From 4f5fd12f607da88ac021a5dda61a4da8cadc26da Mon Sep 17 00:00:00 2001 From: Nan Liu Date: Thu, 6 Aug 2026 22:02:30 +0000 Subject: [PATCH] feat(golang): source Azure Linux golang from the Microsoft build of Go Azure Linux 4.0 now ships a single golang toolchain sourced from Microsoft build of Go instead of Fedora upstream. The golang component builds the Microsoft build of Go 1.26.5-2 source tree using Fedora's golang packaging (F44, pinned 77411fa), so it keeps the full Fedora subpackage split (golang, -bin, -src, -docs, -misc, -tests) and remains a drop-in for consumers that BuildRequire golang-bin / golang-src. - Replace the Fedora golang spec source with the Microsoft build of Go release archive. - Provide msft-golang for compatibility; keep the standard golang/go provides. - Build every tool with GOEXPERIMENT=nodwarf5 (AzL debugedit compatibility) on top of Microsoft build of Go's default systemcrypto (OpenSSL) backend, bootstrapping from the distro golang toolchain. - Skip crypto/rsa PSS and testing/cryptotest ML-KEM tests that fail under the OpenSSL backend with system OpenSSL 3.5. - Add explicit runtime Requires (auto dep generation is disabled via __find_requires): openssl, SymCrypt >= 103.6.0-1, SymCrypt-OpenSSL >= 1.6.1-1. - Disable the Microsoft build of Go toolchain telemetry by default (opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1); enable it in the cmd/go test harness so the telemetry suite still passes. --- .../golang/0005-Set-nodwarf5-in-go.env.patch | 13 ++ ...ip-openssl-incompatible-crypto-tests.patch | 37 +++++ ...Disable-msft-go-telemetry-by-default.patch | 37 +++++ base/comps/golang/golang.comp.toml | 20 ++- ...-microsoft-build-of-go-source.overlay.toml | 15 ++ ...lease-from-microsoft-revision.overlay.toml | 9 ++ .../0003-msft-golang-provide.overlay.toml | 9 ++ .../0004-symcrypt-fips-providers.overlay.toml | 21 +++ ...against-microsoft-build-of-go.overlay.toml | 44 +++++ ...ip-openssl-incompatible-tests.overlay.toml | 8 + .../0007-disable-telemetry.overlay.toml | 8 + locks/golang.lock | 8 +- specs/g/golang/0001-Modify-go.env.patch | 42 ----- .../golang/0005-Set-nodwarf5-in-go.env.patch | 13 ++ .../0006-Default-to-ld.bfd-on-ARM64.patch | 46 ------ ...ip-openssl-incompatible-crypto-tests.patch | 37 +++++ ...Disable-msft-go-telemetry-by-default.patch | 37 +++++ specs/g/golang/golang.spec | 150 ++++++++++++------ specs/g/golang/sources | 2 +- 19 files changed, 407 insertions(+), 149 deletions(-) create mode 100644 base/comps/golang/0005-Set-nodwarf5-in-go.env.patch create mode 100644 base/comps/golang/0006-Skip-openssl-incompatible-crypto-tests.patch create mode 100644 base/comps/golang/0007-Disable-msft-go-telemetry-by-default.patch create mode 100644 base/comps/golang/overlays/0001-microsoft-build-of-go-source.overlay.toml create mode 100644 base/comps/golang/overlays/0002-release-from-microsoft-revision.overlay.toml create mode 100644 base/comps/golang/overlays/0003-msft-golang-provide.overlay.toml create mode 100644 base/comps/golang/overlays/0004-symcrypt-fips-providers.overlay.toml create mode 100644 base/comps/golang/overlays/0005-build-against-microsoft-build-of-go.overlay.toml create mode 100644 base/comps/golang/overlays/0006-skip-openssl-incompatible-tests.overlay.toml create mode 100644 base/comps/golang/overlays/0007-disable-telemetry.overlay.toml delete mode 100644 specs/g/golang/0001-Modify-go.env.patch create mode 100644 specs/g/golang/0005-Set-nodwarf5-in-go.env.patch delete mode 100644 specs/g/golang/0006-Default-to-ld.bfd-on-ARM64.patch create mode 100644 specs/g/golang/0006-Skip-openssl-incompatible-crypto-tests.patch create mode 100644 specs/g/golang/0007-Disable-msft-go-telemetry-by-default.patch diff --git a/base/comps/golang/0005-Set-nodwarf5-in-go.env.patch b/base/comps/golang/0005-Set-nodwarf5-in-go.env.patch new file mode 100644 index 00000000000..b768bf834f1 --- /dev/null +++ b/base/comps/golang/0005-Set-nodwarf5-in-go.env.patch @@ -0,0 +1,13 @@ +diff --git a/go.env b/go.env +--- a/go.env ++++ b/go.env +@@ -12,3 +12,6 @@ GOSUMDB=sum.golang.org + # to a Go toolchain not built by Microsoft, and we want to avoid that. + # See https://go.dev/doc/toolchain for details. + GOTOOLCHAIN=local ++ ++# Keep DWARF v4 until Azure Linux debugedit supports DWARF v5. ++GOEXPERIMENT=nodwarf5 + +-- +2.50.1 \ No newline at end of file diff --git a/base/comps/golang/0006-Skip-openssl-incompatible-crypto-tests.patch b/base/comps/golang/0006-Skip-openssl-incompatible-crypto-tests.patch new file mode 100644 index 00000000000..4035f63d348 --- /dev/null +++ b/base/comps/golang/0006-Skip-openssl-incompatible-crypto-tests.patch @@ -0,0 +1,37 @@ +Skip crypto tests incompatible with the Microsoft build of Go OpenSSL backend + +TestPSSGolden/TestPSSSigning use SHA-1 RSA-PSS, which the system OpenSSL +provider rejects. TestSetGlobalRandom's mlkem.GenerateKey768 subtest asserts a +golden ML-KEM key from a deterministic RNG that the OpenSSL backend does not +consume; the skip is scoped to that subtest so the rand.Read, rand.Reader, +ecdsa.GenerateKey, and cryptocustomrand subtests keep running. These are +backend policy differences, not defects. +--- +--- a/src/crypto/rsa/pss_test.go 2026-08-03 22:47:04.746315785 +0000 ++++ b/src/crypto/rsa/pss_test.go 2026-08-03 22:47:04.746315785 +0000 +@@ -26,6 +26,7 @@ + // TestPSSGolden tests all the test vectors in pss-vect.txt from + // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip + func TestPSSGolden(t *testing.T) { ++ t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS") + inFile, err := os.Open("testdata/pss-vect.txt.bz2") + if err != nil { + t.Fatalf("Failed to open input file: %s", err) +@@ -153,6 +154,7 @@ + } + + func TestPSSSigning(t *testing.T) { ++ t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS") + var saltLengthCombinations = []struct { + signSaltLength, verifySaltLength int + good, fipsGood bool +--- a/src/testing/cryptotest/rand_test.go 2026-08-03 22:47:04.766315745 +0000 ++++ b/src/testing/cryptotest/rand_test.go 2026-08-03 22:47:04.766315745 +0000 +@@ -96,6 +96,7 @@ + + // A direct internal use of drbg.Read. + t.Run("mlkem.GenerateKey768", func(t *testing.T) { ++ t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; ML-KEM key generation does not consume the deterministic test RNG. The other TestSetGlobalRandom subtests pass and remain enabled.") + exp, err := mlkem.NewDecapsulationKey768(seed1) + if err != nil { + t.Fatalf("mlkem.NewDecapsulationKey768: %v", err) diff --git a/base/comps/golang/0007-Disable-msft-go-telemetry-by-default.patch b/base/comps/golang/0007-Disable-msft-go-telemetry-by-default.patch new file mode 100644 index 00000000000..bc15768dfad --- /dev/null +++ b/base/comps/golang/0007-Disable-msft-go-telemetry-by-default.patch @@ -0,0 +1,37 @@ +Disable Microsoft build of Go toolchain telemetry by default + +Azure Linux ships the Microsoft build of Go with the Microsoft-specific +AppInsights telemetry turned off by default. Upstream starts it for +`go build`, `go install`, and `go run` unless the environment variable +MS_GOTOOLCHAIN_TELEMETRY_ENABLED=0 is set. That variable is read with +os.Getenv (not the `go env` / go.env configuration) and is evaluated before +the go command normalizes its environment, so a package cannot reliably set +it for every invocation. Flip the gate to opt-in instead: Microsoft telemetry +runs only when MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 is explicitly set. + +This does not affect the separate upstream Go telemetry, which defaults to +"local" mode and uploads nothing unless the user runs `go telemetry on`. + +The cmd/go script test harness asserts that an App Insights request is +recorded whenever `go build`/`install`/`run` is invoked, which assumed the +upstream default-on behavior. Now that telemetry is opt-in, the harness sets +MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 for the go subprocesses it spawns so the +telemetry plumbing is still exercised by the test suite. +--- +--- a/src/cmd/internal/telemetry/counter/counter.go ++++ b/src/cmd/internal/telemetry/counter/counter.go +@@ -41,6 +41,6 @@ + func OpenMicrosoft() { +- if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") == "0" { +- // Telemetry disabled. ++ if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") != "1" { ++ // Azure Linux: Microsoft build of Go toolchain telemetry is off by default; opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1. + return + } + var logger *slog.Logger +--- a/src/cmd/go/script_test.go ++++ b/src/cmd/go/script_test.go +@@ -259,2 +259,3 @@ + "MS_GOTOOLCHAIN_TELEMETRY_ALLOW_GO_DEVEL=1", // allow telemetry for Go development versions ++ "MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1", // Azure Linux: telemetry is opt-in by default; enable it here so the test harness can exercise telemetry plumbing + "newline=\n", diff --git a/base/comps/golang/golang.comp.toml b/base/comps/golang/golang.comp.toml index 49bcf1d50ea..afe5ba0cd44 100644 --- a/base/comps/golang/golang.comp.toml +++ b/base/comps/golang/golang.comp.toml @@ -1,9 +1,13 @@ +# Azure Linux 4.0 golang: the Microsoft build of Go, packaged with Fedora's golang +# spec. This replaces the Fedora upstream golang entirely, so the distro ships a +# single golang toolchain sourced from Microsoft build of Go (systemcrypto / OpenSSL backend). [components.golang] -# Override to pick up golang-1.25.8-1.fc43, which fixes an expired TLS test -# certificate in net/smtp that causes %check failures after 2026-03-18. -# Upstream: https://github.com/golang/go/issues/77504 -# Backport: https://github.com/golang/go/issues/77531 (Go 1.25.8) -# Fedora commit: https://src.fedoraproject.org/rpms/golang/c/e0faaabdb215feb6be2b3232f480a03ce76ca132?branch=f43 -# TODO: Drop this override once the default Fedora 43 snapshot -# in distro/azurelinux.distro.toml advances past this commit. -spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "e0faaabdb215feb6be2b3232f480a03ce76ca132" } +spec = { type = "upstream", upstream-distro = { name = "fedora", version = "44" }, upstream-commit = "77411fa4053581833ce67c9dd241d7545d4ed6e0" } + +[[components.golang.source-files]] +filename = "go1.26.5.src.tar.gz" +hash = "52aafddac2d7c6245d7759e65021197dc385732d4a7aefb4f15f064d0e3babfe" +hash-type = "SHA256" +origin = { type = "download", uri = "https://github.com/microsoft/go/releases/download/v1.26.5-2/go1.26.5-20260709.6.src.tar.gz" } +replace-upstream = true +replace-reason = "Ship the Microsoft build of Go 1.26.5-2 source as Azure Linux's golang while reusing Fedora's golang packaging" diff --git a/base/comps/golang/overlays/0001-microsoft-build-of-go-source.overlay.toml b/base/comps/golang/overlays/0001-microsoft-build-of-go-source.overlay.toml new file mode 100644 index 00000000000..b283a1e5402 --- /dev/null +++ b/base/comps/golang/overlays/0001-microsoft-build-of-go-source.overlay.toml @@ -0,0 +1,15 @@ +[metadata] +category = "azl-branding-policy" +upstream-status = "inapplicable" + +[[overlays]] +description = "Build from the Microsoft build of Go release archive while retaining Fedora's local source filename" +type = "spec-update-tag" +tag = "Source0" +value = "https://github.com/microsoft/go/releases/download/v1.26.5-2/go1.26.5-20260709.6.src.tar.gz#/go1.26.5.src.tar.gz" + +[[overlays]] +description = "Point package metadata to Microsoft build of Go" +type = "spec-update-tag" +tag = "URL" +value = "https://github.com/microsoft/go" diff --git a/base/comps/golang/overlays/0002-release-from-microsoft-revision.overlay.toml b/base/comps/golang/overlays/0002-release-from-microsoft-revision.overlay.toml new file mode 100644 index 00000000000..59bd5993587 --- /dev/null +++ b/base/comps/golang/overlays/0002-release-from-microsoft-revision.overlay.toml @@ -0,0 +1,9 @@ +[metadata] +category = "azl-release-management" +upstream-status = "inapplicable" + +[[overlays]] +description = "Start the RPM release at the Microsoft build of Go revision (upstream v1.26.5-2)" +type = "spec-search-replace" +regex = '^Release:\s+%autorelease$' +replacement = "Release: %autorelease -b 2" diff --git a/base/comps/golang/overlays/0003-msft-golang-provide.overlay.toml b/base/comps/golang/overlays/0003-msft-golang-provide.overlay.toml new file mode 100644 index 00000000000..ad3a1588c0f --- /dev/null +++ b/base/comps/golang/overlays/0003-msft-golang-provide.overlay.toml @@ -0,0 +1,9 @@ +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +[[overlays]] +description = "Retain the historical Microsoft build of Go virtual provide" +type = "spec-add-tag" +tag = "Provides" +value = "msft-golang = %{version}-%{release}" diff --git a/base/comps/golang/overlays/0004-symcrypt-fips-providers.overlay.toml b/base/comps/golang/overlays/0004-symcrypt-fips-providers.overlay.toml new file mode 100644 index 00000000000..607e6f69238 --- /dev/null +++ b/base/comps/golang/overlays/0004-symcrypt-fips-providers.overlay.toml @@ -0,0 +1,21 @@ +[metadata] +category = "azl-security-compliance" +upstream-status = "inapplicable" + +[[overlays]] +description = "Microsoft build of Go's default systemcrypto backend dlopens libcrypto at runtime; auto-dependency generation is disabled, so require openssl explicitly" +type = "spec-add-tag" +tag = "Requires" +value = "openssl" + +[[overlays]] +description = "Require the SymCrypt FIPS provider so the OpenSSL crypto backend can route through a FIPS-validated implementation" +type = "spec-add-tag" +tag = "Requires" +value = "SymCrypt >= 103.6.0-1" + +[[overlays]] +description = "Require the SymCrypt OpenSSL (SCOSSL) provider that plugs SymCrypt into the system OpenSSL used by the Go crypto backend" +type = "spec-add-tag" +tag = "Requires" +value = "SymCrypt-OpenSSL >= 1.6.1-1" diff --git a/base/comps/golang/overlays/0005-build-against-microsoft-build-of-go.overlay.toml b/base/comps/golang/overlays/0005-build-against-microsoft-build-of-go.overlay.toml new file mode 100644 index 00000000000..786169a53d7 --- /dev/null +++ b/base/comps/golang/overlays/0005-build-against-microsoft-build-of-go.overlay.toml @@ -0,0 +1,44 @@ +[metadata] +category = "azl-compatibility" +upstream-status = "inapplicable" + +[[overlays]] +description = "Require a bootstrap compiler new enough for Go 1.26" +type = "spec-search-replace" +regex = '^BuildRequires:\s+golang > 1\.4$' +replacement = "BuildRequires: golang >= 1.24" + +[[overlays]] +description = "Use the installed bootstrap compiler regardless of package GOROOT" +type = "spec-search-replace" +section = "%build" +regex = '^export GOROOT_BOOTSTRAP=%\{goroot\}$' +replacement = 'export GOROOT_BOOTSTRAP="$(go env GOROOT)"' + +[[overlays]] +description = "Build every Microsoft build of Go tool with the nodwarf5 default installed in go.env" +type = "spec-search-replace" +section = "%build" +regex = '^export GOHOSTOS=linux$' +replacement = "export GOEXPERIMENT=nodwarf5\nexport GOHOSTOS=linux" + +[[overlays]] +description = "Disable the shared stdlib build that duplicates crosscall2 with Microsoft system-crypto backends" +type = "spec-search-replace" +regex = '^%global shared 1$' +replacement = "%global shared 0" + +[[overlays]] +description = "Avoid publishing test fixture shared libraries as RPM capabilities" +type = "spec-prepend-lines" +lines = ["%define __find_provides %{nil}"] + +[[overlays]] +description = "Replace Fedora's environment patch with one compatible with Microsoft build of Go defaults" +type = "patch-remove" +file = "0001-Modify-go.env.patch" + +[[overlays]] +description = "Retain Azure Linux's DWARF compatibility setting in Microsoft build of Go" +type = "patch-add" +source = "../0005-Set-nodwarf5-in-go.env.patch" diff --git a/base/comps/golang/overlays/0006-skip-openssl-incompatible-tests.overlay.toml b/base/comps/golang/overlays/0006-skip-openssl-incompatible-tests.overlay.toml new file mode 100644 index 00000000000..aad8d83861e --- /dev/null +++ b/base/comps/golang/overlays/0006-skip-openssl-incompatible-tests.overlay.toml @@ -0,0 +1,8 @@ +[metadata] +category = "azl-disable-unsupported-tests" +upstream-status = "inapplicable" + +[[overlays]] +description = "Skip crypto/rsa PSS and testing/cryptotest ML-KEM tests that fail under the Microsoft build of Go OpenSSL crypto backend" +type = "patch-add" +source = "../0006-Skip-openssl-incompatible-crypto-tests.patch" diff --git a/base/comps/golang/overlays/0007-disable-telemetry.overlay.toml b/base/comps/golang/overlays/0007-disable-telemetry.overlay.toml new file mode 100644 index 00000000000..8a2930b5be8 --- /dev/null +++ b/base/comps/golang/overlays/0007-disable-telemetry.overlay.toml @@ -0,0 +1,8 @@ +[metadata] +category = "azl-branding-policy" +upstream-status = "inapplicable" + +[[overlays]] +description = "Disable Microsoft build of Go toolchain telemetry by default (opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1)" +type = "patch-add" +source = "../0007-Disable-msft-go-telemetry-by-default.patch" diff --git a/locks/golang.lock b/locks/golang.lock index 09f5a4a8326..71902359432 100644 --- a/locks/golang.lock +++ b/locks/golang.lock @@ -1,6 +1,6 @@ # Managed by azldev component update. Do not edit manually. version = 1 -import-commit = 'e0faaabdb215feb6be2b3232f480a03ce76ca132' -upstream-commit = 'e0faaabdb215feb6be2b3232f480a03ce76ca132' -input-fingerprint = 'sha256:9cc64cbce0e0b54b23f9513393fc3ffe17bcb0bb310618d0096e484865b24f4b' -resolution-input-hash = 'sha256:53918cf7d5c133c8dbf203ddcd7ce8174b81a9d65257d368c208971150252e50' +import-commit = '77411fa4053581833ce67c9dd241d7545d4ed6e0' +upstream-commit = '77411fa4053581833ce67c9dd241d7545d4ed6e0' +input-fingerprint = 'sha256:df95577afd82aa1498d88ef6cc4bda9525cd0ea6630fde646a03e18f0c26cd3c' +resolution-input-hash = 'sha256:ce833778f104c7540309ac2ee9079d8a9a17e22d9ae90bbb6811f0284ec1e1f8' diff --git a/specs/g/golang/0001-Modify-go.env.patch b/specs/g/golang/0001-Modify-go.env.patch deleted file mode 100644 index 6a458b24d66..00000000000 --- a/specs/g/golang/0001-Modify-go.env.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 39432f71436c41201450a523dc41035c92d27569 Mon Sep 17 00:00:00 2001 -From: Maxwell G -Date: Thu, 24 Jul 2025 12:23:59 -0500 -Subject: [PATCH] Modify go.env - ---- - go.env | 17 ++++++++++++++++- - 1 file changed, 16 insertions(+), 1 deletion(-) - -diff --git a/go.env b/go.env -index 6ff2b92..5508440 100644 ---- a/go.env -+++ b/go.env -@@ -4,9 +4,24 @@ - - # Use the Go module mirror and checksum database by default. - # See https://proxy.golang.org for details. -+# -+# NOTE(downstream): We used to disable the Google Go proxy with GOPROXY=direct and -+# disable the GOSUMDB for historical and priavcy reasons, but it caused severe -+# performance degradations, so we reverted to the default upstream configuration. -+# as of https://fedoraproject.org/wiki/Changes/golang1.25. -+# To preserve the previous behavior, set "GOPROXY=direct" and "GOSUMDB=off". - GOPROXY=https://proxy.golang.org,direct - GOSUMDB=sum.golang.org - - # Automatically download newer toolchains as directed by go.mod files. - # See https://go.dev/doc/toolchain for details. --GOTOOLCHAIN=auto -+# -+# NOTE(downstream): We change this default from auto to local so that the -+# distribution-packaged Go toolchain is always used and go doesn't -+# automatically download pre-compiled alternative versions. -+GOTOOLCHAIN=local -+ -+# NOTE(downstream): https://sourceware.org/bugzilla/show_bug.cgi?id=33204 -+# The dwarf5 data emitted by default in Go 1.25+ is incompatible with debugedit -+# and breaks debugdata collection. -+GOEXPERIMENT=nodwarf5 --- -2.50.1 - diff --git a/specs/g/golang/0005-Set-nodwarf5-in-go.env.patch b/specs/g/golang/0005-Set-nodwarf5-in-go.env.patch new file mode 100644 index 00000000000..b768bf834f1 --- /dev/null +++ b/specs/g/golang/0005-Set-nodwarf5-in-go.env.patch @@ -0,0 +1,13 @@ +diff --git a/go.env b/go.env +--- a/go.env ++++ b/go.env +@@ -12,3 +12,6 @@ GOSUMDB=sum.golang.org + # to a Go toolchain not built by Microsoft, and we want to avoid that. + # See https://go.dev/doc/toolchain for details. + GOTOOLCHAIN=local ++ ++# Keep DWARF v4 until Azure Linux debugedit supports DWARF v5. ++GOEXPERIMENT=nodwarf5 + +-- +2.50.1 \ No newline at end of file diff --git a/specs/g/golang/0006-Default-to-ld.bfd-on-ARM64.patch b/specs/g/golang/0006-Default-to-ld.bfd-on-ARM64.patch deleted file mode 100644 index 369b4e6c04d..00000000000 --- a/specs/g/golang/0006-Default-to-ld.bfd-on-ARM64.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 46ec67413008607e2150e3395668e54e538c5b6b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= -Date: Wed, 19 Jun 2024 10:18:58 +0200 -Subject: [PATCH] Default to ld.bfd on ARM64 - ---- - src/cmd/link/internal/ld/lib.go | 20 +++++++------------- - 1 file changed, 7 insertions(+), 13 deletions(-) - -diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go -index eab74dc328..b401f58727 100644 ---- a/src/cmd/link/internal/ld/lib.go -+++ b/src/cmd/link/internal/ld/lib.go -@@ -1620,22 +1620,16 @@ func (ctxt *Link) hostlink() { - } - - if ctxt.Arch.InFamily(sys.ARM64) && buildcfg.GOOS == "linux" { -- // On ARM64, the GNU linker will fail with -- // -znocopyreloc if it thinks a COPY relocation is -- // required. Switch to gold. -- // https://sourceware.org/bugzilla/show_bug.cgi?id=19962 -- // https://go.dev/issue/22040 -- altLinker = "gold" -- -- // If gold is not installed, gcc will silently switch -- // back to ld.bfd. So we parse the version information -- // and provide a useful error if gold is missing. -+ // Use ld.bfd as the default linker -+ altLinker = "bfd" -+ -+ // Provide a useful error if ld.bfd is missing - name, args := flagExtld[0], flagExtld[1:] -- args = append(args, "-fuse-ld=gold", "-Wl,--version") -+ args = append(args, "-fuse-ld=bfd", "-Wl,--version") - cmd := exec.Command(name, args...) - if out, err := cmd.CombinedOutput(); err == nil { -- if !bytes.Contains(out, []byte("GNU gold")) { -- log.Fatalf("ARM64 external linker must be gold (issue #15696, 22040), but is not: %s", out) -+ if !bytes.Contains(out, []byte("GNU ld")) { -+ log.Fatalf("ARM64 external linker must be ld.bfd, but is not: %s", out) - } - } - } --- -2.45.1 - diff --git a/specs/g/golang/0006-Skip-openssl-incompatible-crypto-tests.patch b/specs/g/golang/0006-Skip-openssl-incompatible-crypto-tests.patch new file mode 100644 index 00000000000..4035f63d348 --- /dev/null +++ b/specs/g/golang/0006-Skip-openssl-incompatible-crypto-tests.patch @@ -0,0 +1,37 @@ +Skip crypto tests incompatible with the Microsoft build of Go OpenSSL backend + +TestPSSGolden/TestPSSSigning use SHA-1 RSA-PSS, which the system OpenSSL +provider rejects. TestSetGlobalRandom's mlkem.GenerateKey768 subtest asserts a +golden ML-KEM key from a deterministic RNG that the OpenSSL backend does not +consume; the skip is scoped to that subtest so the rand.Read, rand.Reader, +ecdsa.GenerateKey, and cryptocustomrand subtests keep running. These are +backend policy differences, not defects. +--- +--- a/src/crypto/rsa/pss_test.go 2026-08-03 22:47:04.746315785 +0000 ++++ b/src/crypto/rsa/pss_test.go 2026-08-03 22:47:04.746315785 +0000 +@@ -26,6 +26,7 @@ + // TestPSSGolden tests all the test vectors in pss-vect.txt from + // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip + func TestPSSGolden(t *testing.T) { ++ t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS") + inFile, err := os.Open("testdata/pss-vect.txt.bz2") + if err != nil { + t.Fatalf("Failed to open input file: %s", err) +@@ -153,6 +154,7 @@ + } + + func TestPSSSigning(t *testing.T) { ++ t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS") + var saltLengthCombinations = []struct { + signSaltLength, verifySaltLength int + good, fipsGood bool +--- a/src/testing/cryptotest/rand_test.go 2026-08-03 22:47:04.766315745 +0000 ++++ b/src/testing/cryptotest/rand_test.go 2026-08-03 22:47:04.766315745 +0000 +@@ -96,6 +96,7 @@ + + // A direct internal use of drbg.Read. + t.Run("mlkem.GenerateKey768", func(t *testing.T) { ++ t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; ML-KEM key generation does not consume the deterministic test RNG. The other TestSetGlobalRandom subtests pass and remain enabled.") + exp, err := mlkem.NewDecapsulationKey768(seed1) + if err != nil { + t.Fatalf("mlkem.NewDecapsulationKey768: %v", err) diff --git a/specs/g/golang/0007-Disable-msft-go-telemetry-by-default.patch b/specs/g/golang/0007-Disable-msft-go-telemetry-by-default.patch new file mode 100644 index 00000000000..bc15768dfad --- /dev/null +++ b/specs/g/golang/0007-Disable-msft-go-telemetry-by-default.patch @@ -0,0 +1,37 @@ +Disable Microsoft build of Go toolchain telemetry by default + +Azure Linux ships the Microsoft build of Go with the Microsoft-specific +AppInsights telemetry turned off by default. Upstream starts it for +`go build`, `go install`, and `go run` unless the environment variable +MS_GOTOOLCHAIN_TELEMETRY_ENABLED=0 is set. That variable is read with +os.Getenv (not the `go env` / go.env configuration) and is evaluated before +the go command normalizes its environment, so a package cannot reliably set +it for every invocation. Flip the gate to opt-in instead: Microsoft telemetry +runs only when MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 is explicitly set. + +This does not affect the separate upstream Go telemetry, which defaults to +"local" mode and uploads nothing unless the user runs `go telemetry on`. + +The cmd/go script test harness asserts that an App Insights request is +recorded whenever `go build`/`install`/`run` is invoked, which assumed the +upstream default-on behavior. Now that telemetry is opt-in, the harness sets +MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 for the go subprocesses it spawns so the +telemetry plumbing is still exercised by the test suite. +--- +--- a/src/cmd/internal/telemetry/counter/counter.go ++++ b/src/cmd/internal/telemetry/counter/counter.go +@@ -41,6 +41,6 @@ + func OpenMicrosoft() { +- if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") == "0" { +- // Telemetry disabled. ++ if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") != "1" { ++ // Azure Linux: Microsoft build of Go toolchain telemetry is off by default; opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1. + return + } + var logger *slog.Logger +--- a/src/cmd/go/script_test.go ++++ b/src/cmd/go/script_test.go +@@ -259,2 +259,3 @@ + "MS_GOTOOLCHAIN_TELEMETRY_ALLOW_GO_DEVEL=1", // allow telemetry for Go development versions ++ "MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1", // Azure Linux: telemetry is opt-in by default; enable it here so the test harness can exercise telemetry plumbing + "newline=\n", diff --git a/specs/g/golang/golang.spec b/specs/g/golang/golang.spec index d601c081c88..2b7fd45626b 100644 --- a/specs/g/golang/golang.spec +++ b/specs/g/golang/golang.spec @@ -11,6 +11,7 @@ # This spec file has been modified by azldev to include build configuration overlays. # Do not edit manually; changes may be overwritten. +%define __find_provides %{nil} %bcond_with bootstrap # build ids are not currently generated: @@ -74,7 +75,7 @@ # Build golang shared objects for stdlib %ifarch %{ix86} x86_64 ppc64le %{arm} aarch64 -%global shared 1 +%global shared 0 %else %global shared 0 %endif @@ -112,21 +113,21 @@ %endif # Comment out go_prerelease and go_patch as needed -%global go_api 1.25 -#global go_prerelease rc2 -%global go_patch 8 +%global go_api 1.26 +#global go_prerelease rc3 +%global go_patch 5 %global go_version %{go_api}%{?go_patch:.%{go_patch}}%{?go_prerelease:~%{go_prerelease}} %global go_source %{go_api}%{?go_patch:.%{go_patch}}%{?go_prerelease} Name: golang Version: %{go_version} -Release: %autorelease +Release: %autorelease -b 2 Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain License: BSD-3-Clause AND LicenseRef-Fedora-Public-Domain -URL: https://go.dev -Source0: https://go.dev/dl/go%{go_source}.src.tar.gz +URL: https://github.com/microsoft/go +Source0: https://github.com/microsoft/go/releases/download/v1.26.5-2/go1.26.5-20260709.6.src.tar.gz#/go1.26.5.src.tar.gz # make possible to override default traceback level at build time by setting build tag rpm_crashtraceback Source1: fedora.go @@ -134,13 +135,9 @@ Source1: fedora.go %if !%{golang_bootstrap} BuildRequires: gcc-go >= 5 %else -BuildRequires: golang > 1.4 +BuildRequires: golang >= 1.24 %endif -%if 0%{?rhel} > 6 || 0%{?fedora} > 0 BuildRequires: hostname -%else -BuildRequires: net-tools -%endif # for tests BuildRequires: pcre2-devel, glibc-static, perl-interpreter, procps-ng @@ -148,29 +145,28 @@ BuildRequires: pcre2-devel, glibc-static, perl-interpreter, procps-ng Provides: go = %{version}-%{release} # Bundled/Vendored provides generated by bundled-deps.sh based on the in tree module data -Provides: bundled(golang(github.com/google/pprof)) = 0.0.0.20250208200701.d0013a598941 -Provides: bundled(golang(github.com/ianlancetaylor/demangle)) = 0.0.0.20240912202439.0a2b6291aafd -Provides: bundled(golang(golang.org/x/arch)) = 0.18.1.0.20250605182141.b2f4e2807dec -Provides: bundled(golang(golang.org/x/build)) = 0.0.0.20250606033421.8c8ff6f34a83 -Provides: bundled(golang(golang.org/x/crypto)) = 0.39.0 -Provides: bundled(golang(golang.org/x/mod)) = 0.25.0 -Provides: bundled(golang(golang.org/x/net)) = 0.41.0 -Provides: bundled(golang(golang.org/x/sync)) = 0.15.0 -Provides: bundled(golang(golang.org/x/sys)) = 0.33.0 -Provides: bundled(golang(golang.org/x/telemetry)) = 0.0.0.20250606142133.60998feb31a8 -Provides: bundled(golang(golang.org/x/term)) = 0.32.0 -Provides: bundled(golang(golang.org/x/text)) = 0.26.0 +Provides: bundled(golang(github.com/google/pprof)) = 0.0.0.20251114195745.4902fdda35c8 +Provides: bundled(golang(github.com/ianlancetaylor/demangle)) = 0.0.0.20250417193237.f615e6bd150b +Provides: bundled(golang(golang.org/x/arch)) = 0.23.0 +Provides: bundled(golang(golang.org/x/build)) = 0.0.0.20251128064159.b9bfd88b30e8 +Provides: bundled(golang(golang.org/x/crypto)) = 0.46.1.0.20251210140736.7dacc380ba00 +Provides: bundled(golang(golang.org/x/mod)) = 0.30.1.0.20251115032019.269c237cf350 +Provides: bundled(golang(golang.org/x/net)) = 0.47.1.0.20251128220604.7c360367ab7e +Provides: bundled(golang(golang.org/x/net)) = 0.47.1.0.20260417193450.705de46f8788 +Provides: bundled(golang(golang.org/x/sync)) = 0.19.0 +Provides: bundled(golang(golang.org/x/sys)) = 0.39.0 +Provides: bundled(golang(golang.org/x/telemetry)) = 0.0.0.20251128220624.abf20d0e57ec +Provides: bundled(golang(golang.org/x/term)) = 0.38.0 +Provides: bundled(golang(golang.org/x/text)) = 0.32.0 Provides: bundled(golang(golang.org/x/tools)) = 0.27.0 -Provides: bundled(golang(golang.org/x/tools)) = 0.34.0 +Provides: bundled(golang(golang.org/x/tools)) = 0.39.1.0.20260323181443.4f499ecaa91d Provides: bundled(golang(rsc.io/markdown)) = 0.0.0.20240306144322.0bf8f97ee8ef Requires: %{name}-bin = %{version}-%{release} Requires: %{name}-src = %{version}-%{release} Requires: go-filesystem -Patch1: 0001-Modify-go.env.patch Patch5: 0005-Skip-TestCrashDumpsAllThreads.patch -Patch6: 0006-Default-to-ld.bfd-on-ARM64.patch # Related to https://gcc.gnu.org/PR118497 Patch8: fix_cgo_panic-with-gcc15-in-368.patch # Related to https://github.com/golang/go/issues/74476 @@ -195,6 +191,13 @@ ExclusiveArch: %{golang_arches} Source100: golang-gdbinit +Provides: msft-golang = %{version}-%{release} +Requires: openssl +Requires: SymCrypt >= 103.6.0-1 +Requires: SymCrypt-OpenSSL >= 1.6.1-1 +Patch10: 0005-Set-nodwarf5-in-go.env.patch +Patch11: 0006-Skip-openssl-incompatible-crypto-tests.patch +Patch12: 0007-Disable-msft-go-telemetry-by-default.patch %description %{summary}. @@ -269,11 +272,8 @@ Requires(preun): %{_sbindir}/update-alternatives # This is an odd issue, still looking for a better fix. Requires: glibc Requires: gcc -%if 0%{?rhel} && 0%{?rhel} < 8 -Requires: git, subversion, mercurial -%else -Recommends: git, subversion, mercurial -%endif +Recommends: git-core, subversion, mercurial + %description bin %{summary} @@ -320,12 +320,13 @@ cat /proc/meminfo %if !%{golang_bootstrap} export GOROOT_BOOTSTRAP=/ %else -export GOROOT_BOOTSTRAP=%{goroot} +export GOROOT_BOOTSTRAP="$(go env GOROOT)" %endif # set up final install location export GOROOT_FINAL=%{goroot} +export GOEXPERIMENT=nodwarf5 export GOHOSTOS=linux export GOHOSTARCH=%{gohostarch} @@ -560,27 +561,65 @@ fi %changelog ## START: Generated by rpmautospec -* Thu Apr 30 2026 Daniel McIlvaney - 1.25.8-2 -- feat: introduce deterministic commit resolution via Azure Linux lock file +* Thu Aug 06 2026 Nan Liu - 1.26.5-3 +- feat(golang): source Azure Linux golang from the Microsoft build of Go -* Fri Mar 06 2026 Packit - 1.25.8-1 -- Update to 1.25.8 upstream release +* Wed Jul 08 2026 Packit - 1.26.5-1 +- Update to 1.26.5 upstream release +- Resolves: rhbz#2497796 -* Tue Feb 10 2026 Packit - 1.25.7-2 -- Update to 1.25.7 upstream release +* Wed Jun 03 2026 Alejandro Sáez - 1.26.4-2 +- Update provides -* Wed Feb 04 2026 Packit - 1.25.7-1 -- Update to 1.25.7 upstream release +* Wed Jun 03 2026 Packit - 1.26.4-1 +- Update to 1.26.4 upstream release +- Resolves: rhbz#2484128 -* Thu Jan 15 2026 Packit - 1.25.6-1 -- Update to 1.25.6 upstream release -- Resolves: rhbz#2430148 +* Mon May 11 2026 Alejandro Sáez - 1.26.3-2 +- Remove 0006-Default-to-ld.bfd-on-ARM64.patch + +* Thu May 07 2026 Packit - 1.26.3-1 +- Update to 1.26.3 upstream release +- Resolves: rhbz#2467780 + +* Tue Apr 07 2026 Packit - 1.26.2-1 +- Update to 1.26.2 upstream release +- Resolves: rhbz#2456320 + +* Fri Mar 06 2026 Packit - 1.26.1-1 +- Update to 1.26.1 upstream release +- Resolves: rhbz#2445075 + +* Fri Feb 13 2026 Alejandro Sáez - 1.26.0-2 +- Update to Go 1.26.0 release + +* Tue Feb 10 2026 Packit - 1.26.0-1 +- Update to 1.26.0 upstream release +- Resolves: rhbz#2438726 + +* Mon Feb 09 2026 Alejandro Sáez - 1.26~rc3-2 +- Update .packit.yaml + +* Wed Feb 04 2026 Packit - 1.26~rc3-1 +- Update to 1.26rc3 upstream release + +* Fri Jan 30 2026 Packit - 1.26~rc2-1 +- Update to 1.26rc2 upstream release + +* Fri Jan 16 2026 Fedora Release Engineering - 1.26~rc1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Jan 02 2026 Alejandro Sáez - 1.26~rc1-2 +- Update Packit references + +* Wed Dec 17 2025 Alejandro Sáez - 1.26~rc1-1 +- Update to 1.26rc1 * Fri Dec 05 2025 Packit - 1.25.5-1 - Update to 1.25.5 upstream release - Resolves: rhbz#2419205 -* Thu Dec 04 2025 David Abdurachmanov - 1.25.4-2 +* Tue Dec 02 2025 David Abdurachmanov - 1.25.4-2 - Skip lsan tests on riscv64 * Wed Nov 05 2025 Packit - 1.25.4-1 @@ -591,18 +630,33 @@ fi - Update to 1.25.3 upstream release - Resolves: rhbz#2403668 +* Fri Oct 10 2025 Alejandro Sáez - 1.25.2-2 +- rebuild + * Tue Oct 07 2025 Packit - 1.25.2-1 - Update to 1.25.2 upstream release - Resolves: rhbz#2402368 -* Thu Sep 04 2025 Alejandro Sáez - 1.25.1-2 -- Fix specfile issues +* Thu Sep 04 2025 Mikel Olasagasti Uranga - 1.25.1-4 +- Drop check for old Releases and recommend git-core + +* Thu Sep 04 2025 Mikel Olasagasti Uranga - 1.25.1-3 +- Drop old check on RHEL6 and Fedora + +* Thu Sep 04 2025 Mikel Olasagasti Uranga - 1.25.1-2 +- Remove unused patch * Wed Sep 03 2025 Packit - 1.25.1-1 - Update to 1.25.1 upstream release - Resolves: rhbz#2392955 -* Wed Aug 13 2025 Packit - 1.25.0-1 +* Wed Aug 13 2025 Alejandro Sáez - 1.25.0-3 +- Add Fedora 43 + +* Wed Aug 13 2025 Alejandro Sáez - 1.25.0-2 +- Update to Go 1.25.0 + +* Tue Aug 12 2025 Packit - 1.25.0-1 - Update to 1.25.0 upstream release - Resolves: rhbz#2388116 diff --git a/specs/g/golang/sources b/specs/g/golang/sources index a7de3abb20b..fff9532de1b 100644 --- a/specs/g/golang/sources +++ b/specs/g/golang/sources @@ -1 +1 @@ -SHA512 (go1.25.8.src.tar.gz) = 2f5c9f314d18169985a9a4b19346e00dd5d4b396c8c17bfffe5719e51f27d834cc9649d0165f7eeb7367d3b6d384f49917325a40b49ba4da65e22f2c5362c739 +SHA256 (go1.26.5.src.tar.gz) = 52aafddac2d7c6245d7759e65021197dc385732d4a7aefb4f15f064d0e3babfe