mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-01 21:23:51 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/go: security bump to version 1.26.1

Browse Source 
Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.

To support this we use Go version 1.25.8 as the version for
go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
go-bootstrap-stage5.

Go version 1.25.8 is the latest Go version we can build using
go-bootstrap-stage4.

The package build for go-bootstrap-stage5 is effectively identical to
go-bootstrap-stage4 with only the Go version and stage number changed.

Go 1.28 is expected to require a minor release of Go 1.26 for bootstrap.

Fixes the following security vulnerabilities:

- CVE-2026-25679: net/url: reject IPv6 literal not at start of host
- CVE-2026-27142: html/template: URLs in meta attribute actions not escaped
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
- CVE-2026-27138: crypto/x509: panic in name constraint checking: certificates
- CVE-2026-27139: os: FileInfo can escape from a Root

For full release notes, see:
https://go.dev/doc/devel/release#go1.26.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Christian Stewart
2026-03-12 00:57:22 -07:00
committed by Julien Olivain
parent 42a29e8864
commit 43d1323196
8 changed files with 147 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
package/go/Config.in.host
View File

@@ -2,7 +2,7 @@
config BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
bool
default y
depends on BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE4_ARCH_SUPPORTS || BR2_PACKAGE_HOST_GO_BIN_HOST_ARCH_SUPPORTS
depends on BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE5_ARCH_SUPPORTS || BR2_PACKAGE_HOST_GO_BIN_HOST_ARCH_SUPPORTS
# See https://go.dev/doc/install/source#environment
# See src/go/build/syslist.go for the list of supported architectures
depends on (BR2_arm && BR2_TOOLCHAIN_SUPPORTS_PIE) || BR2_aarch64 \
@@ -34,7 +34,7 @@ config BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS
config BR2_PACKAGE_HOST_GO_HOST_ARCH_SUPPORTS
bool
default y
depends on BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE4_ARCH_SUPPORTS || BR2_PACKAGE_HOST_GO_BIN_HOST_ARCH_SUPPORTS
depends on BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE5_ARCH_SUPPORTS || BR2_PACKAGE_HOST_GO_BIN_HOST_ARCH_SUPPORTS
# CGO linking for the host. Since we use the same compiler for target
# and host, if the target can't do CGO linking, then the host can't.
@@ -57,7 +57,7 @@ if BR2_PACKAGE_HOST_GO
choice
prompt "Go compiler variant"
default BR2_PACKAGE_HOST_GO_SRC if BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE4_ARCH_SUPPORTS
default BR2_PACKAGE_HOST_GO_SRC if BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE5_ARCH_SUPPORTS
default BR2_PACKAGE_HOST_GO_BIN if BR2_PACKAGE_HOST_GO_BIN_HOST_ARCH_SUPPORTS
help
Select a Go compiler variant.
@@ -66,7 +66,7 @@ choice
config BR2_PACKAGE_HOST_GO_SRC
bool "host go (source)"
depends on BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE4_ARCH_SUPPORTS
depends on BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE5_ARCH_SUPPORTS
help
This package will build the go compiler for the host.
@@ -91,3 +91,4 @@ source "package/go/go-bootstrap-stage1/Config.in.host"
source "package/go/go-bootstrap-stage2/Config.in.host"
source "package/go/go-bootstrap-stage3/Config.in.host"
source "package/go/go-bootstrap-stage4/Config.in.host"
source "package/go/go-bootstrap-stage5/Config.in.host"

71
package/go/go-bootstrap-stage5/0001-cmd-dist-set-buildvcs-false-when-building-go-bootstr.patch Normal file
View File

@@ -0,0 +1,71 @@
From 6b05378097c6a386ed9912d2471976dc39504e86 Mon Sep 17 00:00:00 2001
From: Christian Stewart <christian@aperture.us>
Date: Thu, 27 Jul 2023 21:28:47 -0700
Subject: [PATCH] cmd/dist: set buildvcs=false when building go-bootstrap
When building go-bootstrap as part of the make.bash process, the cmd/dist
invokes the bootstrap Go compiler to build the go_bootstrap tool:
${GOROOT_BOOTSTRAP}/bin/go install -tags=math_big_pure_go compiler_bootstrap purego bootstrap/cmd/...
If there is an invalid .git directory in a parent of ${GOROOT_BOOTSTRAP},
make.bash will fail. Reproduction of the issue:
mkdir go-issue-61620
cd ./go-issue-61620
wget https://go.dev/dl/go1.19.11.src.tar.gz
mkdir go-bootstrap
tar -xf go1.19.11.src.tar.gz -C ./go-bootstrap --strip-components=1
cd ./go-bootstrap/src/
bash make.bash
cd ../../
wget https://go.dev/dl/go1.20.6.src.tar.gz
mkdir go
tar -xf go1.20.6.src.tar.gz -C ./go/ --strip-components=1
printf "gitdir: ../../does/not/exist/.git" > ./.git
cd ./go/src/
GOROOT_BOOTSTRAP=$(pwd)/../../go-bootstrap/ bash make.bash
The build fails with the following error:
Building Go toolchain1 using [snip]/go-1.19.10.
error obtaining VCS status: exit status 128
Use -buildvcs=false to disable VCS stamping.
go tool dist: FAILED: [snip]/go-1.19.10/bin/go install -tags=math_big_pure_go \
compiler_bootstrap purego bootstrap/cmd/...: exit status 1
This change unconditionally sets -buildvcs=false when compiling go-bootstrap. We
don't need the revision information in those binaries anyway. Setting this flag
was previously not done as we were unsure if the go-bootstrap compiler would be
new enough to support the buildvcs build flag. Since Go 1.20.x, Go 1.19.x is the
minimum version for go-bootstrap, and supports -buildvcs=false. We can now set
-buildvcs=false without worrying about compatibility.
Related: https://github.com/golang/go/issues/54852
Fixes: https://github.com/golang/go/issues/61620
Upstream: https://github.com/golang/go/pull/61621
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
---
src/cmd/dist/buildtool.go | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/cmd/dist/buildtool.go b/src/cmd/dist/buildtool.go
index a528d7aa76..3b411d6ebb 100644
--- a/src/cmd/dist/buildtool.go
+++ b/src/cmd/dist/buildtool.go
@@ -221,6 +221,9 @@ func bootstrapBuildTools() {
cmd := []string{
pathf("%s/bin/go", goroot_bootstrap),
"install",
+ // Fixes cases where an invalid .git is present in a parent of GOROOT_BOOTSTRAP.
+ // See: https://github.com/golang/go/issues/61620
+ "-buildvcs=false",
"-tags=math_big_pure_go compiler_bootstrap purego",
}
if vflag > 0 {
--
2.41.0

4
package/go/go-bootstrap-stage5/Config.in.host Normal file
View File

@@ -0,0 +1,4 @@
config BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE5_ARCH_SUPPORTS
bool
default y
depends on BR2_PACKAGE_HOST_GO_BOOTSTRAP_STAGE4_ARCH_SUPPORTS

3
package/go/go-bootstrap-stage5/go-bootstrap-stage5.hash Normal file
View File

@@ -0,0 +1,3 @@
# From https://go.dev/dl
sha256 e988d4a2446ac7fe3f6daa089a58e9936a52a381355adec1c8983230a8d6c59e go1.25.8.src.tar.gz
sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE

54
package/go/go-bootstrap-stage5/go-bootstrap-stage5.mk Normal file
View File

@@ -0,0 +1,54 @@
################################################################################
#
# go-bootstrap-stage5
#
################################################################################
# Use last Go version that go-bootstrap-stage4 can build: v1.25.x
# See https://go.dev/doc/go1.26#bootstrap
GO_BOOTSTRAP_STAGE5_VERSION = 1.25.8
GO_BOOTSTRAP_STAGE5_SITE = https://go.dev/dl
GO_BOOTSTRAP_STAGE5_SOURCE = go$(GO_BOOTSTRAP_STAGE5_VERSION).src.tar.gz
GO_BOOTSTRAP_STAGE5_LICENSE = BSD-3-Clause
GO_BOOTSTRAP_STAGE5_LICENSE_FILES = LICENSE
# Use go-bootstrap-stage4 to bootstrap.
HOST_GO_BOOTSTRAP_STAGE5_DEPENDENCIES = host-go-bootstrap-stage4
HOST_GO_BOOTSTRAP_STAGE5_ROOT = $(HOST_DIR)/lib/go-$(GO_BOOTSTRAP_STAGE5_VERSION)
# The go build system is not compatible with ccache, so use
# HOSTCC_NOCCACHE. See https://github.com/golang/go/issues/11685.
HOST_GO_BOOTSTRAP_STAGE5_MAKE_ENV = \
GO111MODULE=off \
GOCACHE=$(HOST_GO_HOST_CACHE) \
GOROOT_BOOTSTRAP=$(HOST_GO_BOOTSTRAP_STAGE4_ROOT) \
GOROOT_FINAL=$(HOST_GO_BOOTSTRAP_STAGE5_ROOT) \
GOROOT="$(@D)" \
GOBIN="$(@D)/bin" \
GOOS=linux \
CC=$(HOSTCC_NOCCACHE) \
CXX=$(HOSTCXX_NOCCACHE) \
CGO_ENABLED=0
define HOST_GO_BOOTSTRAP_STAGE5_BUILD_CMDS
cd $(@D)/src && \
$(HOST_GO_BOOTSTRAP_STAGE5_MAKE_ENV) ./make.bash $(if $(VERBOSE),-v)
endef
define HOST_GO_BOOTSTRAP_STAGE5_INSTALL_CMDS
$(INSTALL) -D -m 0755 $(@D)/bin/go $(HOST_GO_BOOTSTRAP_STAGE5_ROOT)/bin/go
$(INSTALL) -D -m 0755 $(@D)/bin/gofmt $(HOST_GO_BOOTSTRAP_STAGE5_ROOT)/bin/gofmt
cp -a $(@D)/lib $(HOST_GO_BOOTSTRAP_STAGE5_ROOT)/
mkdir -p $(HOST_GO_BOOTSTRAP_STAGE5_ROOT)/pkg
cp -a $(@D)/pkg/include $(HOST_GO_BOOTSTRAP_STAGE5_ROOT)/pkg/
cp -a $(@D)/pkg/tool $(HOST_GO_BOOTSTRAP_STAGE5_ROOT)/pkg/
# The Go sources must be installed to the host/ tree for the Go stdlib.
cp -a $(@D)/src $(HOST_GO_BOOTSTRAP_STAGE5_ROOT)/
endef
$(eval $(host-generic-package))

4
package/go/go-src/go-src.mk
View File

@@ -16,7 +16,7 @@ GO_SRC_CPE_ID_PRODUCT = go
HOST_GO_SRC_PROVIDES = host-go
HOST_GO_SRC_DEPENDENCIES = \
host-go-bootstrap-stage4 \
host-go-bootstrap-stage5 \
$(HOST_GO_DEPENDENCIES_CGO)
ifeq ($(BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS),y)
@@ -37,7 +37,7 @@ endif
HOST_GO_SRC_MAKE_ENV = \
GO111MODULE=off \
GOCACHE=$(HOST_GO_HOST_CACHE) \
GOROOT_BOOTSTRAP=$(HOST_GO_BOOTSTRAP_STAGE4_ROOT) \
GOROOT_BOOTSTRAP=$(HOST_GO_BOOTSTRAP_STAGE5_ROOT) \
GOROOT_FINAL=$(HOST_GO_ROOT) \
GOROOT="$(@D)" \
GOBIN="$(@D)/bin" \

14
package/go/go.hash
View File

@@ -1,9 +1,9 @@
# sha256 checksum from https://go.dev/dl/
sha256 178f2832820274b43e177d32f06a3ebb0129e427dd20a5e4c88df2c1763cf10a go1.25.7.src.tar.gz
sha256 2866517e9ca81e6a2e85a930e9b11bc8a05cfeb2fc6dc6cb2765e7fb3c14b715 go1.25.7.linux-386.tar.gz
sha256 12e6d6a191091ae27dc31f6efc630e3a3b8ba409baf3573d955b196fdf086005 go1.25.7.linux-amd64.tar.gz
sha256 ba611a53534135a81067240eff9508cd7e256c560edd5d8c2fef54f083c07129 go1.25.7.linux-arm64.tar.gz
sha256 1ba07e0eb86b839e72467f4b5c7a5597d07f30bcf5563c951410454f7cda5266 go1.25.7.linux-armv6l.tar.gz
sha256 42124c0edc92464e2b37b2d7fcd3658f0c47ebd6a098732415a522be8cb88e3f go1.25.7.linux-ppc64le.tar.gz
sha256 c6b77facf666dc68195ecab05dbf0ebb4e755b2a8b7734c759880557f1c29b0c go1.25.7.linux-s390x.tar.gz
sha256 3172293d04b209dc1144698e7ba13f0477f6ba8c5ffd0be66c20fdbc9785dfbb go1.26.1.src.tar.gz
sha256 da75d696c6b9440fe9fb6418429f29eaeee947707ee8c6ddb567c558051a1cc2 go1.26.1.linux-386.tar.gz
sha256 031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a go1.26.1.linux-amd64.tar.gz
sha256 a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7 go1.26.1.linux-arm64.tar.gz
sha256 c9937198994dc173b87630a94a0d323442bef81bf7589b1170d55a8ebf759bda go1.26.1.linux-armv6l.tar.gz
sha256 f56eed002998f5f51fa07fd4ed0c5de5e02d51cec7a4007f771c7576620d9d45 go1.26.1.linux-ppc64le.tar.gz
sha256 60fe623ef63e6338c055ec0e0e3f4fa85c97a056de2d2f6ee38591e2bfa9cdde go1.26.1.linux-s390x.tar.gz
sha256 911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad LICENSE

2
package/go/go.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
GO_VERSION = 1.25.7
GO_VERSION = 1.26.1
HOST_GO_GOPATH = $(HOST_DIR)/share/go-path
HOST_GO_HOST_CACHE = $(HOST_DIR)/share/host-go-cache