[release-branch.go1.26] Suppress follow-on systemcrypto errors without cgo - #2480
Merged
George Adams (gdams) merged 1 commit intoAug 25, 2026
Merged
Conversation
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
Quim Muntal (qmuntal)
approved these changes
Aug 25, 2026
George Adams (gdams)
force-pushed
the
dev/gadams/cgoerr
branch
from
August 25, 2026 09:48
1fa0889 to
a36375b
Compare
George Adams (gdams)
enabled auto-merge (squash)
August 25, 2026 09:49
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses a Linux + CGO_ENABLED=0 scenario where requesting GOEXPERIMENT=systemcrypto produces the intended CGO diagnostic but was followed by additional, misleading crypto/internal/backend/fips140 undefined-symbol compiler errors. The change adjusts backend selection so an inert FIPS backend is chosen in that configuration, and updates the cmd/go regression test to assert the output is limited to the expected diagnostic.
Changes:
- Extend the
crypto/internal/backend/fips140“no-backend” selection logic to cover thesystemcrypto+ OpenSSL-without-cgo configuration, preventing follow-on undefined-symbol errors. - Update
cmd/goregression coverage to assert the CGO diagnostic is present and that nocrypto/internal/backend/fips140diagnostic is emitted. - Minor patch hygiene updates (patch stats/index updates) as part of the patch file refresh.
Show a summary per file
| File | Description |
|---|---|
| patches/0003-Implement-crypto-internal-backend.patch | Updates backend build-tag selection and strengthens cmd/go regression testing to avoid follow-on FIPS backend compiler diagnostics when systemcrypto is requested without CGO. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Lite
George Adams (gdams)
merged commit Aug 25, 2026
29061e3
into
microsoft/release-branch.go1.26
42 checks passed
Davis Goodin (dagood)
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When systemcrypto is requested on Linux with CGO disabled, select the inert FIPS backend alongside the existing no-backend implementation. This preserves the intended CGO diagnostic while preventing follow-on undefined-symbol errors from crypto/internal/backend/fips140.
The cmd/go regression test now verifies that the CGO diagnostic is present and no FIPS backend diagnostic is emitted.
Tested with:
Fixes #2473