Skip to content

Update submodule to latest master in microsoft/main #2459

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bot-for-go merged 2 commits into from
Aug 19, 2026
+40 −40
Merged

Update submodule to latest master in microsoft/main #2459

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c246324
Update submodule to latest master (c9e4a2aa): internal/runtime/maps: …
bot-for-go[bot] Aug 19, 2026
95de304
resolve 3-way merge conflicts
gdams Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go
Open in desktop
Submodule go updated 349 files
38 changes: 19 additions & 19 deletions patches/0002-Add-crypto-backends.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -598,7 +598,7 @@ index b305457a23d104..5154aa0be0007c 100644
Additional information available from 'go env' but not read from the environment:

diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
index 958d79623f75b2..be3a89d8c638c1 100644
index 9a75e921c261da..c60c8e7be1769a 100644
--- a/src/cmd/go/internal/load/pkg.go
+++ b/src/cmd/go/internal/load/pkg.go
@@ -16,6 +16,7 @@ import (
Expand Down Expand Up @@ -690,7 +690,7 @@ index 958d79623f75b2..be3a89d8c638c1 100644

if p.Module == nil {
parent := p.Dir[:i+len(p.Dir)-len(p.ImportPath)]
@@ -2450,6 +2491,9 @@ func (p *Package) setBuildInfo(ctx context.Context, f *modfetch.Fetcher, autoVCS
@@ -2437,6 +2478,9 @@ func (p *Package) setBuildInfo(ctx context.Context, f *modfetch.Fetcher, autoVCS
buildmode = "archive"
}
}
Expand All @@ -701,10 +701,10 @@ index 958d79623f75b2..be3a89d8c638c1 100644
appendSetting("-compiler", cfg.BuildContext.Compiler)
if gccgoflags := BuildGccgoflags.String(); gccgoflags != "" && cfg.BuildContext.Compiler == "gccgo" {
diff --git a/src/cmd/go/internal/tool/tool.go b/src/cmd/go/internal/tool/tool.go
index afc50d9b2d9177..cfa89ae75621ef 100644
index 018c808e54de27..5c166f90cb19bb 100644
--- a/src/cmd/go/internal/tool/tool.go
+++ b/src/cmd/go/internal/tool/tool.go
@@ -336,6 +336,10 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
@@ -371,6 +371,10 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
// Override GOOS and GOARCH for the build to build the tool using
// the same GOOS and GOARCH as this go command.
cfg.ForceHost()
Expand All @@ -715,7 +715,7 @@ index afc50d9b2d9177..cfa89ae75621ef 100644

// Ignore go.mod and go.work: we don't need them, and we want to be able
// to run the tool even if there's an issue with the module or workspace the
@@ -343,8 +347,11 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
@@ -378,8 +382,11 @@ func buildAndRunBuiltinTool(ld *modload.Loader, ctx context.Context, toolName, t
ld.RootMode = modload.NoRoot

runFunc := func(b *work.Builder, ctx context.Context, a *work.Action) error {
Expand Down Expand Up @@ -1251,7 +1251,7 @@ index b7ff79c0958bab..c86ccff3e325b2 100644
"crypto/internal/boring/syso",
"crypto/x509",
diff --git a/src/cmd/link/link_test.go b/src/cmd/link/link_test.go
index aca1ac0008b036..5e7d03cf74a713 100644
index 83b4c576d7f594..5795d5fbf884ac 100644
--- a/src/cmd/link/link_test.go
+++ b/src/cmd/link/link_test.go
@@ -14,6 +14,7 @@ import (
Expand All @@ -1262,7 +1262,7 @@ index aca1ac0008b036..5e7d03cf74a713 100644
"internal/testenv"
"internal/xcoff"
"os"
@@ -368,6 +369,9 @@ func TestBuildForTvOS(t *testing.T) {
@@ -373,6 +374,9 @@ func TestBuildForTvOS(t *testing.T) {
if runtime.GOOS != "darwin" {
t.Skip("skipping on non-darwin platform")
}
Expand All @@ -1272,7 +1272,7 @@ index aca1ac0008b036..5e7d03cf74a713 100644
if testing.Short() && testenv.Builder() == "" {
t.Skip("skipping in -short mode with $GO_BUILDER_NAME empty")
}
@@ -598,6 +602,10 @@ func TestIssue34788Android386TLSSequence(t *testing.T) {
@@ -603,6 +607,10 @@ func TestIssue34788Android386TLSSequence(t *testing.T) {
t.Skip("skipping on non-{linux,darwin}/amd64 platform")
}

Expand Down Expand Up @@ -3055,7 +3055,7 @@ index a940fb2a3a0010..e5b6f3615fe0c1 100644

func withNonApprovedHash(f func(crypto.Hash)) {
diff --git a/src/crypto/internal/fips140test/acvp_test.go b/src/crypto/internal/fips140test/acvp_test.go
index ebd73b146a373a..0bbcdbdb8ce931 100644
index 333dee95e3327c..9ce843895fc60e 100644
--- a/src/crypto/internal/fips140test/acvp_test.go
+++ b/src/crypto/internal/fips140test/acvp_test.go
@@ -50,6 +50,8 @@ import (
Expand All @@ -3077,7 +3077,7 @@ index ebd73b146a373a..0bbcdbdb8ce931 100644
+
const (
bsslModule = "boringssl.googlesource.com/boringssl.git"
bsslVersion = "v0.0.0-20260422110153-4ccbe2adaf4f"
bsslVersion = "v0.0.0-20260804180546-69dd9a8a2afc"
diff --git a/src/crypto/internal/fips140test/cast_test.go b/src/crypto/internal/fips140test/cast_test.go
index 99eab7e5de91e4..e5b36643ae9702 100644
--- a/src/crypto/internal/fips140test/cast_test.go
Expand Down Expand Up @@ -6136,10 +6136,10 @@ index 00000000000000..ffb835ce34a2f7
+ }
+}
diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
index 6ddb9afc7f82a4..c5620bbccf6a51 100644
index b47c346cc9c4ec..14358b226bb098 100644
--- a/src/go/build/deps_test.go
+++ b/src/go/build/deps_test.go
@@ -372,8 +372,10 @@ var depsRules = `
@@ -375,8 +375,10 @@ var depsRules = `
math/big, go/token
< go/constant;

Expand All @@ -6151,7 +6151,7 @@ index 6ddb9afc7f82a4..c5620bbccf6a51 100644

# The vast majority of standard library packages should not be resorting to regexp.
# go/types is a good chokepoint. It shouldn't use regexp, nor should anything
@@ -538,7 +540,7 @@ var depsRules = `
@@ -541,7 +543,7 @@ var depsRules = `
< crypto/internal/fips140/edwards25519
< crypto/internal/fips140/ed25519
< crypto/internal/fips140/rsa
Expand All @@ -6160,7 +6160,7 @@ index 6ddb9afc7f82a4..c5620bbccf6a51 100644

crypto !< FIPS;

@@ -558,7 +560,20 @@ var depsRules = `
@@ -561,7 +563,20 @@ var depsRules = `
< github.com/microsoft/go-crypto-winnative/internal/sysdll
< github.com/microsoft/go-crypto-winnative/internal/bcrypt;

Expand All @@ -6182,7 +6182,7 @@ index 6ddb9afc7f82a4..c5620bbccf6a51 100644
< crypto/internal/fips140only
< crypto
< crypto/subtle
@@ -578,6 +593,50 @@ var depsRules = `
@@ -581,6 +596,50 @@ var depsRules = `
github.com/microsoft/go-crypto-winnative/internal/bcrypt
< github.com/microsoft/go-crypto-winnative/cng;

Expand Down Expand Up @@ -6233,7 +6233,7 @@ index 6ddb9afc7f82a4..c5620bbccf6a51 100644
FIPS, internal/godebug, embed,
crypto/internal/boring/sig,
crypto/internal/boring/syso,
@@ -585,7 +644,9 @@ var depsRules = `
@@ -588,7 +647,9 @@ var depsRules = `
crypto/internal/fips140only,
crypto,
crypto/subtle,
Expand All @@ -6244,7 +6244,7 @@ index 6ddb9afc7f82a4..c5620bbccf6a51 100644
< crypto/sha3
< crypto/internal/fips140hash
< crypto/internal/boring
@@ -609,6 +670,9 @@ var depsRules = `
@@ -612,6 +673,9 @@ var depsRules = `
CRYPTO
< golang.org/x/crypto/hkdf;

Expand All @@ -6254,7 +6254,7 @@ index 6ddb9afc7f82a4..c5620bbccf6a51 100644
CGO, fmt, net !< CRYPTO;

# CRYPTO-MATH is crypto that exposes math/big APIs - no cgo, net; fmt now ok.
@@ -617,15 +681,28 @@ var depsRules = `
@@ -620,15 +684,28 @@ var depsRules = `
math/big, github.com/microsoft/go-crypto-darwin/xcrypto < github.com/microsoft/go-crypto-darwin/bbig;
math/big, github.com/microsoft/go-crypto-winnative/cng < github.com/microsoft/go-crypto-winnative/cng/bbig;

Expand Down Expand Up @@ -6286,7 +6286,7 @@ index 6ddb9afc7f82a4..c5620bbccf6a51 100644
< crypto/ecdsa
< CRYPTO-MATH;

@@ -659,7 +736,8 @@ var depsRules = `
@@ -662,7 +739,8 @@ var depsRules = `
< crypto/hpke;

CRYPTO-MATH, NET, container/list, encoding/hex, encoding/pem, crypto/hpke,
Expand Down
40 changes: 20 additions & 20 deletions patches/0010-Align-TLS-settings-with-Microsoft-policies.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@ Subject: [PATCH] Align TLS settings with Microsoft policies
create mode 100644 src/crypto/tls/microsoft_test.go

diff --git a/doc/godebug.md b/doc/godebug.md
index 5fecfb5ccba3eb..4701102b91ec93 100644
index 144332729493c7..477856b077114c 100644
--- a/doc/godebug.md
+++ b/doc/godebug.md
@@ -227,6 +227,15 @@ APIs ignore the random `io.Reader` parameter. For Go 1.26, it defaults
@@ -247,6 +247,15 @@ APIs ignore the random `io.Reader` parameter. For Go 1.26, it defaults
to `cryptocustomrand=0`, ignoring the random parameters. Using `cryptocustomrand=1`
reverts to the pre-Go 1.26 behavior.

Expand All @@ -41,10 +41,10 @@ index 5fecfb5ccba3eb..4701102b91ec93 100644

Go 1.25 added a new `decoratemappings` setting that controls whether the Go
diff --git a/src/crypto/tls/common.go b/src/crypto/tls/common.go
index c329ac82949081..8304282d34ec1c 100644
index dd4aaf546c6208..1b701b257dc01e 100644
--- a/src/crypto/tls/common.go
+++ b/src/crypto/tls/common.go
@@ -1194,7 +1194,14 @@ func (c *Config) cipherSuites(aesGCMPreferred bool) []uint16 {
@@ -1204,7 +1204,14 @@ func (c *Config) cipherSuites(aesGCMPreferred bool) []uint16 {
}
if fips140tls.Required() {
cipherSuites = slices.DeleteFunc(cipherSuites, func(id uint16) bool {
Expand Down Expand Up @@ -289,10 +289,10 @@ index 00000000000000..9e7432fd308c95
+ TLS_RSA_WITH_RC4_128_SHA: true,
+}
diff --git a/src/crypto/tls/handshake_client.go b/src/crypto/tls/handshake_client.go
index 6d97d1fba0dfa9..eb88634f275ce8 100644
index ae1239f632380e..1fb12f7e379bdc 100644
--- a/src/crypto/tls/handshake_client.go
+++ b/src/crypto/tls/handshake_client.go
@@ -131,12 +131,21 @@ func (c *Conn) makeClientHello() (*clientHelloMsg, *keySharePrivateKeys, *echCli
@@ -132,12 +132,21 @@ func (c *Conn) makeClientHello() (*clientHelloMsg, *keySharePrivateKeys, *echCli
hello.cipherSuites = nil
}

Expand Down Expand Up @@ -349,10 +349,10 @@ index d8ac7f232590ca..cb418356d2887b 100644
if len(chi.CipherSuites) != len(expectedCiphersuites) {
t.Errorf("only TLS 1.3 suites should be advertised, got=%x", chi.CipherSuites)
diff --git a/src/crypto/tls/handshake_server_tls13.go b/src/crypto/tls/handshake_server_tls13.go
index ed7c2de8db51f1..cf3a3af4d1204b 100644
index 7fcab7bf82f618..edb8c3b7b0a7c2 100644
--- a/src/crypto/tls/handshake_server_tls13.go
+++ b/src/crypto/tls/handshake_server_tls13.go
@@ -176,12 +176,22 @@ func (hs *serverHandshakeStateTLS13) processClientHello() error {
@@ -177,12 +177,22 @@ func (hs *serverHandshakeStateTLS13) processClientHello() error {
hs.hello.sessionId = hs.clientHello.sessionId
hs.hello.compressionMethod = compressionNone

Expand Down Expand Up @@ -382,10 +382,10 @@ index ed7c2de8db51f1..cf3a3af4d1204b 100644
for _, suiteID := range preferenceList {
hs.suite = mutualCipherSuiteTLS13(hs.clientHello.cipherSuites, suiteID)
diff --git a/src/crypto/tls/handshake_test.go b/src/crypto/tls/handshake_test.go
index d9424c374eab88..d56331d6268321 100644
index 85f7ce951bb175..1a50a8bf39a958 100644
--- a/src/crypto/tls/handshake_test.go
+++ b/src/crypto/tls/handshake_test.go
@@ -450,6 +450,9 @@ func runMain(m *testing.M) int {
@@ -453,6 +453,9 @@ func runMain(m *testing.M) int {
"-naccept", "1", "-verify_return_error", "-verifyCAfile", clientRootCAPath,
"-attime", fmt.Sprint(testTime().Unix())}

Expand Down Expand Up @@ -909,10 +909,10 @@ index cccfb8866f88ab..b2896e95e74686 100644
cipherSuitesPreferenceOrderNoAES = cipherSuitesPreferenceOrder
defaultCipherSuitesTLS13NoAES = defaultCipherSuitesTLS13
diff --git a/src/internal/godebugs/table.go b/src/internal/godebugs/table.go
index c0b2ab933addbe..d075fcf60e053f 100644
index c0251a512a7434..62cb557e9bd8d1 100644
--- a/src/internal/godebugs/table.go
+++ b/src/internal/godebugs/table.go
@@ -48,6 +48,8 @@ var All = []Info{
@@ -49,6 +49,8 @@ var All = []Info{
{Name: "httpservecontentkeepheaders", Package: "net/http", Changed: 23, Old: "1"},
{Name: "installgoroot", Package: "go/build"},
{Name: "jstmpllitinterp", Package: "html/template", Opaque: true}, // bug #66217: remove Opaque
Expand All @@ -922,7 +922,7 @@ index c0b2ab933addbe..d075fcf60e053f 100644
{Name: "multipartmaxheaders", Package: "mime/multipart"},
{Name: "multipartmaxparts", Package: "mime/multipart"},
diff --git a/src/net/http/internal/http2/transport_test.go b/src/net/http/internal/http2/transport_test.go
index 4863054a019ad9..42b7f94f1f2da7 100644
index e47bddee642e90..8edf6df90db742 100644
--- a/src/net/http/internal/http2/transport_test.go
+++ b/src/net/http/internal/http2/transport_test.go
@@ -15,6 +15,7 @@ import (
Expand All @@ -933,11 +933,11 @@ index 4863054a019ad9..42b7f94f1f2da7 100644
"io"
"log"
"math/rand"
@@ -2755,6 +2756,7 @@ func testTransportCloseAfterLostPing(t testing.TB) {
}

func TestTransportPingWriteBlocks(t *testing.T) {
@@ -2870,6 +2871,7 @@ func TestTransportPingWriteBlocks(t *testing.T) {
// The blocked mutex acquisition prevents the synctest bubble from quiescing.
//
// This also means we can't use newTestClientConn, which assumes synctest.
+ testenv.SetGODEBUG(t, "ms_tlsprofile=off")
ts := newTestServer(t,
func(w http.ResponseWriter, r *http.Request) {},
)
tr := newTransport(t)
var wg sync.WaitGroup
defer wg.Wait()
Loading