rpms/golang
5
0
Fork 0
Code Issues Pull Requests Releases Activity

import golang-1.19.6-2.el9_2

Browse Source
This commit is contained in:
CentOS Sources 2023-05-09 05:18:33 +00:00 committed by Stepan Oksanichenko
parent 25f732c70e
commit 99de7a0953
11 changed files with 464 additions and 734 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@ -1 +1,2 @@
SOURCES/go1.18.10-1-openssl-fips.tar.gz SOURCES/go1.19.6-1-openssl-fips.tar.gz
SOURCES/go1.19.6.tar.gz

3
.golang.metadata
View File

@ -1 +1,2 @@
d12404b2ef5e4e0ed1d9f735cb487812c1c6ceb1 SOURCES/go1.18.10-1-openssl-fips.tar.gz e990e956bbd3c1e52914ea39f075a1c666bde4e4 SOURCES/go1.19.6-1-openssl-fips.tar.gz
d85391faa6c2d74090008b9744e4664267700fd3 SOURCES/go1.19.6.tar.gz

288
SOURCES/disable_static_tests_part1.patch Normal file
View File

@ -0,0 +1,288 @@
diff --git a/src/crypto/internal/backend/nobackend.go b/src/crypto/internal/backend/nobackend.go
index 5f258a2..5dbbc42 100644
--- a/src/crypto/internal/backend/nobackend.go
+++ b/src/crypto/internal/backend/nobackend.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
-// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
+//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl || static
+// +build !linux !cgo android cmd_go_bootstrap msan no_openssl static
package backend
diff --git a/src/crypto/internal/boring/goboringcrypto.h b/src/crypto/internal/boring/goboringcrypto.h
index d6d99b1..f2fe332 100644
--- a/src/crypto/internal/boring/goboringcrypto.h
+++ b/src/crypto/internal/boring/goboringcrypto.h
@@ -1,4 +1,5 @@
// Copyright 2017 The Go Authors. All rights reserved.
+// +build !static
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
diff --git a/src/crypto/internal/boring/syso/syso.go b/src/crypto/internal/boring/syso/syso.go
index b338754..db5ea1e 100644
--- a/src/crypto/internal/boring/syso/syso.go
+++ b/src/crypto/internal/boring/syso/syso.go
@@ -2,7 +2,7 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build boringcrypto
+//go:build boringcrypto && !static
// This package only exists with GOEXPERIMENT=boringcrypto.
// It provides the actual syso file.
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
index 079fc3c..e826d0b 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/aes.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
index 0b61e79..94d0c98 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdh.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
index afec529..d822152 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/ecdsa.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h b/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
index 6d6a562..17cc314 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/goopenssl.h
@@ -1,4 +1,5 @@
// Copyright 2017 The Go Authors. All rights reserved.
+// +build !static
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
// +build linux
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
index ae40b93..17bc075 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hkdf.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
index 6f00177..f466b18 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/hmac.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
index 7c0b5d6..262af07 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/notboring.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
-// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
+//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl || static
+// +build !linux !cgo android cmd_go_bootstrap msan no_openssl static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
index d49194d..ff15054 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
index 2349db1..57fbb04 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_ecdsa_signature.c
@@ -1,4 +1,5 @@
// +build linux
+// +build !static
// +build !android
// +build !no_openssl
// +build !cmd_go_bootstrap
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
index 4379019..5034c46 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
@@ -1,4 +1,5 @@
// +build linux
+// +build !static
// +build !android
// +build !no_openssl
// +build !cmd_go_bootstrap
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
index 49d40a7..3b3dbf8 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_lock_setup.c
@@ -1,4 +1,5 @@
// +build linux
+// +build !static
// +build !android
// +build !no_openssl
// +build !cmd_go_bootstrap
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
index 7eb645e..1c3225a 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_aead_gcm.c
@@ -1,4 +1,5 @@
// This file contains a port of the BoringSSL AEAD interface.
+// +build !static
// +build linux
// +build !android
// +build !no_openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
index df4ebe3..876393b 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ctr128.c
@@ -1,4 +1,5 @@
// +build linux
+// +build !static
// +build !android
// +build !no_openssl
// +build !cmd_go_bootstrap
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
index 2eedd5b..04510d3 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_evp_md5_sha1.c
@@ -1,4 +1,5 @@
// This file contains a backport of the EVP_md5_sha1 method.
+// +build !static
// +build linux
// +build !android
// +build !no_openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
index 362d9e5..bebafef 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_hmac.c
@@ -1,4 +1,5 @@
// This file contains HMAC portability wrappers.
+// +build !static
// +build linux
// +build !android
// +build !no_openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
index 2824147..8bc1d85 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_rsa.c
@@ -1,4 +1,5 @@
// This file contains RSA portability wrappers.
+// +build !static
// +build linux
// +build !android
// +build !no_openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
index 22bd865..b7aa26b 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_stub_rand.c
@@ -1,4 +1,5 @@
// +build linux
+// +build !static
// +build !android
// +build !no_openssl
// +build !cmd_go_bootstrap
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
index b3668b8..dcdae70 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rand.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
index 915c840..8623d9d 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/rsa.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go b/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
index 0b55ced..57309c0 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/sha.go
@@ -2,8 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl
-// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl
+//go:build linux && !android && !cmd_go_bootstrap && !msan && !no_openssl && !static
+// +build linux,!android,!cmd_go_bootstrap,!msan,!no_openssl,!static
package openssl

36
SOURCES/disable_static_tests_part2.patch Normal file
View File

@ -0,0 +1,36 @@
diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
index da5b179..6a772df 100644
--- a/src/cmd/dist/test.go
+++ b/src/cmd/dist/test.go
@@ -1247,18 +1247,20 @@ func (t *tester) cgoTest(dt *distTest) error {
fmt.Println("No support for static linking found (lacks libc.a?), skip cgo static linking test.")
} else {
if goos != "android" {
- t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
+ t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, "-tags=no_openssl")
}
t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), ".")
t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external`, ".")
if goos != "android" {
- t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
+ t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, "-tags=no_openssl")
+ /*
t.addCmd(dt, "misc/cgo/test", t.goTest(), "-tags=static", "-ldflags", `-linkmode=external -extldflags "-static -pthread"`, ".")
// -static in CGO_LDFLAGS triggers a different code path
// than -static in -extldflags, so test both.
// See issue #16651.
cmd := t.addCmd(dt, "misc/cgo/test", t.goTest(), "-tags=static", ".")
setEnv(cmd, "CGO_LDFLAGS", "-static -pthread")
+ */
}
}
@@ -1268,7 +1270,7 @@ func (t *tester) cgoTest(dt *distTest) error {
t.addCmd(dt, "misc/cgo/test", t.goTest(), "-buildmode=pie", "-ldflags=-linkmode=internal", "-tags=internal,internal_pie", ".")
}
t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-buildmode=pie", ".")
- t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie", ".")
+ t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie", "-tags=no_openssl")
}
}
}

363
SOURCES/enable-big-endian-fips.patch
View File

@ -1,363 +0,0 @@
diff --git a/src/crypto/internal/boring/goopenssl.h b/src/crypto/internal/boring/goopenssl.h
index 4820385f67..2415702b28 100644
--- a/src/crypto/internal/boring/goopenssl.h
+++ b/src/crypto/internal/boring/goopenssl.h
@@ -76,7 +76,7 @@ _goboringcrypto_DLOPEN_OPENSSL(void)
#include <openssl/opensslv.h>
#include <openssl/ssl.h>
-DEFINEFUNCINTERNAL(int, OPENSSL_init, (void), ())
+DEFINEFUNCINTERNAL(void, OPENSSL_init, (void), ())
static unsigned long _goboringcrypto_internal_OPENSSL_VERSION_NUMBER(void) {
return OPENSSL_VERSION_NUMBER;
@@ -97,35 +97,32 @@ DEFINEFUNCINTERNAL(void, ERR_error_string_n, (unsigned long e, unsigned char *bu
#include <openssl/crypto.h>
-DEFINEFUNCINTERNAL(int, CRYPTO_num_locks, (void), ())
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+DEFINEFUNC(int, CRYPTO_num_locks, (void), ())
+#else
static inline int
_goboringcrypto_CRYPTO_num_locks(void) {
+ return CRYPTO_num_locks(); /* defined as macro */
+}
+#endif
#if OPENSSL_VERSION_NUMBER < 0x10100000L
- return _goboringcrypto_internal_CRYPTO_num_locks();
+DEFINEFUNC(void, CRYPTO_set_id_callback, (unsigned long (*id_function)(void)), (id_function))
#else
- return CRYPTO_num_locks();
-#endif
-}
-DEFINEFUNCINTERNAL(void, CRYPTO_set_id_callback, (unsigned long (*id_function)(void)), (id_function))
static inline void
_goboringcrypto_CRYPTO_set_id_callback(unsigned long (*id_function)(void)) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
- _goboringcrypto_internal_CRYPTO_set_id_callback(id_function);
-#else
- CRYPTO_set_id_callback(id_function);
-#endif
+ CRYPTO_set_id_callback(id_function); /* defined as macro */
}
-DEFINEFUNCINTERNAL(void, CRYPTO_set_locking_callback,
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+DEFINEFUNC(void, CRYPTO_set_locking_callback,
(void (*locking_function)(int mode, int n, const char *file, int line)),
(locking_function))
+#else
static inline void
_goboringcrypto_CRYPTO_set_locking_callback(void (*locking_function)(int mode, int n, const char *file, int line)) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
- _goboringcrypto_internal_CRYPTO_set_locking_callback(locking_function);
-#else
- CRYPTO_set_locking_callback(locking_function);
-#endif
+ CRYPTO_set_locking_callback(locking_function); /* defined as macro */
}
+#endif
int _goboringcrypto_OPENSSL_thread_setup(void);
@@ -206,10 +203,16 @@ DEFINEFUNC(const GO_EVP_MD *, EVP_sha384, (void), ())
DEFINEFUNC(const GO_EVP_MD *, EVP_sha512, (void), ())
#if OPENSSL_VERSION_NUMBER < 0x30000000L
DEFINEFUNCINTERNAL(int, EVP_MD_type, (const GO_EVP_MD *arg0), (arg0))
+DEFINEFUNCINTERNAL(size_t, EVP_MD_size, (const GO_EVP_MD *arg0), (arg0))
+static inline int
+_goboringcrypto_EVP_MD_get_size(const GO_EVP_MD *arg0)
+{
+ return _goboringcrypto_internal_EVP_MD_size(arg0);
+}
#else
DEFINEFUNCINTERNAL(int, EVP_MD_get_type, (const GO_EVP_MD *arg0), (arg0))
+DEFINEFUNC(int, EVP_MD_get_size, (const GO_EVP_MD *arg0), (arg0))
#endif
-DEFINEFUNCINTERNAL(size_t, EVP_MD_size, (const GO_EVP_MD *arg0), (arg0))
DEFINEFUNCINTERNAL(const GO_EVP_MD*, EVP_md5_sha1, (void), ())
# include <openssl/md5.h>
@@ -240,8 +243,6 @@ _goboringcrypto_EVP_md5_sha1(void) {
typedef HMAC_CTX GO_HMAC_CTX;
-DEFINEFUNC(void, HMAC_CTX_init, (GO_HMAC_CTX * arg0), (arg0))
-DEFINEFUNC(void, HMAC_CTX_cleanup, (GO_HMAC_CTX * arg0), (arg0))
DEFINEFUNC(int, HMAC_Init_ex,
(GO_HMAC_CTX * arg0, const void *arg1, int arg2, const GO_EVP_MD *arg3, ENGINE *arg4),
(arg0, arg1, arg2, arg3, arg4))
@@ -249,59 +250,57 @@ DEFINEFUNC(int, HMAC_Update, (GO_HMAC_CTX * arg0, const uint8_t *arg1, size_t ar
DEFINEFUNC(int, HMAC_Final, (GO_HMAC_CTX * arg0, uint8_t *arg1, unsigned int *arg2), (arg0, arg1, arg2))
DEFINEFUNC(size_t, HMAC_CTX_copy, (GO_HMAC_CTX *dest, GO_HMAC_CTX *src), (dest, src))
-DEFINEFUNCINTERNAL(void, HMAC_CTX_free, (GO_HMAC_CTX * arg0), (arg0))
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+DEFINEFUNCINTERNAL(void, HMAC_CTX_cleanup, (GO_HMAC_CTX * arg0), (arg0))
static inline void
_goboringcrypto_HMAC_CTX_free(HMAC_CTX *ctx) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
if (ctx != NULL) {
- _goboringcrypto_HMAC_CTX_cleanup(ctx);
+ _goboringcrypto_internal_HMAC_CTX_cleanup(ctx);
free(ctx);
}
+}
#else
- _goboringcrypto_internal_HMAC_CTX_free(ctx);
+DEFINEFUNC(void, HMAC_CTX_free, (GO_HMAC_CTX * arg0), (arg0))
#endif
-}
-DEFINEFUNCINTERNAL(EVP_MD*, HMAC_CTX_get_md, (const GO_HMAC_CTX* ctx), (ctx))
-DEFINEFUNCINTERNAL(size_t, EVP_MD_get_size, (const GO_EVP_MD *arg0), (arg0))
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
static inline size_t
_goboringcrypto_HMAC_size(const GO_HMAC_CTX* arg0) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
- return _goboringcrypto_internal_EVP_MD_size(arg0->md);
-#elif OPENSSL_VERSION_NUMBER >= 0x30000000L
- const EVP_MD* md;
- md = _goboringcrypto_internal_HMAC_CTX_get_md(arg0);
- return _goboringcrypto_internal_EVP_MD_get_size(md);
+ return _goboringcrypto_EVP_MD_get_size(arg0->md);
+}
#else
+DEFINEFUNCINTERNAL(const EVP_MD*, HMAC_CTX_get_md, (const GO_HMAC_CTX* ctx), (ctx))
+static inline size_t
+_goboringcrypto_HMAC_size(const GO_HMAC_CTX* arg0) {
const EVP_MD* md;
md = _goboringcrypto_internal_HMAC_CTX_get_md(arg0);
- return _goboringcrypto_internal_EVP_MD_size(md);
-#endif
+ return _goboringcrypto_EVP_MD_get_size(md);
}
+#endif
-DEFINEFUNCINTERNAL(GO_HMAC_CTX*, HMAC_CTX_new, (void), ())
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+DEFINEFUNCINTERNAL(void, HMAC_CTX_init, (GO_HMAC_CTX * arg0), (arg0))
static inline GO_HMAC_CTX*
_goboringcrypto_HMAC_CTX_new(void) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
GO_HMAC_CTX* ctx = malloc(sizeof(GO_HMAC_CTX));
if (ctx != NULL)
- _goboringcrypto_HMAC_CTX_init(ctx);
+ _goboringcrypto_internal_HMAC_CTX_init(ctx);
return ctx;
+}
#else
- return _goboringcrypto_internal_HMAC_CTX_new();
+DEFINEFUNC(GO_HMAC_CTX*, HMAC_CTX_new, (void), ())
#endif
-}
-DEFINEFUNCINTERNAL(void, HMAC_CTX_reset, (GO_HMAC_CTX * arg0), (arg0))
-static inline void
-_goboringcrypto_HMAC_CTX_reset(GO_HMAC_CTX* ctx) {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
- _goboringcrypto_HMAC_CTX_cleanup(ctx);
- _goboringcrypto_HMAC_CTX_init(ctx);
+static inline int
+_goboringcrypto_HMAC_CTX_reset(GO_HMAC_CTX* ctx) {
+ _goboringcrypto_internal_HMAC_CTX_cleanup(ctx);
+ _goboringcrypto_internal_HMAC_CTX_init(ctx);
+ return 0;
+}
#else
- _goboringcrypto_internal_HMAC_CTX_reset(ctx);
+DEFINEFUNC(int, HMAC_CTX_reset, (GO_HMAC_CTX * arg0), (arg0))
#endif
-}
int _goboringcrypto_HMAC_CTX_copy_ex(GO_HMAC_CTX *dest, const GO_HMAC_CTX *src);
@@ -408,16 +407,14 @@ DEFINEFUNCINTERNAL(int, ECDSA_verify,
(int type, const unsigned char *dgst, size_t dgstlen, const unsigned char *sig, unsigned int siglen, EC_KEY *eckey),
(type, dgst, dgstlen, sig, siglen, eckey))
-DEFINEFUNCINTERNAL(EVP_MD_CTX*, EVP_MD_CTX_new, (void), ())
-DEFINEFUNCINTERNAL(EVP_MD_CTX*, EVP_MD_CTX_create, (void), ())
-
-static inline EVP_MD_CTX* _goboringcrypto_EVP_MD_CTX_create(void) {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
- return _goboringcrypto_internal_EVP_MD_CTX_create();
+DEFINEFUNC(EVP_MD_CTX*, EVP_MD_CTX_create, (void), ())
#else
+DEFINEFUNCINTERNAL(EVP_MD_CTX*, EVP_MD_CTX_new, (void), ())
+static inline EVP_MD_CTX* _goboringcrypto_EVP_MD_CTX_create(void) {
return _goboringcrypto_internal_EVP_MD_CTX_new();
-#endif
}
+#endif
DEFINEFUNCINTERNAL(int, EVP_PKEY_assign,
(EVP_PKEY *pkey, int type, void *eckey),
@@ -441,7 +438,7 @@ DEFINEFUNC(int, EVP_DigestUpdate,
(EVP_MD_CTX* ctx, const void *d, size_t cnt),
(ctx, d, cnt))
DEFINEFUNC(int, EVP_DigestSignFinal,
- (EVP_MD_CTX* ctx, unsigned char *sig, unsigned int *siglen),
+ (EVP_MD_CTX* ctx, unsigned char *sig, size_t *siglen),
(ctx, sig, siglen))
DEFINEFUNC(int, EVP_DigestVerifyInit,
@@ -451,18 +448,17 @@ DEFINEFUNC(int, EVP_DigestVerifyFinal,
(EVP_MD_CTX* ctx, const uint8_t *sig, unsigned int siglen),
(ctx, sig, siglen))
-int _goboringcrypto_EVP_sign(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, uint8_t *sig, unsigned int *slen, EVP_PKEY *eckey);
+int _goboringcrypto_EVP_sign(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, uint8_t *sig, size_t *slen, EVP_PKEY *eckey);
int _goboringcrypto_EVP_verify(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, const uint8_t *sig, unsigned int slen, EVP_PKEY *key);
-DEFINEFUNCINTERNAL(void, EVP_MD_CTX_free, (EVP_MD_CTX *ctx), (ctx))
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
DEFINEFUNCINTERNAL(void, EVP_MD_CTX_destroy, (EVP_MD_CTX *ctx), (ctx))
static inline void _goboringcrypto_EVP_MD_CTX_free(EVP_MD_CTX *ctx) {
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
return _goboringcrypto_internal_EVP_MD_CTX_destroy(ctx);
+}
#else
- return _goboringcrypto_internal_EVP_MD_CTX_free(ctx);
+DEFINEFUNC(void, EVP_MD_CTX_free, (EVP_MD_CTX *ctx), (ctx))
#endif
-}
int _goboringcrypto_ECDSA_sign(EVP_MD *md, const uint8_t *arg1, size_t arg2, uint8_t *arg3, unsigned int *arg4, GO_EC_KEY *arg5);
int _goboringcrypto_ECDSA_verify(EVP_MD *md, const uint8_t *arg1, size_t arg2, const uint8_t *arg3, unsigned int arg4, GO_EC_KEY *arg5);
@@ -473,7 +469,7 @@ int _goboringcrypto_ECDSA_verify(EVP_MD *md, const uint8_t *arg1, size_t arg2, c
typedef RSA GO_RSA;
typedef BN_GENCB GO_BN_GENCB;
-int _goboringcrypto_EVP_RSA_sign(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, uint8_t *sig, unsigned int *slen, RSA *rsa);
+int _goboringcrypto_EVP_RSA_sign(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, uint8_t *sig, size_t *slen, RSA *rsa);
int _goboringcrypto_EVP_RSA_verify(EVP_MD* md, const uint8_t *msg, unsigned int msgLen, const uint8_t *sig, unsigned int slen, GO_RSA *rsa);
DEFINEFUNC(GO_RSA *, RSA_new, (void), ())
@@ -774,10 +770,10 @@ _goboringcrypto_EVP_PKEY_CTX_set_rsa_mgf1_md(GO_EVP_PKEY_CTX * ctx, const GO_EVP
}
DEFINEFUNC(int, EVP_PKEY_decrypt,
- (GO_EVP_PKEY_CTX * arg0, uint8_t *arg1, unsigned int *arg2, const uint8_t *arg3, unsigned int arg4),
+ (GO_EVP_PKEY_CTX * arg0, uint8_t *arg1, size_t *arg2, const uint8_t *arg3, unsigned int arg4),
(arg0, arg1, arg2, arg3, arg4))
DEFINEFUNC(int, EVP_PKEY_encrypt,
- (GO_EVP_PKEY_CTX * arg0, uint8_t *arg1, unsigned int *arg2, const uint8_t *arg3, unsigned int arg4),
+ (GO_EVP_PKEY_CTX * arg0, uint8_t *arg1, size_t *arg2, const uint8_t *arg3, unsigned int arg4),
(arg0, arg1, arg2, arg3, arg4))
DEFINEFUNC(int, EVP_PKEY_decrypt_init, (GO_EVP_PKEY_CTX * arg0), (arg0))
DEFINEFUNC(int, EVP_PKEY_encrypt_init, (GO_EVP_PKEY_CTX * arg0), (arg0))
diff --git a/src/crypto/internal/boring/openssl_ecdsa_signature.c b/src/crypto/internal/boring/openssl_ecdsa_signature.c
index 710d0744ff..9d0056c5f7 100644
--- a/src/crypto/internal/boring/openssl_ecdsa_signature.c
+++ b/src/crypto/internal/boring/openssl_ecdsa_signature.c
@@ -18,7 +18,9 @@ _goboringcrypto_ECDSA_sign(EVP_MD* md, const uint8_t *msg, size_t msgLen, uint8_
result = 0;
goto err;
}
- result = _goboringcrypto_EVP_sign(md, NULL, msg, msgLen, sig, slen, key);
+ size_t _slen;
+ result = _goboringcrypto_EVP_sign(md, NULL, msg, msgLen, sig, &_slen, key);
+ *slen = _slen;
err:
_goboringcrypto_EVP_PKEY_free(key);
return result;
diff --git a/src/crypto/internal/boring/openssl_evp.c b/src/crypto/internal/boring/openssl_evp.c
index 36be702224..8b81fd71f6 100644
--- a/src/crypto/internal/boring/openssl_evp.c
+++ b/src/crypto/internal/boring/openssl_evp.c
@@ -7,7 +7,7 @@
#include "goboringcrypto.h"
int
-_goboringcrypto_EVP_sign(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, uint8_t *sig, unsigned int *slen, EVP_PKEY *key) {
+_goboringcrypto_EVP_sign(EVP_MD* md, EVP_PKEY_CTX *ctx, const uint8_t *msg, size_t msgLen, uint8_t *sig, size_t *slen, EVP_PKEY *key) {
EVP_MD_CTX *mdctx = NULL;
int ret = 0;
diff --git a/src/crypto/internal/boring/openssl_port_rsa.c b/src/crypto/internal/boring/openssl_port_rsa.c
index 5174f662c9..3ad4e69e9d 100644
--- a/src/crypto/internal/boring/openssl_port_rsa.c
+++ b/src/crypto/internal/boring/openssl_port_rsa.c
@@ -19,7 +19,7 @@ int _goboringcrypto_RSA_generate_key_fips(GO_RSA *rsa, int size, GO_BN_GENCB *cb
return ret;
}
-int _goboringcrypto_RSA_digest_and_sign_pss_mgf1(GO_RSA *rsa, unsigned int *out_len, uint8_t *out, size_t max_out,
+int _goboringcrypto_RSA_digest_and_sign_pss_mgf1(GO_RSA *rsa, size_t *out_len, uint8_t *out, size_t max_out,
const uint8_t *in, size_t in_len, EVP_MD *md, const EVP_MD *mgf1_md, int salt_len)
{
EVP_PKEY_CTX *ctx;
@@ -173,7 +173,7 @@ err:
return ret;
}
-int _goboringcrypto_EVP_RSA_sign(EVP_MD *md, const uint8_t *msg, unsigned int msgLen, uint8_t *sig, unsigned int *slen, RSA *rsa)
+int _goboringcrypto_EVP_RSA_sign(EVP_MD *md, const uint8_t *msg, unsigned int msgLen, uint8_t *sig, size_t *slen, RSA *rsa)
{
int result;
EVP_PKEY *key = _goboringcrypto_EVP_PKEY_new();
diff --git a/src/crypto/internal/boring/rsa.go b/src/crypto/internal/boring/rsa.go
index b1a2f57abd..e47ca3bb63 100644
--- a/src/crypto/internal/boring/rsa.go
+++ b/src/crypto/internal/boring/rsa.go
@@ -200,7 +200,7 @@ func setupRSA(withKey func(func(*C.GO_RSA) C.int) C.int,
func cryptRSA(withKey func(func(*C.GO_RSA) C.int) C.int,
padding C.int, h hash.Hash, label []byte, saltLen int, ch crypto.Hash,
init func(*C.GO_EVP_PKEY_CTX) C.int,
- crypt func(*C.GO_EVP_PKEY_CTX, *C.uint8_t, *C.uint, *C.uint8_t, C.uint) C.int,
+ crypt func(*C.GO_EVP_PKEY_CTX, *C.uint8_t, *C.size_t, *C.uint8_t, C.uint) C.int,
in []byte) ([]byte, error) {
pkey, ctx, err := setupRSA(withKey, padding, h, label, saltLen, ch, init)
@@ -210,7 +210,7 @@ func cryptRSA(withKey func(func(*C.GO_RSA) C.int) C.int,
defer C._goboringcrypto_EVP_PKEY_free(pkey)
defer C._goboringcrypto_EVP_PKEY_CTX_free(ctx)
- var outLen C.uint
+ var outLen C.size_t
if crypt(ctx, nil, &outLen, base(in), C.uint(len(in))) == 0 {
return nil, NewOpenSSLError("EVP_PKEY_decrypt/encrypt failed")
}
@@ -251,7 +251,7 @@ func decryptInit(ctx *C.GO_EVP_PKEY_CTX) C.int {
return C._goboringcrypto_EVP_PKEY_decrypt_init(ctx)
}
-func decrypt(ctx *C.GO_EVP_PKEY_CTX, out *C.uint8_t, outLen *C.uint, in *C.uint8_t, inLen C.uint) C.int {
+func decrypt(ctx *C.GO_EVP_PKEY_CTX, out *C.uint8_t, outLen *C.size_t, in *C.uint8_t, inLen C.uint) C.int {
return C._goboringcrypto_EVP_PKEY_decrypt(ctx, out, outLen, in, inLen)
}
@@ -259,7 +259,7 @@ func encryptInit(ctx *C.GO_EVP_PKEY_CTX) C.int {
return C._goboringcrypto_EVP_PKEY_encrypt_init(ctx)
}
-func encrypt(ctx *C.GO_EVP_PKEY_CTX, out *C.uint8_t, outLen *C.uint, in *C.uint8_t, inLen C.uint) C.int {
+func encrypt(ctx *C.GO_EVP_PKEY_CTX, out *C.uint8_t, outLen *C.size_t, in *C.uint8_t, inLen C.uint) C.int {
return C._goboringcrypto_EVP_PKEY_encrypt(ctx, out, outLen, in, inLen)
}
@@ -307,10 +307,9 @@ func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, msg []byte, msgIsHashed
return nil, errors.New("crypto/rsa: unsupported hash function: " + strconv.Itoa(int(h)))
}
- var out []byte
- var outLen C.uint
-
if msgIsHashed {
+ var out []byte
+ var outLen C.uint
PanicIfStrictFIPS("You must provide a raw unhashed message for PKCS1v15 signing and use HashSignPKCS1v15 instead of SignPKCS1v15")
nid := C._goboringcrypto_EVP_MD_type(md)
if priv.withKey(func(key *C.GO_RSA) C.int {
@@ -323,6 +322,9 @@ func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, msg []byte, msgIsHashed
return out[:outLen], nil
}
+ var out []byte
+ var outLen C.size_t
+
if priv.withKey(func(key *C.GO_RSA) C.int {
return C._goboringcrypto_EVP_RSA_sign(md, base(msg), C.uint(len(msg)), base(out), &outLen, key)
}) == 0 {

48
SOURCES/fix-memory-leak-evp-sign-verify.patch Normal file
View File

@ -0,0 +1,48 @@
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
index 2124978..1f853b4 100644
--- a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_evp.c
@@ -44,7 +44,11 @@ int _goboringcrypto_EVP_sign_raw(EVP_MD *md, EVP_PKEY_CTX *ctx, const uint8_t *m
GO_RSA *rsa_key) {
int ret = 0;
GO_EVP_PKEY *pk = _goboringcrypto_EVP_PKEY_new();
- _goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key);
+ if (!pk)
+ return 0;
+
+ if (!(_goboringcrypto_EVP_PKEY_set1_RSA(pk, rsa_key)))
+ goto err;
if (!ctx && !(ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL)))
goto err;
@@ -64,6 +68,8 @@ int _goboringcrypto_EVP_sign_raw(EVP_MD *md, EVP_PKEY_CTX *ctx, const uint8_t *m
err:
if (ctx)
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
+ if (pk)
+ _goboringcrypto_EVP_PKEY_free(pk);
return ret;
}
@@ -104,7 +110,11 @@ int _goboringcrypto_EVP_verify_raw(const uint8_t *msg, size_t msgLen,
int ret = 0;
EVP_PKEY_CTX *ctx;
GO_EVP_PKEY *pk = _goboringcrypto_EVP_PKEY_new();
- _goboringcrypto_EVP_PKEY_assign_RSA(pk, rsa_key);
+ if (!pk)
+ return 0;
+
+ if (!(_goboringcrypto_EVP_PKEY_set1_RSA(pk, rsa_key)))
+ goto err;
if (!(ctx = _goboringcrypto_EVP_PKEY_CTX_new(pk, NULL)))
goto err;
@@ -124,6 +134,8 @@ int _goboringcrypto_EVP_verify_raw(const uint8_t *msg, size_t msgLen,
err:
if (ctx)
_goboringcrypto_EVP_PKEY_CTX_free(ctx);
+ if (pk)
+ _goboringcrypto_EVP_PKEY_free(pk);
return ret;
}

73
SOURCES/go1.5-zoneinfo_testing_only.patch
View File

@ -1,73 +0,0 @@
diff --git a/src/time/internal_test.go b/src/time/internal_test.go
index f0dddb7..415949a 100644
--- a/src/time/internal_test.go
+++ b/src/time/internal_test.go
@@ -4,13 +4,15 @@
package time
+import "runtime"
+
func init() {
// force US/Pacific for time zone tests
ForceUSPacificForTesting()
}
func initTestingZone() {
- z, err := loadLocation("America/Los_Angeles", zoneSources[len(zoneSources)-1:])
+ z, err := loadLocation("America/Los_Angeles", zoneSources)
if err != nil {
panic("cannot load America/Los_Angeles for testing: " + err.Error() + "; you may want to use -tags=timetzdata")
}
@@ -21,8 +23,9 @@ func initTestingZone() {
var OrigZoneSources = zoneSources
func forceZipFileForTesting(zipOnly bool) {
- zoneSources = make([]string, len(OrigZoneSources))
+ zoneSources = make([]string, len(OrigZoneSources)+1)
copy(zoneSources, OrigZoneSources)
+ zoneSources = append(zoneSources, runtime.GOROOT()+"/lib/time/zoneinfo.zip")
if zipOnly {
zoneSources = zoneSources[len(zoneSources)-1:]
}
diff --git a/src/time/zoneinfo_test.go b/src/time/zoneinfo_test.go
index f032aa7..e3e5547 100644
--- a/src/time/zoneinfo_test.go
+++ b/src/time/zoneinfo_test.go
@@ -9,6 +9,7 @@ import (
"fmt"
"os"
"reflect"
+ "runtime"
"testing"
"time"
)
@@ -137,7 +138,7 @@ func TestLoadLocationFromTZData(t *testing.T) {
t.Fatal(err)
}
- tzinfo, err := time.LoadTzinfo(locationName, time.OrigZoneSources[len(time.OrigZoneSources)-1])
+ tzinfo, err := time.LoadTzinfo(locationName, runtime.GOROOT()+"/lib/time/zoneinfo.zip")
if err != nil {
t.Fatal(err)
}
diff --git a/src/time/zoneinfo_unix.go b/src/time/zoneinfo_unix.go
index 23f8b3c..228db1b 100644
--- a/src/time/zoneinfo_unix.go
+++ b/src/time/zoneinfo_unix.go
@@ -12,7 +12,6 @@
package time
import (
- "runtime"
"syscall"
)
@@ -22,7 +21,6 @@ var zoneSources = []string{
"/usr/share/zoneinfo/",
"/usr/share/lib/zoneinfo/",
"/usr/lib/locale/TZ/",
- runtime.GOROOT() + "/lib/time/zoneinfo.zip",
}
func initLocal() {

124
SOURCES/openssl_deprecated_algorithm_tests.patch
View File

@ -1,124 +0,0 @@
diff --git a/src/crypto/rsa/pkcs1v15_test.go b/src/crypto/rsa/pkcs1v15_test.go
index a4f2e2dbbe..76701d2e2b 100644
--- a/src/crypto/rsa/pkcs1v15_test.go
+++ b/src/crypto/rsa/pkcs1v15_test.go
@@ -52,6 +52,7 @@ var decryptPKCS1v15Tests = []DecryptPKCS1v15Test{
}
func TestDecryptPKCS1v15(t *testing.T) {
+ t.Skip("not supported in FIPS mode")
decryptionFuncs := []func([]byte) ([]byte, error){
func(ciphertext []byte) (plaintext []byte, err error) {
return DecryptPKCS1v15(nil, testRSA2048PrivateKey, ciphertext)
@@ -76,6 +77,7 @@ func TestDecryptPKCS1v15(t *testing.T) {
}
func TestEncryptPKCS1v15(t *testing.T) {
+ t.Skip("not supported in FIPS mode")
random := rand.Reader
k := (testRSA2048PrivateKey.N.BitLen() + 7) / 8
@@ -137,6 +139,7 @@ var decryptPKCS1v15SessionKeyTests = []DecryptPKCS1v15Test{
}
func TestEncryptPKCS1v15SessionKey(t *testing.T) {
+ t.Skip("not supported in FIPS mode")
for i, test := range decryptPKCS1v15SessionKeyTests {
key := []byte("FAIL")
err := DecryptPKCS1v15SessionKey(nil, testRSA2048PrivateKey, decodeBase64(test.in), key)
@@ -151,6 +154,7 @@ func TestEncryptPKCS1v15SessionKey(t *testing.T) {
}
func TestEncryptPKCS1v15DecrypterSessionKey(t *testing.T) {
+ t.Skip("not supported in FIPS mode")
for i, test := range decryptPKCS1v15SessionKeyTests {
plaintext, err := testRSA2048PrivateKey.Decrypt(rand.Reader, decodeBase64(test.in), &PKCS1v15DecryptOptions{SessionKeyLen: 4})
if err != nil {
@@ -270,6 +274,7 @@ func TestUnpaddedSignature(t *testing.T) {
}
func TestShortSessionKey(t *testing.T) {
+ t.Skip("not supported in FIPS mode")
// This tests that attempting to decrypt a session key where the
// ciphertext is too small doesn't run outside the array bounds.
ciphertext, err := EncryptPKCS1v15(rand.Reader, &testRSA2048PrivateKey.PublicKey, []byte{1})
diff --git a/src/crypto/rsa/pss_test.go b/src/crypto/rsa/pss_test.go
index b547a87c71..99e7882866 100644
--- a/src/crypto/rsa/pss_test.go
+++ b/src/crypto/rsa/pss_test.go
@@ -77,6 +77,7 @@ func TestEMSAPSS(t *testing.T) {
// TestPSSGolden tests all the test vectors in pss-vect.txt from
// ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip
func TestPSSGolden(t *testing.T) {
+ t.Skip("SHA1 not supported in boring mode")
inFile, err := os.Open("testdata/pss-vect.txt.bz2")
if err != nil {
t.Fatalf("Failed to open input file: %s", err)
diff --git a/src/crypto/rsa/rsa_test.go b/src/crypto/rsa/rsa_test.go
index 9aa67655ab..2f4e666abb 100644
--- a/src/crypto/rsa/rsa_test.go
+++ b/src/crypto/rsa/rsa_test.go
@@ -123,28 +123,29 @@ func testKeyBasics(t *testing.T, priv *PrivateKey) {
t.Errorf("private exponent too large")
}
- if boring.Enabled() {
- // Cannot call encrypt/decrypt directly. Test via PKCS1v15.
- msg := []byte("hi!")
- if priv.Size() >= 256 {
- enc, err := EncryptPKCS1v15(rand.Reader, &priv.PublicKey, msg)
- if err != nil {
- t.Errorf("EncryptPKCS1v15: %v", err)
- return
- }
- dec, err := DecryptPKCS1v15(rand.Reader, priv, enc)
- if err != nil {
- t.Errorf("DecryptPKCS1v15: %v", err)
- return
- }
- if !bytes.Equal(dec, msg) {
- t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
- }
- } else {
- t.Logf("skipping check for unsupported key less than 2048 bits")
- }
- return
- }
+ if boring.Enabled() {
+ // Cannot call encrypt/decrypt directly. Test via EncryptOAEP.
+ sha256 := sha256.New()
+ msg := []byte("hi!")
+ if priv.Size() >= 256 {
+ enc, err := EncryptOAEP(sha256, rand.Reader, &priv.PublicKey, msg, nil)
+ if err != nil {
+ t.Errorf("EncryptOAEP: %v", err)
+ return
+ }
+ dec, err := DecryptOAEP(sha256, rand.Reader, priv, enc, nil)
+ if err != nil {
+ t.Errorf("DecryptOAEP: %v", err)
+ return
+ }
+ if !bytes.Equal(dec, msg) {
+ t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
+ }
+ } else {
+ t.Logf("skipping check for unsupported key less than 2048 bits")
+ }
+ return
+ }
pub := &priv.PublicKey
m := big.NewInt(42)
@@ -312,6 +312,11 @@ func TestDecryptOAEP(t *testing.T) {
private.PublicKey = PublicKey{N: n, E: test.e}
private.D = d
+ if boring.Enabled() && private.PublicKey.Size() < 256 {
+ t.Logf("skipping check for unsupported key less than 2048 bits")
+ continue
+ }
+ t.Logf("running check for supported key size")
for j, message := range test.msgs {
out, err := DecryptOAEP(sha1, nil, private, message.out, nil)
if err != nil {

128
SOURCES/remove_ed25519vectors_test.patch
View File

@ -1,128 +0,0 @@
From d7cad65ab9179804e9f089ce97bc124e9ef79494 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= <asm@redhat.com>
Date: Wed, 15 Dec 2021 16:02:15 +0100
Subject: [PATCH] Remove ed25519vectors_test.go
---
src/crypto/ed25519/ed25519vectors_test.go | 109 ----------------------
1 file changed, 109 deletions(-)
delete mode 100644 src/crypto/ed25519/ed25519vectors_test.go
diff --git a/src/crypto/ed25519/ed25519vectors_test.go b/src/crypto/ed25519/ed25519vectors_test.go
deleted file mode 100644
index 74fcdcdf4e..0000000000
--- a/src/crypto/ed25519/ed25519vectors_test.go
+++ /dev/null
@@ -1,109 +0,0 @@
-// Copyright 2021 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package ed25519_test
-
-import (
- "crypto/ed25519"
- "encoding/hex"
- "encoding/json"
- "internal/testenv"
- "os"
- "os/exec"
- "path/filepath"
- "testing"
-)
-
-// TestEd25519Vectors runs a very large set of test vectors that exercise all
-// combinations of low-order points, low-order components, and non-canonical
-// encodings. These vectors lock in unspecified and spec-divergent behaviors in
-// edge cases that are not security relevant in most contexts, but that can
-// cause issues in consensus applications if changed.
-//
-// Our behavior matches the "classic" unwritten verification rules of the
-// "ref10" reference implementation.
-//
-// Note that although we test for these edge cases, they are not covered by the
-// Go 1 Compatibility Promise. Applications that need stable verification rules
-// should use github.com/hdevalence/ed25519consensus.
-//
-// See https://hdevalence.ca/blog/2020-10-04-its-25519am for more details.
-func TestEd25519Vectors(t *testing.T) {
- jsonVectors := downloadEd25519Vectors(t)
- var vectors []struct {
- A, R, S, M string
- Flags []string
- }
- if err := json.Unmarshal(jsonVectors, &vectors); err != nil {
- t.Fatal(err)
- }
- for i, v := range vectors {
- expectedToVerify := true
- for _, f := range v.Flags {
- switch f {
- // We use the simplified verification formula that doesn't multiply
- // by the cofactor, so any low order residue will cause the
- // signature not to verify.
- //
- // This is allowed, but not required, by RFC 8032.
- case "LowOrderResidue":
- expectedToVerify = false
- // Our point decoding allows non-canonical encodings (in violation
- // of RFC 8032) but R is not decoded: instead, R is recomputed and
- // compared bytewise against the canonical encoding.
- case "NonCanonicalR":
- expectedToVerify = false
- }
- }
-
- publicKey := decodeHex(t, v.A)
- signature := append(decodeHex(t, v.R), decodeHex(t, v.S)...)
- message := []byte(v.M)
-
- didVerify := ed25519.Verify(publicKey, message, signature)
- if didVerify && !expectedToVerify {
- t.Errorf("#%d: vector with flags %s unexpectedly verified", i, v.Flags)
- }
- if !didVerify && expectedToVerify {
- t.Errorf("#%d: vector with flags %s unexpectedly rejected", i, v.Flags)
- }
- }
-}
-
-func downloadEd25519Vectors(t *testing.T) []byte {
- testenv.MustHaveExternalNetwork(t)
-
- // Download the JSON test file from the GOPROXY with `go mod download`,
- // pinning the version so test and module caching works as expected.
- goTool := testenv.GoToolPath(t)
- path := "filippo.io/mostly-harmless/ed25519vectors@v0.0.0-20210322192420-30a2d7243a94"
- cmd := exec.Command(goTool, "mod", "download", "-json", path)
- // TODO: enable the sumdb once the TryBots proxy supports it.
- cmd.Env = append(os.Environ(), "GONOSUMDB=*")
- output, err := cmd.Output()
- if err != nil {
- t.Fatalf("failed to run `go mod download -json %s`, output: %s", path, output)
- }
- var dm struct {
- Dir string // absolute path to cached source root directory
- }
- if err := json.Unmarshal(output, &dm); err != nil {
- t.Fatal(err)
- }
-
- jsonVectors, err := os.ReadFile(filepath.Join(dm.Dir, "ed25519vectors.json"))
- if err != nil {
- t.Fatalf("failed to read ed25519vectors.json: %v", err)
- }
- return jsonVectors
-}
-
-func decodeHex(t *testing.T, s string) []byte {
- t.Helper()
- b, err := hex.DecodeString(s)
- if err != nil {
- t.Errorf("invalid hex: %v", err)
- }
- return b
-}
--
2.33.1

12
SOURCES/skip_test_rhbz1939923.patch Normal file
View File

@ -0,0 +1,12 @@
diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go
index b1cdabb..09eaace 100644
--- a/src/crypto/x509/x509_test.go
+++ b/src/crypto/x509/x509_test.go
@@ -2993,6 +2993,7 @@ func (bs *brokenSigner) Sign(_ io.Reader, _ []byte, _ crypto.SignerOpts) ([]byte
}
func TestCreateCertificateBrokenSigner(t *testing.T) {
+ t.Skip("TODO Fix me: rhbz#1939923")
template := &Certificate{
SerialNumber: big.NewInt(10),
DNSNames: []string{"example.com"},

120
SPECS/golang.spec
View File

@ -56,7 +56,7 @@
%endif %endif
# Controls what ever we fail on failed tests # Controls what ever we fail on failed tests
%ifarch x86_64 %{arm} aarch64 ppc64le %ifarch x86_64 %{arm} aarch64 ppc64le s390x
%global fail_on_tests 1 %global fail_on_tests 1
%else %else
%global fail_on_tests 0 %global fail_on_tests 0
@ -95,20 +95,28 @@
%global gohostarch s390x %global gohostarch s390x
%endif %endif
%global go_api 1.18 %global go_api 1.19
%global go_version 1.18.10 %global go_version 1.19.6
%global version %{go_version}
%global pkg_release 1 %global pkg_release 1
Name: golang Name: golang
Version: %{go_version} Version: %{version}
Release: 1%{?dist} Release: 2%{?dist}
Summary: The Go Programming Language Summary: The Go Programming Language
# source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain
License: BSD and Public Domain License: BSD and Public Domain
URL: http://golang.org/ URL: http://golang.org/
Source0: https://github.com/golang-fips/go/archive/refs/tags/go%{go_version}-%{pkg_release}-openssl-fips.tar.gz Source0: https://github.com/golang/go/archive/refs/tags/go%{version}.tar.gz
# Go's FIPS mode bindings are now provided as a standalone
# module instead of in tree. This makes it easier to see
# the actual changes vs upstream Go. The module source is
# located at https://github.com/golang-fips/openssl-fips,
# And pre-genetated patches to set up the module for a given
# Go release are located at https://github.com/golang-fips/go.
Source1: https://github.com/golang-fips/go/archive/refs/tags/go%{version}-%{pkg_release}-openssl-fips.tar.gz
# make possible to override default traceback level at build time by setting build tag rpm_crashtraceback # make possible to override default traceback level at build time by setting build tag rpm_crashtraceback
Source1: fedora.go Source2: fedora.go
# The compiler is written in Go. Needs go(1.4+) compiler for build. # The compiler is written in Go. Needs go(1.4+) compiler for build.
# Actual Go based bootstrap compiler provided by above source. # Actual Go based bootstrap compiler provided by above source.
@ -124,10 +132,6 @@ BuildRequires: net-tools
%endif %endif
# For OpenSSL FIPS # For OpenSSL FIPS
BuildRequires: openssl-devel BuildRequires: openssl-devel
# For openssl-fipsinstall
BuildRequires: openssl
# for tests # for tests
BuildRequires: pcre-devel, glibc-static, perl BuildRequires: pcre-devel, glibc-static, perl
@ -137,18 +141,18 @@ Requires: %{name}-src = %{version}-%{release}
Requires: openssl-devel Requires: openssl-devel
Requires: diffutils Requires: diffutils
# we had been just removing the zoneinfo.zip, but that caused tests to fail for users that
# later run `go test -a std`. This makes it only use the zoneinfo.zip where needed in tests.
Patch215: go1.5-zoneinfo_testing_only.patch
# Proposed patch by jcajka https://golang.org/cl/86541 # Proposed patch by jcajka https://golang.org/cl/86541
Patch221: fix_TestScript_list_std.patch Patch221: fix_TestScript_list_std.patch
Patch223: remove_ed25519vectors_test.patch Patch1939923: skip_test_rhbz1939923.patch
Patch224: openssl_deprecated_algorithm_tests.patch # Disables libc static linking tests which
# are incompatible with dlopen in golang-fips
Patch2: disable_static_tests_part1.patch
Patch3: disable_static_tests_part2.patch
Patch225: enable-big-endian-fips.patch Patch4: fix-memory-leak-evp-sign-verify.patch
# Having documentation separate was broken # Having documentation separate was broken
Obsoletes: %{name}-docs < 1.1-4 Obsoletes: %{name}-docs < 1.1-4
@ -237,15 +241,29 @@ Requires: %{name} = %{version}-%{release}
%endif %endif
%prep %prep
%setup -q -n go-go%{go_version}-%{pkg_release}-openssl-fips %setup -q -n go-go%{version}
pushd ..
tar -xf %{SOURCE1}
popd
patch -p1 < ../go-go%{version}-%{pkg_release}-openssl-fips/patches/000-initial-setup.patch
patch -p1 < ../go-go%{version}-%{pkg_release}-openssl-fips/patches/001-initial-openssl-for-fips.patch
# Configure crypto tests
pushd ../go-go%{version}-%{pkg_release}-openssl-fips
ln -s ../go-go%{version} go
./scripts/configure-crypto-tests.sh
popd
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch215 -p1
%patch221 -p1 %patch221 -p1
%patch223 -p1
%patch224 -p1
%patch225 -p1
cp %{SOURCE1} ./src/runtime/ %patch1939923 -p1
cp %{SOURCE2} ./src/runtime/
%build %build
set -xe set -xe
@ -401,6 +419,8 @@ cp -av %{SOURCE100} $RPM_BUILD_ROOT%{_sysconfdir}/gdbinit.d/golang.gdb
# prelink blacklist # prelink blacklist
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d
cp -av %{SOURCE101} $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d/golang.conf cp -av %{SOURCE101} $RPM_BUILD_ROOT%{_sysconfdir}/prelink.conf.d/golang.conf
# Quick fix for the rhbz#2014704
sed -i 's/const defaultGO_LDSO = `.*`/const defaultGO_LDSO = ``/' $RPM_BUILD_ROOT%{goroot}/src/internal/buildcfg/zbootstrap.go sed -i 's/const defaultGO_LDSO = `.*`/const defaultGO_LDSO = ``/' $RPM_BUILD_ROOT%{goroot}/src/internal/buildcfg/zbootstrap.go
%check %check
@ -439,23 +459,19 @@ export GO_TEST_RUN=""
./run.bash --no-rebuild -v -v -v -k $GO_TEST_RUN ./run.bash --no-rebuild -v -v -v -k $GO_TEST_RUN
# tests timeout on ppc64le due to
# https://bugzilla.redhat.com/show_bug.cgi?id=2118776
%ifnarch ppc64le
export OPENSSL_FORCE_FIPS_MODE=1
# Run tests with FIPS enabled. # Run tests with FIPS enabled.
export GOLANG_FIPS=1
export OPENSSL_FORCE_FIPS_MODE=1
pushd crypto pushd crypto
# Run all crypto tests but skip TLS, we will run FIPS specific TLS tests later # Run all crypto tests but skip TLS, we will run FIPS specific TLS tests later
GOLANG_FIPS=1 go test $(go list ./... | grep -v tls) -v go test $(go list ./... | grep -v tls) -v
# Check that signature functions have parity between boring and notboring # Check that signature functions have parity between boring and notboring
CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v CGO_ENABLED=0 go test $(go list ./... | grep -v tls) -v
popd popd
# Run all FIPS specific TLS tests # Run all FIPS specific TLS tests
pushd crypto/tls pushd crypto/tls
GOLANG_FIPS=1 go test -v -run "Boring" go test -v -run "Boring"
popd popd
%endif
%else %else
./run.bash --no-rebuild -v -v -v -k || : ./run.bash --no-rebuild -v -v -v -k || :
%endif %endif
@ -463,7 +479,7 @@ cd ..
%files %files
%doc AUTHORS CONTRIBUTORS LICENSE PATENTS %doc LICENSE PATENTS
# VERSION has to be present in the GOROOT, for `go install std` to work # VERSION has to be present in the GOROOT, for `go install std` to work
%doc %{goroot}/VERSION %doc %{goroot}/VERSION
%dir %{goroot}/doc %dir %{goroot}/doc
@ -517,21 +533,37 @@ cd ..
%endif %endif
%changelog %changelog
* Fri Mar 03 2023 Alejandro Sáez <asm@redhat.com> - 1.18.9-2 * Wed Mar 29 2023 David Benoit <dbenoit@redhat.com> - 1.19.6-2
- Update to Go 1.18.10 - Rebuild without changes
- Remove ./ppc64le-internal-linker-fix.patch - Related: rhbz#2175174
- Resolves: rhbz#2174416
* Tue Dec 20 2022 David Benoit <dbenoit@redhat.com> - 1.18.9-1 * Wed Mar 01 2023 David Benoit <dbenoit@redhat.com> - 1.19.6-1
- Rebase to Go 1.18.9 - Rebase to Go 1.19.6
- Enable big endian support for fips mode - Resolves: rhbz#2174429
- Fix memory leak
- Resolves: rhbz#2157602
- Enable tests in check phase
* Wed Dec 21 2022 David Benoit <dbenoit@redhat.com> - 1.19.4-1
- Rebase to Go 1.19.4
- Fix ppc64le linker issue - Fix ppc64le linker issue
- Resolves: rhbz#2144547 - Remove defunct patches
- Resolves: rhbz#2149311 - Remove downstream generated FIPS mode patches
- Add golang-fips/go as the source for FIPS mode patches
- Resolves: rhbz#2144539
* Tue Aug 16 2022 David Benoit <dbenoit@redhat.com> - 1.18.4-3 * Wed Nov 30 2022 David Benoit <dbenoit@redhat.com> - 1.19.2-2
- Temporarily disable crypto tests on ppc64le - Fix endian issue in FIPS mode
- Related: rhbz#2109180 - Resolves: rhbz#1966992
* Fri Oct 21 2022 David Benoit <dbenoit@redhat.com> - 1.19.2-1
- Update go to version 1.19.2
- Resolves: rhbz#2134407
* Wed Sep 14 2022 David Benoit <dbenoit@redhat.com> - 1.19.1-2
- Rebase to Go 1.19.1
- Temporarily disable crypto tests
- Resolves: rhbz#2131028
* Wed Aug 10 2022 Alejandro Sáez <asm@redhat.com> - 1.18.4-2 * Wed Aug 10 2022 Alejandro Sáez <asm@redhat.com> - 1.18.4-2
- Update to Go 1.18.4 - Update to Go 1.18.4