feat(golang): source Azure Linux golang from the Microsoft build of Go #18360
+407
−149
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| diff --git a/go.env b/go.env | ||
| --- a/go.env | ||
| +++ b/go.env | ||
| @@ -12,3 +12,6 @@ GOSUMDB=sum.golang.org | ||
| # to a Go toolchain not built by Microsoft, and we want to avoid that. | ||
| # See https://go.dev/doc/toolchain for details. | ||
| GOTOOLCHAIN=local | ||
| + | ||
| +# Keep DWARF v4 until Azure Linux debugedit supports DWARF v5. | ||
| +GOEXPERIMENT=nodwarf5 | ||
|
|
||
| -- | ||
| 2.50.1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| Skip crypto tests incompatible with the Microsoft build of Go OpenSSL backend | ||
|
|
||
| TestPSSGolden/TestPSSSigning use SHA-1 RSA-PSS, which the system OpenSSL | ||
| provider rejects. TestSetGlobalRandom's mlkem.GenerateKey768 subtest asserts a | ||
| golden ML-KEM key from a deterministic RNG that the OpenSSL backend does not | ||
| consume; the skip is scoped to that subtest so the rand.Read, rand.Reader, | ||
| ecdsa.GenerateKey, and cryptocustomrand subtests keep running. These are | ||
| backend policy differences, not defects. | ||
| --- | ||
| --- a/src/crypto/rsa/pss_test.go 2026-08-03 22:47:04.746315785 +0000 | ||
| +++ b/src/crypto/rsa/pss_test.go 2026-08-03 22:47:04.746315785 +0000 | ||
| @@ -26,6 +26,7 @@ | ||
| // TestPSSGolden tests all the test vectors in pss-vect.txt from | ||
| // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip | ||
| func TestPSSGolden(t *testing.T) { | ||
| + t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS") | ||
| inFile, err := os.Open("testdata/pss-vect.txt.bz2") | ||
| if err != nil { | ||
| t.Fatalf("Failed to open input file: %s", err) | ||
| @@ -153,6 +154,7 @@ | ||
| } | ||
|
|
||
| func TestPSSSigning(t *testing.T) { | ||
| + t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS") | ||
| var saltLengthCombinations = []struct { | ||
| signSaltLength, verifySaltLength int | ||
| good, fipsGood bool | ||
| --- a/src/testing/cryptotest/rand_test.go 2026-08-03 22:47:04.766315745 +0000 | ||
| +++ b/src/testing/cryptotest/rand_test.go 2026-08-03 22:47:04.766315745 +0000 | ||
| @@ -96,6 +96,7 @@ | ||
|
|
||
| // A direct internal use of drbg.Read. | ||
| t.Run("mlkem.GenerateKey768", func(t *testing.T) { | ||
| + t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; ML-KEM key generation does not consume the deterministic test RNG. The other TestSetGlobalRandom subtests pass and remain enabled.") | ||
| exp, err := mlkem.NewDecapsulationKey768(seed1) | ||
| if err != nil { | ||
| t.Fatalf("mlkem.NewDecapsulationKey768: %v", err) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| Disable Microsoft build of Go toolchain telemetry by default | ||
|
|
||
| Azure Linux ships the Microsoft build of Go with the Microsoft-specific | ||
| AppInsights telemetry turned off by default. Upstream starts it for | ||
| `go build`, `go install`, and `go run` unless the environment variable | ||
| MS_GOTOOLCHAIN_TELEMETRY_ENABLED=0 is set. That variable is read with | ||
| os.Getenv (not the `go env` / go.env configuration) and is evaluated before | ||
| the go command normalizes its environment, so a package cannot reliably set | ||
| it for every invocation. Flip the gate to opt-in instead: Microsoft telemetry | ||
| runs only when MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 is explicitly set. | ||
|
|
||
| This does not affect the separate upstream Go telemetry, which defaults to | ||
| "local" mode and uploads nothing unless the user runs `go telemetry on`. | ||
|
|
||
| The cmd/go script test harness asserts that an App Insights request is | ||
| recorded whenever `go build`/`install`/`run` is invoked, which assumed the | ||
| upstream default-on behavior. Now that telemetry is opt-in, the harness sets | ||
| MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 for the go subprocesses it spawns so the | ||
| telemetry plumbing is still exercised by the test suite. | ||
| --- | ||
| --- a/src/cmd/internal/telemetry/counter/counter.go | ||
| +++ b/src/cmd/internal/telemetry/counter/counter.go | ||
| @@ -41,6 +41,6 @@ | ||
| func OpenMicrosoft() { | ||
| - if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") == "0" { | ||
| - // Telemetry disabled. | ||
| + if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") != "1" { | ||
| + // Azure Linux: Microsoft build of Go toolchain telemetry is off by default; opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1. | ||
| return | ||
| } | ||
| var logger *slog.Logger | ||
| --- a/src/cmd/go/script_test.go | ||
| +++ b/src/cmd/go/script_test.go | ||
| @@ -259,2 +259,3 @@ | ||
| "MS_GOTOOLCHAIN_TELEMETRY_ALLOW_GO_DEVEL=1", // allow telemetry for Go development versions | ||
| + "MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1", // Azure Linux: telemetry is opt-in by default; enable it here so the test harness can exercise telemetry plumbing | ||
| "newline=\n", |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,13 @@ | ||
| # Azure Linux 4.0 golang: the Microsoft build of Go, packaged with Fedora's golang | ||
| # spec. This replaces the Fedora upstream golang entirely, so the distro ships a | ||
| # single golang toolchain sourced from Microsoft build of Go (systemcrypto / OpenSSL backend). | ||
| [components.golang] | ||
| spec = { type = "upstream", upstream-distro = { name = "fedora", version = "44" }, upstream-commit = "77411fa4053581833ce67c9dd241d7545d4ed6e0" } | ||
|
|
||
| [[components.golang.source-files]] | ||
| filename = "go1.26.5.src.tar.gz" | ||
| hash = "52aafddac2d7c6245d7759e65021197dc385732d4a7aefb4f15f064d0e3babfe" | ||
| hash-type = "SHA256" | ||
| origin = { type = "download", uri = "https://github.com/microsoft/go/releases/download/v1.26.5-2/go1.26.5-20260709.6.src.tar.gz" } | ||
| replace-upstream = true | ||
| replace-reason = "Ship the Microsoft build of Go 1.26.5-2 source as Azure Linux's golang while reusing Fedora's golang packaging" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| [metadata] | ||
| category = "azl-branding-policy" | ||
| upstream-status = "inapplicable" | ||
|
|
||
| [[overlays]] | ||
| description = "Build from the Microsoft build of Go release archive while retaining Fedora's local source filename" | ||
| type = "spec-update-tag" | ||
| tag = "Source0" | ||
| value = "https://github.com/microsoft/go/releases/download/v1.26.5-2/go1.26.5-20260709.6.src.tar.gz#/go1.26.5.src.tar.gz" | ||
|
|
||
| [[overlays]] | ||
| description = "Point package metadata to Microsoft build of Go" | ||
| type = "spec-update-tag" | ||
| tag = "URL" | ||
| value = "https://github.com/microsoft/go" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| [metadata] | ||
| category = "azl-release-management" | ||
| upstream-status = "inapplicable" | ||
|
|
||
| [[overlays]] | ||
| description = "Start the RPM release at the Microsoft build of Go revision (upstream v1.26.5-2)" | ||
| type = "spec-search-replace" | ||
| regex = '^Release:\s+%autorelease$' | ||
| replacement = "Release: %autorelease -b 2" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| [metadata] | ||
| category = "azl-compatibility" | ||
| upstream-status = "inapplicable" | ||
|
|
||
| [[overlays]] | ||
| description = "Retain the historical Microsoft build of Go virtual provide" | ||
| type = "spec-add-tag" | ||
| tag = "Provides" | ||
| value = "msft-golang = %{version}-%{release}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| [metadata] | ||
| category = "azl-security-compliance" | ||
| upstream-status = "inapplicable" | ||
|
|
||
| [[overlays]] | ||
| description = "Microsoft build of Go's default systemcrypto backend dlopens libcrypto at runtime; auto-dependency generation is disabled, so require openssl explicitly" | ||
| type = "spec-add-tag" | ||
| tag = "Requires" | ||
| value = "openssl" | ||
|
|
||
| [[overlays]] | ||
| description = "Require the SymCrypt FIPS provider so the OpenSSL crypto backend can route through a FIPS-validated implementation" | ||
| type = "spec-add-tag" | ||
| tag = "Requires" | ||
| value = "SymCrypt >= 103.6.0-1" | ||
|
|
||
| [[overlays]] | ||
| description = "Require the SymCrypt OpenSSL (SCOSSL) provider that plugs SymCrypt into the system OpenSSL used by the Go crypto backend" | ||
| type = "spec-add-tag" | ||
| tag = "Requires" | ||
| value = "SymCrypt-OpenSSL >= 1.6.1-1" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| [metadata] | ||
| category = "azl-compatibility" | ||
| upstream-status = "inapplicable" | ||
|
|
||
| [[overlays]] | ||
| description = "Require a bootstrap compiler new enough for Go 1.26" | ||
| type = "spec-search-replace" | ||
| regex = '^BuildRequires:\s+golang > 1\.4$' | ||
| replacement = "BuildRequires: golang >= 1.24" | ||
|
|
||
| [[overlays]] | ||
| description = "Use the installed bootstrap compiler regardless of package GOROOT" | ||
| type = "spec-search-replace" | ||
| section = "%build" | ||
| regex = '^export GOROOT_BOOTSTRAP=%\{goroot\}$' | ||
| replacement = 'export GOROOT_BOOTSTRAP="$(go env GOROOT)"' | ||
|
|
||
| [[overlays]] | ||
| description = "Build every Microsoft build of Go tool with the nodwarf5 default installed in go.env" | ||
| type = "spec-search-replace" | ||
| section = "%build" | ||
| regex = '^export GOHOSTOS=linux$' | ||
| replacement = "export GOEXPERIMENT=nodwarf5\nexport GOHOSTOS=linux" | ||
|
|
||
| [[overlays]] | ||
| description = "Disable the shared stdlib build that duplicates crosscall2 with Microsoft system-crypto backends" | ||
| type = "spec-search-replace" | ||
| regex = '^%global shared 1$' | ||
| replacement = "%global shared 0" | ||
|
|
||
| [[overlays]] | ||
| description = "Avoid publishing test fixture shared libraries as RPM capabilities" | ||
| type = "spec-prepend-lines" | ||
| lines = ["%define __find_provides %{nil}"] | ||
|
|
||
| [[overlays]] | ||
| description = "Replace Fedora's environment patch with one compatible with Microsoft build of Go defaults" | ||
| type = "patch-remove" | ||
| file = "0001-Modify-go.env.patch" | ||
|
|
||
| [[overlays]] | ||
| description = "Retain Azure Linux's DWARF compatibility setting in Microsoft build of Go" | ||
| type = "patch-add" | ||
| source = "../0005-Set-nodwarf5-in-go.env.patch" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| [metadata] | ||
| category = "azl-disable-unsupported-tests" | ||
| upstream-status = "inapplicable" | ||
|
|
||
| [[overlays]] | ||
| description = "Skip crypto/rsa PSS and testing/cryptotest ML-KEM tests that fail under the Microsoft build of Go OpenSSL crypto backend" | ||
| type = "patch-add" | ||
| source = "../0006-Skip-openssl-incompatible-crypto-tests.patch" | ||
|
Contributor
There was a problem hiding this comment. issue(blocking): I think that the version of |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| [metadata] | ||
| category = "azl-branding-policy" | ||
| upstream-status = "inapplicable" | ||
|
|
||
| [[overlays]] | ||
| description = "Disable Microsoft build of Go toolchain telemetry by default (opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1)" | ||
| type = "patch-add" | ||
| source = "../0007-Disable-msft-go-telemetry-by-default.patch" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| # Managed by azldev component update. Do not edit manually. | ||
| version = 1 | ||
| import-commit = '77411fa4053581833ce67c9dd241d7545d4ed6e0' | ||
| upstream-commit = '77411fa4053581833ce67c9dd241d7545d4ed6e0' | ||
| input-fingerprint = 'sha256:df95577afd82aa1498d88ef6cc4bda9525cd0ea6630fde646a03e18f0c26cd3c' | ||
| resolution-input-hash = 'sha256:ce833778f104c7540309ac2ee9079d8a9a17e22d9ae90bbb6811f0284ec1e1f8' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| diff --git a/go.env b/go.env | ||
| --- a/go.env | ||
| +++ b/go.env | ||
| @@ -12,3 +12,6 @@ GOSUMDB=sum.golang.org | ||
| # to a Go toolchain not built by Microsoft, and we want to avoid that. | ||
| # See https://go.dev/doc/toolchain for details. | ||
| GOTOOLCHAIN=local | ||
| + | ||
| +# Keep DWARF v4 until Azure Linux debugedit supports DWARF v5. | ||
| +GOEXPERIMENT=nodwarf5 | ||
|
|
||
| -- | ||
| 2.50.1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| Skip crypto tests incompatible with the Microsoft build of Go OpenSSL backend | ||
|
|
||
| TestPSSGolden/TestPSSSigning use SHA-1 RSA-PSS, which the system OpenSSL | ||
| provider rejects. TestSetGlobalRandom's mlkem.GenerateKey768 subtest asserts a | ||
| golden ML-KEM key from a deterministic RNG that the OpenSSL backend does not | ||
| consume; the skip is scoped to that subtest so the rand.Read, rand.Reader, | ||
| ecdsa.GenerateKey, and cryptocustomrand subtests keep running. These are | ||
| backend policy differences, not defects. | ||
| --- | ||
| --- a/src/crypto/rsa/pss_test.go 2026-08-03 22:47:04.746315785 +0000 | ||
| +++ b/src/crypto/rsa/pss_test.go 2026-08-03 22:47:04.746315785 +0000 | ||
| @@ -26,6 +26,7 @@ | ||
| // TestPSSGolden tests all the test vectors in pss-vect.txt from | ||
| // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip | ||
| func TestPSSGolden(t *testing.T) { | ||
| + t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS") | ||
| inFile, err := os.Open("testdata/pss-vect.txt.bz2") | ||
| if err != nil { | ||
| t.Fatalf("Failed to open input file: %s", err) | ||
| @@ -153,6 +154,7 @@ | ||
| } | ||
|
|
||
| func TestPSSSigning(t *testing.T) { | ||
| + t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS") | ||
| var saltLengthCombinations = []struct { | ||
| signSaltLength, verifySaltLength int | ||
| good, fipsGood bool | ||
| --- a/src/testing/cryptotest/rand_test.go 2026-08-03 22:47:04.766315745 +0000 | ||
| +++ b/src/testing/cryptotest/rand_test.go 2026-08-03 22:47:04.766315745 +0000 | ||
| @@ -96,6 +96,7 @@ | ||
|
|
||
| // A direct internal use of drbg.Read. | ||
| t.Run("mlkem.GenerateKey768", func(t *testing.T) { | ||
| + t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; ML-KEM key generation does not consume the deterministic test RNG. The other TestSetGlobalRandom subtests pass and remain enabled.") | ||
| exp, err := mlkem.NewDecapsulationKey768(seed1) | ||
| if err != nil { | ||
| t.Fatalf("mlkem.NewDecapsulationKey768: %v", err) |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
question(blocking): Does this really require
openssl, or can it rely just onopenssl-libs?