diff --git a/go b/go index 9549c91031..65bbc74a59 160000 --- a/go +++ b/go @@ -1 +1 @@ -Subproject commit 9549c91031e12f484d5b02d4531f9022231f951f +Subproject commit 65bbc74a590c4c56a22abd0fdc15663184071716 diff --git a/patches/0001-Vendor-external-dependencies.patch b/patches/0001-Vendor-external-dependencies.patch index 262a83316c..3503e0a68c 100644 --- a/patches/0001-Vendor-external-dependencies.patch +++ b/patches/0001-Vendor-external-dependencies.patch @@ -831,7 +831,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result create mode 100644 src/vendor/github.com/microsoft/go/cryptobackend/tls13/tls13_windows.go diff --git a/src/cmd/go.mod b/src/cmd/go.mod -index 72d17b6d37c14b..4be5038f5b021f 100644 +index f55f0768249d4c..608aca7971a87e 100644 --- a/src/cmd/go.mod +++ b/src/cmd/go.mod @@ -4,6 +4,8 @@ go 1.28 @@ -842,9 +842,9 @@ index 72d17b6d37c14b..4be5038f5b021f 100644 + github.com/microsoft/go-infra/telemetry/config v0.0.0-20260526160655-aa04f117b3ce golang.org/x/arch v0.29.0 golang.org/x/build v0.0.0-20260715183034-a43f90886f2e - golang.org/x/mod v0.38.0 + golang.org/x/mod v0.39.1-0.20260813190000-57549bfb0d25 diff --git a/src/cmd/go.sum b/src/cmd/go.sum -index 97bbb0b963d9ce..1c7a8b32afa17a 100644 +index b803eee2622670..f701430f92a369 100644 --- a/src/cmd/go.sum +++ b/src/cmd/go.sum @@ -4,6 +4,10 @@ github.com/google/pprof v0.0.0-20260507013755-92041b743c96 h1:YDDnaZ9afWajDboPMt @@ -2670,7 +2670,7 @@ index 00000000000000..016de9bdd95956 + return filtered +} diff --git a/src/cmd/vendor/modules.txt b/src/cmd/vendor/modules.txt -index e543d18b3bb23d..eaef8375c4522b 100644 +index 843d5e7e81fd41..0ce155ac5b1c9c 100644 --- a/src/cmd/vendor/modules.txt +++ b/src/cmd/vendor/modules.txt @@ -16,6 +16,17 @@ github.com/google/pprof/third_party/svgpan @@ -2738,7 +2738,7 @@ index 00000000000000..d4671e1584dfa8 +// This file is here just to declare cryptobackend dependencies. +// This allows tracking their versions in a single patch file. diff --git a/src/go.mod b/src/go.mod -index 5cd65aa1cd3b98..6c38eb85ec32be 100644 +index d9c91d7b0dbcbb..607c4dded38695 100644 --- a/src/go.mod +++ b/src/go.mod @@ -3,11 +3,17 @@ module std @@ -2746,7 +2746,7 @@ index 5cd65aa1cd3b98..6c38eb85ec32be 100644 require ( - golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 -- golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb +- golang.org/x/net v0.57.1-0.20260723204303-5a920b1a8090 + github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f // indirect + github.com/microsoft/go-crypto-openssl v0.5.1-0.20260731132607-9fc2a2ab131d // indirect + github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 // indirect @@ -2759,12 +2759,12 @@ index 5cd65aa1cd3b98..6c38eb85ec32be 100644 - golang.org/x/text v0.40.0 // indirect + github.com/microsoft/go/cryptobackend v0.0.0 + golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 -+ golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb ++ golang.org/x/net v0.57.1-0.20260723204303-5a920b1a8090 ) + +replace github.com/microsoft/go/cryptobackend => ../../cryptobackend diff --git a/src/go.sum b/src/go.sum -index f540571ca5387d..363dffe7c44517 100644 +index 2d4171d08a2857..504df8a325c78a 100644 --- a/src/go.sum +++ b/src/go.sum @@ -1,3 +1,9 @@ @@ -2776,9 +2776,9 @@ index f540571ca5387d..363dffe7c44517 100644 +github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825/go.mod h1:a1Z07CJIuWa8WT/pzFIGNTTKS96s8o1B1TPOziAHUxw= golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1 h1:vGPAn+SBeT/HVkWqXTwgapJgtGQJztG0WR0OTuHzMAI= golang.org/x/crypto v0.54.1-0.20260714033321-10b54ffa51b1/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= - golang.org/x/net v0.57.1-0.20260720200444-a02ddfa7eacb h1:4Zpnuj4Vkh1c0wOa1MvxIp+I66KR18NRN08y9bN5zL0= + golang.org/x/net v0.57.1-0.20260723204303-5a920b1a8090 h1:XtR9OCj3sl60bQa861zXyA2fXGYcpmj8o8fGZe8iCtQ= diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go -index 4959a421892996..67627cdb93ff22 100644 +index 314608372954ce..6ddb9afc7f82a4 100644 --- a/src/go/build/deps_test.go +++ b/src/go/build/deps_test.go @@ -153,6 +153,13 @@ var depsRules = ` @@ -2795,7 +2795,7 @@ index 4959a421892996..67627cdb93ff22 100644 # TIME is SYSCALL plus the core packages about time, including context. SYSCALL < time/tzdata -@@ -540,16 +547,46 @@ var depsRules = ` +@@ -541,16 +548,46 @@ var depsRules = ` NONE < crypto/internal/boring/sig, crypto/internal/boring/syso; sync/atomic < crypto/internal/boring/bcache; @@ -2847,7 +2847,7 @@ index 4959a421892996..67627cdb93ff22 100644 < crypto/internal/boring < crypto/boring < crypto/internal/rand -@@ -575,6 +612,10 @@ var depsRules = ` +@@ -576,6 +613,10 @@ var depsRules = ` # CRYPTO-MATH is crypto that exposes math/big APIs - no cgo, net; fmt now ok. @@ -2858,7 +2858,7 @@ index 4959a421892996..67627cdb93ff22 100644 CRYPTO, FMT, math/big, internal/saferio < crypto/internal/boring/bbig < crypto/internal/fips140cache -@@ -954,7 +995,7 @@ var buildIgnore = []byte("\n//go:build ignore") +@@ -955,7 +996,7 @@ var buildIgnore = []byte("\n//go:build ignore") func findImports(pkg string) ([]string, error) { vpkg := pkg @@ -2867,7 +2867,7 @@ index 4959a421892996..67627cdb93ff22 100644 vpkg = "vendor/" + pkg } dir := filepath.Join(Default.GOROOT, "src", vpkg) -@@ -964,7 +1005,7 @@ func findImports(pkg string) ([]string, error) { +@@ -965,7 +1006,7 @@ func findImports(pkg string) ([]string, error) { } var imports []string var haveImport = map[string]bool{} @@ -45321,7 +45321,7 @@ index 00000000000000..b7ffeea07c6b8d + panic("cryptobackend: not available") +} diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt -index 6a02c35f7fafa9..d46e368a70e8f2 100644 +index 87a2fc95544420..63bd2e1385fcdb 100644 --- a/src/vendor/modules.txt +++ b/src/vendor/modules.txt @@ -1,3 +1,57 @@ diff --git a/patches/0002-Add-crypto-backends.patch b/patches/0002-Add-crypto-backends.patch index 15a14ba589..5164f2cff5 100644 --- a/patches/0002-Add-crypto-backends.patch +++ b/patches/0002-Add-crypto-backends.patch @@ -1251,7 +1251,7 @@ index b7ff79c0958bab..c86ccff3e325b2 100644 "crypto/internal/boring/syso", "crypto/x509", diff --git a/src/cmd/link/link_test.go b/src/cmd/link/link_test.go -index e7c406c4ad1eb8..7574d1b069807d 100644 +index aca1ac0008b036..5e7d03cf74a713 100644 --- a/src/cmd/link/link_test.go +++ b/src/cmd/link/link_test.go @@ -14,6 +14,7 @@ import ( @@ -2115,10 +2115,10 @@ index 13865ea7012989..81a6b5a9fb1ef9 100644 return c.sharedSecret(local.fips, remote.fips) } diff --git a/src/crypto/ecdh/x25519.go b/src/crypto/ecdh/x25519.go -index 21a921aa12d44d..075b2f679d2238 100644 +index 80ed77f6fd7ddc..939f1439557610 100644 --- a/src/crypto/ecdh/x25519.go +++ b/src/crypto/ecdh/x25519.go -@@ -11,6 +11,9 @@ import ( +@@ -12,6 +12,9 @@ import ( "crypto/internal/rand" "errors" "io" @@ -2128,7 +2128,7 @@ index 21a921aa12d44d..075b2f679d2238 100644 ) var ( -@@ -38,6 +41,23 @@ func (c *x25519Curve) GenerateKey(r io.Reader) (*PrivateKey, error) { +@@ -39,6 +42,23 @@ func (c *x25519Curve) GenerateKey(r io.Reader) (*PrivateKey, error) { if fips140only.Enforced() { return nil, errors.New("crypto/ecdh: use of X25519 is not allowed in FIPS 140-only mode") } @@ -2152,7 +2152,7 @@ index 21a921aa12d44d..075b2f679d2238 100644 r = rand.CustomReader(r) key := make([]byte, x25519PrivateKeySize) if _, err := io.ReadFull(r, key); err != nil { -@@ -53,6 +73,23 @@ func (c *x25519Curve) NewPrivateKey(key []byte) (*PrivateKey, error) { +@@ -54,6 +74,23 @@ func (c *x25519Curve) NewPrivateKey(key []byte) (*PrivateKey, error) { if len(key) != x25519PrivateKeySize { return nil, errors.New("crypto/ecdh: invalid private key size") } @@ -2174,8 +2174,8 @@ index 21a921aa12d44d..075b2f679d2238 100644 + return k, nil + } publicKey := make([]byte, x25519PublicKeySize) - x25519Basepoint := [32]byte{9} - x25519ScalarMult(publicKey, key, x25519Basepoint[:]) + x25519ScalarBaseMult(publicKey, key) + // We don't check for the all-zero public key here because the scalar is @@ -73,6 +110,17 @@ func (c *x25519Curve) NewPublicKey(key []byte) (*PublicKey, error) { if len(key) != x25519PublicKeySize { return nil, errors.New("crypto/ecdh: invalid public key")