From c3f86964ee733e30425a4e7f977a9ad0b418bd61 Mon Sep 17 00:00:00 2001 From: dbenoit Date: Tue, 12 May 2026 13:23:33 -0400 Subject: [PATCH 1/4] Update to Go 1.26.3 (fips-1) Resolves: RHEL-175604 --- .gitignore | 2 ++ golang.spec | 4 ++-- sources | 4 ++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 4081eaa..cc0b36a 100644 --- a/.gitignore +++ b/.gitignore @@ -181,3 +181,5 @@ /go1.26.1-1-openssl-fips.tar.gz /go1.26.2.src.tar.gz /go1.26.2-2-openssl-fips.tar.gz +/go1.26.3.src.tar.gz +/go1.26.3-1-openssl-fips.tar.gz diff --git a/golang.spec b/golang.spec index 31c1c90..8b2734a 100644 --- a/golang.spec +++ b/golang.spec @@ -102,11 +102,11 @@ %global go_api 1.26 # Use only for prerelease versions #global go_prerelease rc3 -%global go_patch 2 +%global go_patch 3 %global go_version %{go_api}%{?go_patch:.%{go_patch}}%{?go_prerelease:~%{go_prerelease}} %global go_source %{go_api}%{?go_patch:.%{go_patch}}%{?go_prerelease} # Go FIPS package release -%global pkg_release 2 +%global pkg_release 1 # For rpmdev-bumpspec and releng automation. %global baserelease 1 diff --git a/sources b/sources index 701d88c..80929a3 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (go1.26.2.src.tar.gz) = 370773727c0e6fbf0acd534726938aaaa03ff785f0634c258c94a7a896e9a27acc0ba57120967f711a942e9e275cec46251a194d6f84ba15f28b5dcf0efed673 -SHA512 (go1.26.2-2-openssl-fips.tar.gz) = 3b086cd73f7520eb786b866043c31f0d6a75294fbbee9390adb688ee7dd5666183789897cb9ac7dfbaa993310ae6decec9889eecb4c3f0bd708b1d660e3330c9 +SHA512 (go1.26.3.src.tar.gz) = 9c673a9ec7783a345b6294984486a5c76ba52de3eb72c95cbd68626312d100c50adb7a3ed15c93d1dc9ce9969b0f6fb4b86c87771118091cc7b0297afaf74fec +SHA512 (go1.26.3-1-openssl-fips.tar.gz) = dddc3d4bead27ec546a8304afd915646ee9707d6563e77d7579c7cbae2a8eb6597ffb955e1e55fddbcb66aee8bba812b6b4b3bd3af3c6d3a04c31be5f982ec65 SHA512 (compiler-rt-18.1.8.src.tar.xz) = fb8795bd51c9b005c2ad1975591e9e2715740d6407ccad41379f136ef2e8d24ded8b97b01165a3ae4bd377119a6a1049ca05d3220404fc12bee86114ff2bff0d From 1f69623fe79b56093503dfacb3577c84f0be243c Mon Sep 17 00:00:00 2001 From: dbenoit Date: Wed, 13 May 2026 11:00:58 -0400 Subject: [PATCH 2/4] Remove ld.bfd patch for aarch64 Fixed upstream via https://go-review.googlesource.com/c/go/+/740480 Related: RHEL-175604 --- 0006-Default-to-ld.bfd-on-ARM64.patch | 46 --------------------------- golang.spec | 1 - 2 files changed, 47 deletions(-) delete mode 100644 0006-Default-to-ld.bfd-on-ARM64.patch diff --git a/0006-Default-to-ld.bfd-on-ARM64.patch b/0006-Default-to-ld.bfd-on-ARM64.patch deleted file mode 100644 index 369b4e6..0000000 --- a/0006-Default-to-ld.bfd-on-ARM64.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 46ec67413008607e2150e3395668e54e538c5b6b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= -Date: Wed, 19 Jun 2024 10:18:58 +0200 -Subject: [PATCH] Default to ld.bfd on ARM64 - ---- - src/cmd/link/internal/ld/lib.go | 20 +++++++------------- - 1 file changed, 7 insertions(+), 13 deletions(-) - -diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go -index eab74dc328..b401f58727 100644 ---- a/src/cmd/link/internal/ld/lib.go -+++ b/src/cmd/link/internal/ld/lib.go -@@ -1620,22 +1620,16 @@ func (ctxt *Link) hostlink() { - } - - if ctxt.Arch.InFamily(sys.ARM64) && buildcfg.GOOS == "linux" { -- // On ARM64, the GNU linker will fail with -- // -znocopyreloc if it thinks a COPY relocation is -- // required. Switch to gold. -- // https://sourceware.org/bugzilla/show_bug.cgi?id=19962 -- // https://go.dev/issue/22040 -- altLinker = "gold" -- -- // If gold is not installed, gcc will silently switch -- // back to ld.bfd. So we parse the version information -- // and provide a useful error if gold is missing. -+ // Use ld.bfd as the default linker -+ altLinker = "bfd" -+ -+ // Provide a useful error if ld.bfd is missing - name, args := flagExtld[0], flagExtld[1:] -- args = append(args, "-fuse-ld=gold", "-Wl,--version") -+ args = append(args, "-fuse-ld=bfd", "-Wl,--version") - cmd := exec.Command(name, args...) - if out, err := cmd.CombinedOutput(); err == nil { -- if !bytes.Contains(out, []byte("GNU gold")) { -- log.Fatalf("ARM64 external linker must be gold (issue #15696, 22040), but is not: %s", out) -+ if !bytes.Contains(out, []byte("GNU ld")) { -+ log.Fatalf("ARM64 external linker must be ld.bfd, but is not: %s", out) - } - } - } --- -2.45.1 - diff --git a/golang.spec b/golang.spec index 8b2734a..f84a4a0 100644 --- a/golang.spec +++ b/golang.spec @@ -197,7 +197,6 @@ Requires: %{name}-race = %{version}-%{release} %endif Patch1: 0001-Modify-go.env.patch -Patch6: 0006-Default-to-ld.bfd-on-ARM64.patch # Related: https://sourceware.org/bugzilla/show_bug.cgi?id=33204 Patch7: revert_dwarf5.patch Patch8: skip-TestTerminalSignal-in-container.patch From dd8136324cfe8110cbb8a7b2883a8c8ad33cefbe Mon Sep 17 00:00:00 2001 From: dbenoit Date: Wed, 13 May 2026 11:26:53 -0400 Subject: [PATCH 3/4] Conditionalize baseline ISA Related: RHEL-175604 --- golang.spec | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/golang.spec b/golang.spec index f84a4a0..f146775 100644 --- a/golang.spec +++ b/golang.spec @@ -99,6 +99,20 @@ %global gohostarch riscv64 %endif +# Set the RHEL architecture baseline. +%if 0%{?rhel} < 9 +%global goamd64 v1 +%global goppc64 power8 +%else +%if 0%{?rhel} < 10 +%global goamd64 v2 +%global goppc64 power8 +%else +%global goamd64 v3 +%global goppc64 power9 +%endif +%endif + %global go_api 1.26 # Use only for prerelease versions #global go_prerelease rc3 @@ -342,6 +356,14 @@ Binary library objects for Go's race detector. # Copy fedora.go to ./src/runtime/ cp %{SOURCE2} ./src/runtime/ sed -i '1s/$/ (%{?rhel:Red Hat} %{version}-%{release})/' VERSION + +# Historically the ISA baselines have been set in modify-go.env.patch. +# This will prevent us sharing a specfile across major RHEL versions. +# As such, we must override the baselines set in the patch file. +sed -iE "s/^.*baseline for RHEL.*$//" go.env +sed -i "s/GOAMD64=.*/GOAMD64=%{goamd64}/" go.env +sed -i "s/GOPPC64=.*/GOPPC64=%{goppc64}/" go.env + # Delete the bundled race detector objects. find ./src/runtime/race/ -name "race_*.syso" -exec rm {} \; # Delete the boring binary blob. We use the system OpenSSL instead. From fd1ccb57079131ae316723fcfe6928b063c53697 Mon Sep 17 00:00:00 2001 From: dbenoit Date: Thu, 14 May 2026 09:41:31 -0400 Subject: [PATCH 4/4] Set conditional ISA for bootstrap Related: RHEL-175604 --- golang.spec | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/golang.spec b/golang.spec index f146775..b8d92a1 100644 --- a/golang.spec +++ b/golang.spec @@ -425,7 +425,7 @@ popd cp "${tsan_go_dir}"/race_linux_amd64.syso ./src/runtime/race/internal/amd64v3/race_linux.syso pushd "${tsan_go_dir}" - CFLAGS="%{tsan_buildflags} %{tsan_optflag}" CC=clang GOAMD64=v3 ./buildgo.sh + CFLAGS="%{tsan_buildflags} %{tsan_optflag}" CC=clang GOAMD64=v1 ./buildgo.sh popd cp "${tsan_go_dir}"/race_linux_amd64.syso ./src/runtime/race/internal/amd64v1/race_linux.syso @@ -449,8 +449,8 @@ export GOROOT_FINAL=%{goroot} export GOHOSTOS=linux export GOHOSTARCH=%{gohostarch} -export GOAMD64=v3 -export GOPPC64='power9' +export GOAMD64=%{goamd64} +export GOPPC64=%{goppc64} pushd src # use our gcc options for this build, but store gcc as default for compiler @@ -460,8 +460,8 @@ export CC="gcc" export CC_FOR_TARGET="gcc" export GOOS=linux export GOARCH=%{gohostarch} -export GOAMD64=v3 -export GOPPC64='power9' +export GOAMD64=%{goamd64} +export GOPPC64=%{goppc64} DEFAULT_GO_LD_FLAGS="" %if !%{external_linker} @@ -618,8 +618,8 @@ go env export CC="gcc" export CFLAGS="$RPM_OPT_FLAGS" export LDFLAGS="$RPM_LD_FLAGS" -export GOAMD64=v3 -export GOPPC64='power9' +export GOAMD64=%{goamd64} +export GOPPC64=%{goppc64} %if !%{external_linker} export GO_LDFLAGS="-linkmode internal" %else