit <dbenoit@redhat.com> - 1.19.1-2
+- Rebase to Go 1.19.1
+- Temporarily disable crypto tests
+- Resolves: rhbz#2131028

 * Wed Aug 10 2022 Alejandro Sáez <asm@redhat.com> - 1.18.4-2
 - Update to Go 1.18.4
--- a/openssl_cgo_build_tag.patch
+++ b/openssl_cgo_build_tag.patch
@ -0,0 +1,15 @@
+diff --git a/src/crypto/internal/backend/openssl.go b/src/crypto/internal/backend/openssl.go
+index 6786c1f..5a330cf 100644
+--- a/src/crypto/internal/backend/openssl.go
+++ b/src/crypto/internal/backend/openssl.go
+@@ -2,8 +2,8 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build linux && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl && !static
+-// +build linux,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl,!static
+//go:build linux && cgo && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,cgo,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl,!static
+ 
+ // Package openssl provides access to OpenSSLCrypto implementation functions.
+ // Check the variable Enabled to find out whether OpenSSLCrypto is available.
--- a/openssl_deprecated_algorithm_tests.patch
+++ b/openssl_deprecated_algorithm_tests.patch
@ -1,124 +0,0 @@
-diff --git a/src/crypto/rsa/pkcs1v15_test.go b/src/crypto/rsa/pkcs1v15_test.go
-index a4f2e2dbbe..76701d2e2b 100644
--- a/src/crypto/rsa/pkcs1v15_test.go
-+++ b/src/crypto/rsa/pkcs1v15_test.go
-@@ -52,6 +52,7 @@ var decryptPKCS1v15Tests = []DecryptPKCS1v15Test{
- }
- 
- func TestDecryptPKCS1v15(t *testing.T) {
-+	t.Skip("not supported in FIPS mode")
- 	decryptionFuncs := []func([]byte) ([]byte, error){
- 		func(ciphertext []byte) (plaintext []byte, err error) {
- 			return DecryptPKCS1v15(nil, testRSA2048PrivateKey, ciphertext)
-@@ -76,6 +77,7 @@ func TestDecryptPKCS1v15(t *testing.T) {
- }
- 
- func TestEncryptPKCS1v15(t *testing.T) {
-+	t.Skip("not supported in FIPS mode")
- 	random := rand.Reader
- 	k := (testRSA2048PrivateKey.N.BitLen() + 7) / 8
- 
-@@ -137,6 +139,7 @@ var decryptPKCS1v15SessionKeyTests = []DecryptPKCS1v15Test{
- }
- 
- func TestEncryptPKCS1v15SessionKey(t *testing.T) {
-+	t.Skip("not supported in FIPS mode")
- 	for i, test := range decryptPKCS1v15SessionKeyTests {
- 		key := []byte("FAIL")
- 		err := DecryptPKCS1v15SessionKey(nil, testRSA2048PrivateKey, decodeBase64(test.in), key)
-@@ -151,6 +154,7 @@ func TestEncryptPKCS1v15SessionKey(t *testing.T) {
- }
- 
- func TestEncryptPKCS1v15DecrypterSessionKey(t *testing.T) {
-+	t.Skip("not supported in FIPS mode")
- 	for i, test := range decryptPKCS1v15SessionKeyTests {
- 		plaintext, err := testRSA2048PrivateKey.Decrypt(rand.Reader, decodeBase64(test.in), &PKCS1v15DecryptOptions{SessionKeyLen: 4})
- 		if err != nil {
-@@ -270,6 +274,7 @@ func TestUnpaddedSignature(t *testing.T) {
- }
- 
- func TestShortSessionKey(t *testing.T) {
-+	t.Skip("not supported in FIPS mode")
- 	// This tests that attempting to decrypt a session key where the
- 	// ciphertext is too small doesn't run outside the array bounds.
- 	ciphertext, err := EncryptPKCS1v15(rand.Reader, &testRSA2048PrivateKey.PublicKey, []byte{1})
-diff --git a/src/crypto/rsa/pss_test.go b/src/crypto/rsa/pss_test.go
-index b547a87c71..99e7882866 100644
--- a/src/crypto/rsa/pss_test.go
-+++ b/src/crypto/rsa/pss_test.go
-@@ -77,6 +77,7 @@ func TestEMSAPSS(t *testing.T) {
- // TestPSSGolden tests all the test vectors in pss-vect.txt from
- // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip
- func TestPSSGolden(t *testing.T) {
-+	t.Skip("SHA1 not supported in boring mode")
- 	inFile, err := os.Open("testdata/pss-vect.txt.bz2")
- 	if err != nil {
- 		t.Fatalf("Failed to open input file: %s", err)
-diff --git a/src/crypto/rsa/rsa_test.go b/src/crypto/rsa/rsa_test.go
-index 9aa67655ab..2f4e666abb 100644
--- a/src/crypto/rsa/rsa_test.go
-+++ b/src/crypto/rsa/rsa_test.go
-@@ -123,28 +123,29 @@ func testKeyBasics(t *testing.T, priv *PrivateKey) {
- 		t.Errorf("private exponent too large")
- 	}
- 
-	if boring.Enabled() {
-		// Cannot call encrypt/decrypt directly. Test via PKCS1v15.
-		msg := []byte("hi!")
-		if priv.Size() >= 256 {
-			enc, err := EncryptPKCS1v15(rand.Reader, &priv.PublicKey, msg)
-			if err != nil {
-				t.Errorf("EncryptPKCS1v15: %v", err)
-				return
-			}
-			dec, err := DecryptPKCS1v15(rand.Reader, priv, enc)
-			if err != nil {
-				t.Errorf("DecryptPKCS1v15: %v", err)
-				return
-			}
-			if !bytes.Equal(dec, msg) {
-				t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
-			}
-		} else {
-			t.Logf("skipping check for unsupported key less than 2048 bits")
-		}
-		return
-	}
-+        if boring.Enabled() {
-+                // Cannot call encrypt/decrypt directly. Test via EncryptOAEP.
-+		sha256 := sha256.New()
-+                msg := []byte("hi!")
-+                if priv.Size() >= 256 {
-+                        enc, err := EncryptOAEP(sha256, rand.Reader, &priv.PublicKey, msg, nil)
-+                        if err != nil {
-+                                t.Errorf("EncryptOAEP: %v", err)
-+                                return
-+                        }
-+                        dec, err := DecryptOAEP(sha256, rand.Reader, priv, enc, nil)
-+                        if err != nil {
-+                                t.Errorf("DecryptOAEP: %v", err)
-+                                return
-+                        }
-+                        if !bytes.Equal(dec, msg) {
-+                                t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
-+                        }
-+                } else {
-+                        t.Logf("skipping check for unsupported key less than 2048 bits")
-+                }
-+                return
-+        }
- 
- 	pub := &priv.PublicKey
- 	m := big.NewInt(42)
-@@ -312,6 +312,11 @@ func TestDecryptOAEP(t *testing.T) {
- 		private.PublicKey = PublicKey{N: n, E: test.e}
- 		private.D = d
- 
-+		if boring.Enabled() && private.PublicKey.Size() < 256 {
-+			t.Logf("skipping check for unsupported key less than 2048 bits")
-+			continue
-+		}
-+		t.Logf("running check for supported key size")
- 		for j, message := range test.msgs {
- 			out, err := DecryptOAEP(sha1, nil, private, message.out, nil)
- 			if err != nil {
--- a/remove_ed25519vectors_test.patch
+++ b/remove_ed25519vectors_test.patch
@ -1,128 +0,0 @@
-From d7cad65ab9179804e9f089ce97bc124e9ef79494 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= <asm@redhat.com>
-Date: Wed, 15 Dec 2021 16:02:15 +0100
-Subject: [PATCH] Remove ed25519vectors_test.go
-
---
- src/crypto/ed25519/ed25519vectors_test.go | 109 ----------------------
- 1 file changed, 109 deletions(-)
- delete mode 100644 src/crypto/ed25519/ed25519vectors_test.go
-
-diff --git a/src/crypto/ed25519/ed25519vectors_test.go b/src/crypto/ed25519/ed25519vectors_test.go
-deleted file mode 100644
-index 74fcdcdf4e..0000000000
--- a/src/crypto/ed25519/ed25519vectors_test.go
-+++ /dev/null
-@@ -1,109 +0,0 @@
-// Copyright 2021 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package ed25519_test
-
-import (
-	"crypto/ed25519"
-	"encoding/hex"
-	"encoding/json"
-	"internal/testenv"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"testing"
-)
-
-// TestEd25519Vectors runs a very large set of test vectors that exercise all
-// combinations of low-order points, low-order components, and non-canonical
-// encodings. These vectors lock in unspecified and spec-divergent behaviors in
-// edge cases that are not security relevant in most contexts, but that can
-// cause issues in consensus applications if changed.
-//
-// Our behavior matches the "classic" unwritten verification rules of the
-// "ref10" reference implementation.
-//
-// Note that although we test for these edge cases, they are not covered by the
-// Go 1 Compatibility Promise. Applications that need stable verification rules
-// should use github.com/hdevalence/ed25519consensus.
-//
-// See https://hdevalence.ca/blog/2020-10-04-its-25519am for more details.
-func TestEd25519Vectors(t *testing.T) {
-	jsonVectors := downloadEd25519Vectors(t)
-	var vectors []struct {
-		A, R, S, M string
-		Flags      []string
-	}
-	if err := json.Unmarshal(jsonVectors, &vectors); err != nil {
-		t.Fatal(err)
-	}
-	for i, v := range vectors {
-		expectedToVerify := true
-		for _, f := range v.Flags {
-			switch f {
-			// We use the simplified verification formula that doesn't multiply
-			// by the cofactor, so any low order residue will cause the
-			// signature not to verify.
-			//
-			// This is allowed, but not required, by RFC 8032.
-			case "LowOrderResidue":
-				expectedToVerify = false
-			// Our point decoding allows non-canonical encodings (in violation
-			// of RFC 8032) but R is not decoded: instead, R is recomputed and
-			// compared bytewise against the canonical encoding.
-			case "NonCanonicalR":
-				expectedToVerify = false
-			}
-		}
-
-		publicKey := decodeHex(t, v.A)
-		signature := append(decodeHex(t, v.R), decodeHex(t, v.S)...)
-		message := []byte(v.M)
-
-		didVerify := ed25519.Verify(publicKey, message, signature)
-		if didVerify && !expectedToVerify {
-			t.Errorf("#%d: vector with flags %s unexpectedly verified", i, v.Flags)
-		}
-		if !didVerify && expectedToVerify {
-			t.Errorf("#%d: vector with flags %s unexpectedly rejected", i, v.Flags)
-		}
-	}
-}
-
-func downloadEd25519Vectors(t *testing.T) []byte {
-	testenv.MustHaveExternalNetwork(t)
-
-	// Download the JSON test file from the GOPROXY with `go mod download`,
-	// pinning the version so test and module caching works as expected.
-	goTool := testenv.GoToolPath(t)
-	path := "filippo.io/mostly-harmless/ed25519vectors@v0.0.0-20210322192420-30a2d7243a94"
-	cmd := exec.Command(goTool, "mod", "download", "-json", path)
-	// TODO: enable the sumdb once the TryBots proxy supports it.
-	cmd.Env = append(os.Environ(), "GONOSUMDB=*")
-	output, err := cmd.Output()
-	if err != nil {
-		t.Fatalf("failed to run `go mod download -json %s`, output: %s", path, output)
-	}
-	var dm struct {
-		Dir string // absolute path to cached source root directory
-	}
-	if err := json.Unmarshal(output, &dm); err != nil {
-		t.Fatal(err)
-	}
-
-	jsonVectors, err := os.ReadFile(filepath.Join(dm.Dir, "ed25519vectors.json"))
-	if err != nil {
-		t.Fatalf("failed to read ed25519vectors.json: %v", err)
-	}
-	return jsonVectors
-}
-
-func decodeHex(t *testing.T, s string) []byte {
-	t.Helper()
-	b, err := hex.DecodeString(s)
-	if err != nil {
-		t.Errorf("invalid hex: %v", err)
-	}
-	return b
-}
-- 
-2.33.1
-
--- a/rhbz1955035.patch
+++ b/rhbz1955035.patch
@ -1,42 +0,0 @@
-From 4ec78a579cc3c83a7d0afc7483fb3e69e2fd87a7 Mon Sep 17 00:00:00 2001
-From: "Paul E. Murphy" <murp@ibm.com>
-Date: Tue, 27 Apr 2021 15:05:51 -0500
-Subject: [PATCH] cmd/link: disable plugin support if cgo is disabled
-
-Functional plugin support requires cgo to be enabled. Disable
-it if the environment has disabled cgo.
-
-This prevents unexpected linker failures when linking large
-binaries with cgo disabled which use the plugin package.
-
-Fixes #45564
-
-Change-Id: Ib71f0e089f7373b7b3e3cd53da3612291e7bc473
-Reviewed-on: https://go-review.googlesource.com/c/go/+/314449
-Run-TryBot: Paul Murphy <murp@ibm.com>
-Reviewed-by: Cherry Zhang <cherryyz@google.com>
-TryBot-Result: Go Bot <gobot@golang.org>
-Trust: Lynn Boger <laboger@linux.vnet.ibm.com>
---
- src/cmd/link/internal/ld/lib.go | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
-index 0e77424884..f7a32aebae 100644
--- a/src/cmd/link/internal/ld/lib.go
-+++ b/src/cmd/link/internal/ld/lib.go
-@@ -533,7 +533,10 @@ func (ctxt *Link) loadlib() {
- 	// up symbol by name may not get expected result.
- 
- 	iscgo = ctxt.LibraryByPkg["runtime/cgo"] != nil
-	ctxt.canUsePlugins = ctxt.LibraryByPkg["plugin"] != nil
-+
-+	// Plugins a require cgo support to function. Similarly, plugins may require additional
-+	// internal linker support on some platforms which may not be implemented.
-+	ctxt.canUsePlugins = ctxt.LibraryByPkg["plugin"] != nil && iscgo
- 
- 	// We now have enough information to determine the link mode.
- 	determineLinkMode(ctxt)
-- 
-2.30.2
-
--- a/runtime_pprof_wrong_mapping.patch
+++ b/runtime_pprof_wrong_mapping.patch
@ -0,0 +1,20 @@
+diff --git a/src/runtime/pprof/proto_test.go b/src/runtime/pprof/proto_test.go
+index 84a051a..1462c20 100644
+--- a/src/runtime/pprof/proto_test.go
+++ b/src/runtime/pprof/proto_test.go
+@@ -95,11 +95,11 @@ func testPCs(t *testing.T) (addr1, addr2 uint64, map1, map2 *profile.Mapping) {
+ 			// region of memory.
+ 			t.Skipf("need 2 or more mappings, got %v", len(mprof.Mapping))
+ 		}
+-		addr1 = mprof.Mapping[0].Start
+-		map1 = mprof.Mapping[0]
+		addr1 = mprof.Mapping[1].Start
+		map1 = mprof.Mapping[1]
+ 		map1.BuildID, _ = elfBuildID(map1.File)
+-		addr2 = mprof.Mapping[1].Start
+-		map2 = mprof.Mapping[1]
+		addr2 = mprof.Mapping[2].Start
+		map2 = mprof.Mapping[2]
+ 		map2.BuildID, _ = elfBuildID(map2.File)
+ 	case "js":
+ 		addr1 = uint64(abi.FuncPCABIInternal(f1))
--- a/skip_test_rhbz1939923.patch
+++ b/skip_test_rhbz1939923.patch
@ -1,8 +1,8 @@
 diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go
-index 51dda16815..2d1e1b1e6e 100644
+index b1cdabb..09eaace 100644
 --- a/src/crypto/x509/x509_test.go
 +++ b/src/crypto/x509/x509_test.go
-@@ -2880,6 +2880,7 @@ func (bs *brokenSigner) Sign(_ io.Reader, _ []byte, _ crypto.SignerOpts) ([]byte
+@@ -2993,6 +2993,7 @@ func (bs *brokenSigner) Sign(_ io.Reader, _ []byte, _ crypto.SignerOpts) ([]byte
 }
 
 func TestCreateCertificateBrokenSigner(t *testing.T) {
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (go1.18.4-1-openssl-fips.tar.gz) = 935f3ba3c2427b4e274b1f49b85f0702d6a2872580b70c5a500c82418a3b1729c0678e05d9ed5eb8eb0f0bc49e1302171f769fb7e15d90694db71f0223ecaa56
+SHA512 (go1.19.1.tar.gz) = 8f35dddfdfd4cc22f86c0a8af367038f7a5c9d88a21f4233ff234dd97e344b781f6c49741870fd5d292f41ae6b07e829080d5a0b0c578ce64f0fab5f6597f353