summaryrefslogtreecommitdiff
path: root/lang/go
AgeCommit message (Collapse)AuthorFilesLines
2020-10-15Update go115 to 1.15.3.bsiegert1-2/+2
go1.15.2 (released 2020/09/09) includes fixes to the compiler, runtime, documentation, the go command, and the net/mail, os, sync, and testing packages. See the Go 1.15.2 milestone on our issue tracker for details. go1.15.3 (released 2020/10/14) includes fixes to cgo, the compiler, runtime, the go command, and the bytes, plugin, and testing packages. See the Go 1.15.3 milestone on our issue tracker for details.
2020-10-15Update go114 to 1.14.10.bsiegert1-2/+2
go1.14.9 (released 2020/09/09) includes fixes to the compiler, linker, runtime, documentation, and the net/http and testing packages. See the Go 1.14.9 milestone on our issue tracker for details. go1.14.10 (released 2020/10/14) includes fixes to the compiler, runtime, and the plugin and testing packages. See the Go 1.14.10 milestone on our issue tracker for details.
2020-09-03Update go114 to 1.14.8.bsiegert1-2/+2
go1.14.8 (released 2020/09/01) includes security fixes to the net/http/cgi and net/http/fcgi packages. See the Go 1.14.8 milestone on our issue tracker for details.
2020-09-03Update go115 to 1.15.1.bsiegert1-3/+3
go1.15.1 (released 2020/09/01) includes security fixes to the net/http/cgi and net/http/fcgi packages. See the Go 1.15.1 milestone on our issue tracker for details.
2020-08-30go/go-module.mk: sort show-go-modules outputtnn1-3/+2
2020-08-30go-vars.mk: set RELRO_SUPPORTED=no heretnn1-1/+2
So we don't have to set CHECK_RELRO_SKIP in every go package. It's a property of golang and may get fixed some day.
2020-08-21Add a package for Go 1.15.bsiegert1-1/+2
The latest Go release, version 1.15, arrives six months after Go 1.14. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before. Go 1.15 includes substantial improvements to the linker, improves allocation for small objects at high core counts, and deprecates X.509 CommonName. GOPROXY now supports skipping proxies that return errors and a new embedded tzdata package has been added. There are no changes to the language.
2020-08-20go-module.mk: fix permission denied as non-root when running "make clean"tnn1-1/+4
2020-08-14Update go114 to 1.14.7.bsiegert1-2/+2
go1.14.7 (released 2020/08/06) includes security fixes to the encoding/binary package. See the Go 1.14.7 milestone on our issue tracker for details.
2020-08-14Update go113 to 1.13.15.bsiegert1-2/+2
go1.13.15 (released 2020/08/06) includes security fixes to the encoding/binary package. See the Go 1.13.15 milestone on our issue tracker for details.
2020-07-17Update go114 to 1.14.6.bsiegert1-2/+2
go1.14.5 (released 2020/07/14) includes security fixes to the crypto/x509 and net/http packages. See the Go 1.14.5 milestone on our issue tracker for details. go1.14.6 (released 2020/07/16) includes fixes to the go command, the compiler, the linker, vet, and the database/sql, encoding/json, net/http, reflect, and testing packages. See the Go 1.14.6 milestone on our issue tracker for details.
2020-07-17Update go113 to 1.13.14.bsiegert1-2/+2
go1.13.12 (released 2020/06/01) includes fixes to the runtime, and the go/types and math/big packages. See the Go 1.13.12 milestone on our issue tracker for details. go1.13.13 (released 2020/07/14) includes security fixes to the crypto/x509 and net/http packages. See the Go 1.13.13 milestone on our issue tracker for details. go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the database/sql, net/http, and reflect packages. See the Go 1.13.14 milestone on our issue tracker for details.
2020-07-17go-module.mk: Run "go mod download" to prime the module cache.bsiegert1-2/+2
This was suggested by Russ Cox, instead of "go get".
2020-06-17Update go114 to 1.14.4.bsiegert1-2/+2
go1.14.3 (released 2020/05/14) includes fixes to cgo, the compiler, the runtime, and the go/doc and math/big packages. See the Go 1.14.3 milestone on our issue tracker for details. go1.14.4 (released 2020/06/01) includes fixes to the go doc command, the runtime, and the encoding/json and os packages. See the Go 1.14.4 milestone on our issue tracker for details.
2020-05-16Update go113 to 1.13.11.bsiegert2-4/+4
go1.13.11 (released 2020/05/14) includes fixes to the compiler. See the Go 1.13.11 milestone on our issue tracker for details.
2020-05-02go/bootstrap.mk: depend on lang/go-bin on {Linux,NetBSD}-*-aarch64tnn1-13/+6
2020-05-01go/bootstrap.mk: add manual user instructions for aarch64 bootstraptnn1-1/+14
In lieu of something better, like lang/go14 aarch64 support ...
2020-05-01go/version.mk: now supports aarch64tnn1-2/+7
2020-05-01go/bootstrap.mk: allow user to set GOROOT_BOOTSTRAP in mk.conftnn1-1/+3
2020-05-01go*: move definition of GOROOT_BOOTSTRAP to go/bootstrap.mk.tnn1-0/+4
NFC. But will later need to do something else when MACHINE_ARCH == aarch64. Also drop dup include of bsd.prefs.mk. go/version.mk does this already.
2020-04-12Add support for building Go modules in pkgsrc.bsiegert1-0/+84
This is for packages containing a "go.mod" file.
2020-04-12Update go113 to 1.13.10.bsiegert1-3/+2
go1.13.10 (released 2020/04/08) includes fixes to the go command, the runtime, os/exec, and time packages. See the Go 1.13.10 milestone on our issue tracker for details.
2020-04-12Set 1.14 as default Go version.bsiegert1-2/+2
1.14.2 is good now :)
2020-04-09Update go114 to 1.14.2.bsiegert1-2/+2
go1.14.2 (released 2020/04/08) includes fixes to cgo, the go command, the runtime, os/exec, and testing packages. See the Go 1.14.2 milestone on our issue tracker for details. From what I know from work, 1.14.1 had a nasty runtime bug that is now fixed.
2020-03-30Support UNLIMIT_RESOURCES for go packages.joerg1-3/+3
2020-03-21Update go113 to 1.13.9.bsiegert1-2/+2
This release includes fixes to the go command, tools, the runtime, the toolchain, and to the crypto/cypher package. View the release notes for more information: https://golang.org/doc/devel/release.html#go1.13.minor
2020-03-21Remove GO112_VERSION and GO111_VERSION.bsiegert1-3/+1
2020-03-20Update go114 to 1.14.1.bsiegert1-2/+2
This release include fixes to the go command, tools, the runtime, the toolchain, and to the crypto/cypher package. View the release notes for more information: https://golang.org/doc/devel/release.html#go1.14.minor
2020-02-27Update go113 to 1.13.8.bsiegert1-2/+2
This release includes fixes to the runtime, the crypto/x509, and net/http packages.
2020-02-27Add a package for Go 1.14.bsiegert1-1/+2
The default will remain at 1.13 for the next branch. The latest Go release, version 1.14, arrives six months after Go 1.13. Most of its changes are in the implementation of the toolchain, runtime, and libraries. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before. See the release notes at https://golang.org/doc/go1.14.
2020-02-23Update go112 to 1.12.7.bsiegert1-2/+2
These releases include fixes to the runtime, the crypto/x509, and net/http packages.
2020-02-18Forcibly turn off Go module support.maya1-1/+2
We don't currently build any packages using modules, and the switch to newer versions of Go has resulted in the default changing to modules being sometimes enabled. This now causes random packages to begin fetching from the Internet during builds, which goes against pkgsrc policy. Doesn't seem to harm the ability to build a random subset of the Go packages in pkgsrc.
2020-02-02Update go113 to 1.13.7 (security release).bsiegert1-2/+2
Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte can lead to a panic. The malformed certificate can be delivered via a crypto/tls connection to a client, or to a server that accepts client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Thanks to Project Wycheproof for providing the test cases that led to the discovery of this issue. The issue is CVE-2020-7919 and Go issue golang.org/issue/36837. This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of golang.org/x/crypto/cryptobyte.
2020-02-02Update go112 to 1.12.16 (security release).bsiegert1-2/+2
Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte can lead to a panic. The malformed certificate can be delivered via a crypto/tls connection to a client, or to a server that accepts client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Thanks to Project Wycheproof for providing the test cases that led to the discovery of this issue. The issue is CVE-2020-7919 and Go issue golang.org/issue/36837. This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of golang.org/x/crypto/cryptobyte.
2020-01-26all: migrate homepages from http to httpsrillig1-2/+2
pkglint -r --network --only "migrate" As a side-effect of migrating the homepages, pkglint also fixed a few indentations in unrelated lines. These and the new homepages have been checked manually.
2020-01-10go: use go113 as the default for building packages.bsiegert1-2/+2
I did a preliminary bulk build to find build failures resulting from this change and fixed the fallout in www/grafana. Everything else seemed to be ok.
2020-01-10Update go112 to 1.12.15.bsiegert1-2/+2
These releases include fixes to the runtime and to the net/http package. The macOS releases enable the Hardened Runtime. See https://golang.org/issue/34986 for details. View the release notes for more information: https://golang.org/doc/devel/release.html#go1.13.minor
2020-01-10Update go113 to 1.13.6.bsiegert1-2/+2
These releases include fixes to the runtime and to the net/http package. The macOS releases enable the Hardened Runtime. See https://golang.org/issue/34986 for details. View the release notes for more information: https://golang.org/doc/devel/release.html#go1.13.minor
2019-12-13Update go112 to 1.12.14.bsiegert1-2/+2
go1.12.13 (released 2019/10/31) fixes an issue on macOS 10.15 Catalina where the non-notarized installer and binaries were being rejected by Gatekeeper. Only macOS users who hit this issue need to update. go1.12.14 (released 2019/12/04) includes a fix to the runtime. See the Go 1.12.14 milestone on our issue tracker for details.
2019-12-09go: Split *_SUPPORTED variables out into new go-vars.mk.jperkin2-6/+27
It's not always possible to include go-package.mk earlier than bsd.prefs.mk in a package, for example if the package defines its own do-install target, so move out the *_SUPPORTED variables that need to be included first.
2019-12-08Add go113.bsiegert1-1/+2
I forgot to include this file in the go113 commit, thanks wiz@ for notifying me!
2019-12-07lang/go: add go to the tools directoryrillig1-1/+4
This makes it easier to run the Go compiler from within the build environment created by "bmake build-env".
2019-11-03lang: align variable assignmentsrillig1-12/+12
pkglint -Wall -F --only aligned --only indent -r No manual corrections.
2019-10-18Update go112 to 1.12.12.bsiegert1-2/+2
qo1.12.11 (released 2019/10/17) includes security fixes to the crypto/dsa package. See the Go 1.12.11 milestone on our issue tracker for details. go1.12.12 (released 2019/10/17) includes fixes to the go command, runtime, syscall and net packages. See the Go 1.12.12 milestone on our issue tracker for details.
2019-09-26Update go112 to 1.12.10.bsiegert1-2/+2
Commit ok'd by wiz@ for PMC. Go 1.12.10: net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same upstream connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications. The issue is CVE-2019-16276 and Go issue golang.org/issue/34540. Go 1.12.9: go1.12.9 (released 2019/08/15) includes fixes to the linker, and the os and math/big packages. See the Go 1.12.9 milestone on our issue tracker for details.
2019-09-17lang/go: on osx 10.9 and earlier, use go110dbj1-1/+6
go 1.11 removed support for osx 10.8 and 10.9 https://github.com/golang/go/issues/23122
2019-09-10lang/go: update _VARGROUPS in go-package.mk, small refactoringrillig1-12/+12
2019-09-10lang/go: extend _VARGROUPS section in go-dep.mkrillig1-1/+13
2019-08-14go112: update to 1.12.8 (security release).bsiegert1-2/+2
net/http: Denial of Service vulnerabilities in the HTTP/2 implementation net/http and golang.org/x/net/http2 servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. Servers will now close connections if the send queue accumulates too many control messages. The issues are CVE-2019-9512 and CVE-2019-9514, and Go issue golang.org/issue/33606. Thanks to Jonathan Looney from Netflix for discovering and reporting these issues. This is also fixed in version v0.0.0-20190813141303-74dc4d7220e7 of golang.org/x/net/http2. net/url: parsing validation issue url.Parse would accept URLs with malformed hosts, such that the Host field could have arbitrary suffixes that would appear in neither Hostname() nor Port(), allowing authorization bypasses in certain applications. Note that URLs with invalid, not numeric ports will now return an error from url.Parse. The issue is CVE-2019-14809 and Go issue golang.org/issue/29098. Thanks to Julian Hector and Nikolai Krein from Cure53, and Adi Cohen (adico.me) for discovering and reporting this issue.
2019-08-14go111: update to 1.11.13 (security release).bsiegert1-2/+2
net/http: Denial of Service vulnerabilities in the HTTP/2 implementation net/http and golang.org/x/net/http2 servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. Servers will now close connections if the send queue accumulates too many control messages. The issues are CVE-2019-9512 and CVE-2019-9514, and Go issue golang.org/issue/33606. Thanks to Jonathan Looney from Netflix for discovering and reporting these issues. This is also fixed in version v0.0.0-20190813141303-74dc4d7220e7 of golang.org/x/net/http2. net/url: parsing validation issue url.Parse would accept URLs with malformed hosts, such that the Host field could have arbitrary suffixes that would appear in neither Hostname() nor Port(), allowing authorization bypasses in certain applications. Note that URLs with invalid, not numeric ports will now return an error from url.Parse. The issue is CVE-2019-14809 and Go issue golang.org/issue/29098. Thanks to Julian Hector and Nikolai Krein from Cure53, and Adi Cohen (adico.me) for discovering and reporting this issue.
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-10 16:13:26 +0000