summaryrefslogtreecommitdiff
path: root/lang/go
AgeCommit message (Collapse)AuthorFilesLines
2016-04-13Update Go to 1.6.1.bsiegert5-36/+11
Two security-related issues were recently reported, and to address these issues we have just released Go 1.6.1 and Go 1.5.4. We recommend that all users update to one of these releases (if you're not sure which, choose Go 1.6.1). The issues addressed by these releases are: On Windows, Go loads system DLLs by name with LoadLibrary, making it vulnerable to DLL preloading attacks. For instance, if a user runs a Go executable from a Downloads folder, malicious DLL files also downloaded to that folder could be loaded into that executable. This is CVE-2016-3958 and was addressed by this change: https://golang.org/cl/21428 Thanks to Taru Karttunen for identifying this issue. Go's crypto libraries passed certain parameters unchecked to the underlying big integer library, possibly leading to extremely long-running computations, which in turn makes Go programs vulnerable to remote denial of service attacks. Programs using HTTPS client certificates or the Go SSH server libraries are both exposed to this vulnerability. This is CVE-2016-3959 and was addressed by this change: https://golang.org/cl/21533 Thanks to David Wong for identifying this issue.
2016-04-08Patch CVE-2016-3959 in Go. There will be a Go 1.6.1 release next week thatbsiegert3-2/+29
fixes this properly.
2016-03-09Add Linux specific PLISTtnn1-0/+2
2016-02-23Update Go to 1.6.bsiegert4-195/+482
The latest Go release, version 1.6, arrives six months after 1.5. Most of its changes are in the implementation of the language, runtime, and libraries. There are no changes to the language specification. As always, the release maintains the Go 1 promise of compatibility. We expect almost all Go programs to continue to compile and run as before. The release adds new ports to Linux on 64-bit MIPS and Android on 32-bit x86; defined and enforced rules for sharing Go pointers with C; transparent, automatic support for HTTP/2; and a new mechanism for template reuse. Full changelog at https://golang.org/doc/go1.6.
2016-01-31Add the correct path for SSL certificates that mozilla-rootcerts uses.bsiegert3-2/+14
PR pkg/50690.
2016-01-23Made Go packages testable and cleaned up shell commandsrillig1-7/+12
Prevented the error message "*** Error 1 (ignored) ***" during installation by using || instead of &&. Shell commands are hidden during normal operation. Go packages can be tested using "bmake test". ok @bsiegert
2016-01-16Update lang/go to 1.5.3.fhajny5-219/+9
This is a security-related release, it fixes CVE-2015-8618 that was partically patched in 1.5.2nb1. See full release notes for a description: https://groups.google.com/d/msg/golang-announce/MEATuOi_ei4/JsndUuZwEAAJ
2015-12-29Real buildlink support for Go, hacked with wiz@.bsiegert1-2/+2
Go packages now define a set of files to buildlink in their buildlink3.mk. go-packages.mk no longer looks in ${PREFIX}/gopkg during the build. This should also fix the spurious issues with rebuilds of .a files during bulk builds of Go packages.
2015-12-27Document variables this mk file provides.wiz1-1/+18
Ok bsiegert@
2015-12-22Pull in https://golang.org/cl/17672, "math/big: fix carry propagation inbsiegert5-6/+214
Int.Exp Montgomery code", to fix CVE-2015-8618. From the oss-security posting that asked for a CVE: "The Go open source project has received notification of an error in the math/big library (https://golang.org/pkg/math/big/). The problem that was identified is similar to CVE-2015-3193 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3193>. The vulnerability was introduced in the 1.5 release, and remains present in Go 1.5.1 and 1.5.2. "A fix for the issue has been applied to the master branch of the Go repo under CL 17672 <https://go-review.googlesource.com/#/c/17672/>. We will also be releasing Go 1.5.3 to fix this vulnerability." ok wiz@
2015-12-10Update Go to 1.5.2, original patch from Kamel Derouiche in PR pkg/50498.bsiegert6-13/+48
go1.5.2 (released 2015/12/02) includes bug fixes to the compiler, linker, and the mime/multipart, net, and runtime packages. See the Go 1.5.2 milestone on our issue tracker for details. https://github.com/golang/go/issues?q=milestone%3AGo1.5.2
2015-11-03Add SHA512 digests for distfiles for lang categoryagc1-1/+2
Problems found with existing digests: Package nhc98 distfile nhc98src-1.22.tar.gz a8adc8f22371998ee0657bc0e01058a57d876abc [recorded] 81975fcb5f1dda5efeaabc30ce8c6dceae55e591 [calculated] Problems found locating distfiles: Package gcc-aux: missing distfile ada-bootstrap.i386.dragonfly.36A.tar.bz2 Package gcc-aux: missing distfile ada-bootstrap.i386.freebsd.84.tar.bz2 Package gcc-aux: missing distfile ada-bootstrap.x86_64.dragonfly.36A.tar.bz2 Package gcc-aux: missing distfile ada-bootstrap.x86_64.freebsd.84.tar.bz2 Package gcc-aux: missing distfile ada-bootstrap.x86_64.solaris.511.tar.bz2 Package gcc5-aux: missing distfile ada-bootstrap.i386.dragonfly.36A.tar.bz2 Package gcc5-aux: missing distfile ada-bootstrap.i386.freebsd.84.tar.bz2 Package gcc5-aux: missing distfile ada-bootstrap.x86_64.dragonfly.36A.tar.bz2 Package gcc5-aux: missing distfile ada-bootstrap.x86_64.freebsd.84.tar.bz2 Package gcc5-aux: missing distfile ada-bootstrap.x86_64.solaris.511.tar.bz2 Package ghc7: missing distfile ghc-7.6.3-boot-i386-unknown-freebsd.tar.xz Package icc11: missing distfile l_cproc_p_11.1.080.tgz Package jini: missing distfile jini-1_2_1_001-src.zip Package oo2c: missing distfile oo2c_32-2.0.11.tar.bz2 Package openjdk7: missing distfile openjdk7/bootstrap-jdk-1.7.76-freebsd-10-amd64-20150301.tar.xz Package openjdk7: missing distfile openjdk7/bootstrap-jdk-1.7.76-netbsd-5-i386-20150301.tar.xz Package openjdk7: missing distfile openjdk7/bootstrap-jdk-1.7.76-netbsd-6-i386-20150301.tar.xz Package openjdk7: missing distfile openjdk7/bootstrap-jdk-1.7.76-netbsd-7-earmv6hf-20150306.tar.xz Package openjdk7: missing distfile openjdk7/bootstrap-jdk-1.7.76-netbsd-7-sparc64-20150301.tar.xz Package openjdk7: missing distfile openjdk7/bootstrap-jdk7u60-bin-dragonfly-3.8-amd64-20140719.tar.bz2 Package openjdk8: missing distfile openjdk7/bootstrap-jdk-1.7.76-freebsd-10-amd64-20150301.tar.xz Package openjdk8: missing distfile openjdk7/bootstrap-jdk-1.7.76-netbsd-5-i386-20150301.tar.xz Package openjdk8: missing distfile openjdk7/bootstrap-jdk-1.7.76-netbsd-6-i386-20150301.tar.xz Package openjdk8: missing distfile openjdk7/bootstrap-jdk-1.7.76-netbsd-7-earmv6hf-20150306.tar.xz Package openjdk8: missing distfile openjdk7/bootstrap-jdk-1.7.76-netbsd-7-sparc64-20150301.tar.xz Package openjdk8: missing distfile openjdk7/bootstrap-jdk7u60-bin-dragonfly-3.8-amd64-20140719.tar.bz2 Package oracle-jdk8: missing distfile jdk-8u60-linux-i586.tar.gz Package oracle-jdk8: missing distfile jdk-8u60-solaris-x64.tar.gz Package oracle-jre8: missing distfile jre-8u60-linux-i586.tar.gz Package oracle-jre8: missing distfile jre-8u60-solaris-x64.tar.gz Package sun-jdk6: missing distfile jdk-6u45-linux-i586.bin Package sun-jdk6: missing distfile jdk-6u45-solaris-i586.sh Package sun-jdk7: missing distfile jdk-7u72-linux-i586.tar.gz Package sun-jdk7: missing distfile jdk-7u72-solaris-i586.tar.gz Package sun-jre6: missing distfile jce_policy-6.zip Package sun-jre6: missing distfile jre-6u45-linux-x64.bin Package sun-jre6: missing distfile jre-6u45-solaris-x64.sh Package sun-jre7: missing distfile jre-7u72-linux-i586.tar.gz Package sun-jre7: missing distfile jre-7u72-solaris-i586.tar.gz Otherwise, existing SHA1 digests verified and found to be the same on the machine holding the existing distfiles (morden). All existing SHA1 digests retained for now as an audit trail.
2015-09-26Update go14 to 1.4.3. It fixes four security-related issues.bsiegert1-2/+2
The issues were reported in Go's net/http package. They affect programs using that package to proxy HTTP requests. We recommend that all users upgrade to Go 1.5, which fixes these issues. For users unable to upgrade to Go 1.5, we have released version 1.4.3, which is based on Go 1.4.2 plus fixes for these issues. Affected Go programs—those that use the net/http package as a proxy server—must be recompiled with Go 1.5 or Go 1.4.3 to receive the fixes. The CVE issue descriptions and fixes are linked below. CVE-2015-5739 "Content Length" treated as valid header: https://go-review.googlesource.com/#/c/11772/ CVE-2015-5740 Double content-length headers does not return 400 error: https://go-review.googlesource.com/#/c/11810/ CVE-2015-5741 Additional hardening, not sending Content-Length w/Transfer-Encoding, Closing connections: https://go-review.googlesource.com/#/c/11810/ https://go-review.googlesource.com/#/c/12865/ https://go-review.googlesource.com/#/c/13148/ The Go team would like to thank Jed Denlea and Régis Leroy for their contributions to this release. They have been awarded 1337 USD under the Google Security Bounty program.
2015-09-13Remove patch for a problem that was fixed in 1.5.1.fhajny3-21/+2
Clear PKGREVISION after PKGVERSION update.
2015-09-13Update Go to 1.5.1.bsiegert3-7/+9
go1.5.1 (released 2015/09/08) includes bug fixes to the compiler, assembler, and the fmt, net/textproto, net/http, and runtime packages. See the Go 1.5.1 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.5.1
2015-08-25Add support for the dup2 syscall on SunOS. Bump PKGREVISION.fhajny3-3/+22
2015-08-25Define test target for lang/gofhajny1-1/+4
2015-08-25Remove stale cgo/SunOS patches that are no longer needed. Fixes SunOS build.fhajny5-115/+19
Fix problem with -lsendfile needed on SunOS when building 3rd party software that uses the net package.
2015-08-22Fix interpreter path in more installed files.wiz1-1/+10
Ignore another file's interpreter during build. Bump PKGREVISION.
2015-08-22Update go to 1.5.bsiegert30-1514/+1434
This release now needs the previous one (lang/go14) to build. The biggest developments in the implementation are: * The compiler and runtime are now written entirely in Go (with a little assembler). C is no longer involved in the implementation, and so the C compiler that was once necessary for building the distribution is gone. * The garbage collector is now concurrent and provides dramatically lower pause times by running, when possible, in parallel with other goroutines. * By default, Go programs run with GOMAXPROCS set to the number of cores available; in prior releases it defaulted to 1. * Support for internal packages is now provided for all repositories, not just the Go core. * The go command now provides experimental support for "vendoring" external dependencies. * A new go tool trace command supports fine-grained tracing of program execution. * A new go doc command (distinct from godoc) is customized for command-line use. Full release notes are at https://golang.org/doc/go1.5.
2015-07-31Create lang/go14 as a copy of lang/go but which installs underbsiegert1-1/+2
$PREFIX/go14. Go 1.5 is going to be released soon, and it will depend on an existing installation of Go 1.4 to compile. So let's provide one.
2015-06-12Recursive PKGREVISION bump for all packages mentioning 'perl',wiz1-2/+2
having a PKGNAME of p5-*, or depending such a package, for perl-5.22.0.
2015-05-11Actually define the GO_PLATFORM var before using it. Fixes PLIST generationbsiegert1-2/+3
for Go packages.
2015-05-03go-package.mk: add an awk fragment for print-PLIST to replace GO_PLATFORM.bsiegert1-1/+5
After a similar patch by hiramatsu@ for ocaml.mk.
2015-05-03Remove some files that no longer exist from the replace-interpreter list.bsiegert1-6/+1
2015-03-10Add pax to USE_TOOLS.bsiegert1-1/+2
2015-03-10Implement cgo support for illumos. Patches by Keith Wesolowski at Joyent.jperkin29-13/+936
Bump PKGREVISION.
2015-02-22dropped DIST_SUBDIRtnn1-4/+4
2015-02-22drop DIST_SUBDIRtnn1-2/+1
2015-02-22go1.4.2 (released 2015/02/17) includes bug fixes to the go command, the ↵mspo3-7/+13
compiler and linker, and the runtime, syscall, reflect, and math/big packages.
2015-02-04Upstream did distfile switcheroo. Update checksum to match the one listedtnn2-5/+6
on https://golang.org/dl/. Diff to previous rel revealed nothing weird.
2015-01-16Update to 1.4.1:wiz4-9/+9
We've just released Go version 1.4.1, a minor point release. This release fixes bugs in linker and the log, runtime, and syscall packages.
2015-01-13Add definition for GOTOOLDIR.bsiegert1-1/+3
This is needed for the go-tools package.
2015-01-02Add infrastructure for compiling software written in Go to pkgsrc. Thisbsiegert1-0/+43
used to be in wip/go.
2014-12-31Remove special case for golang.org/x/tools from the go command.bsiegert5-12/+31
We handle it differently in the go-tools package. While here, rename GO_COMPILER to GOCHAR, which is the name upstream uses. Bump PKGREVISION.
2014-12-13Only use PLIST subst vars were they should really be.fhajny1-15/+15
2014-12-12Update to 1.4, ok bsiegert:wiz6-2172/+2369
Today we announce Go 1.4, the fifth major stable release of Go, arriving six months after our previous major release Go 1.3. It contains a small language change, support for more operating systems and processor architectures, and improvements to the tool chain and libraries. As always, Go 1.4 keeps the promise of compatibility, and almost everything will continue to compile and run without change when moved to 1.4. For the full details, see the Go 1.4 release notes. The most notable new feature in this release is official support for Android. Using the support in the core and the libraries in the golang.org/x/mobile repository, it is now possible to write simple Android apps using only Go code. At this stage, the support libraries are still nascent and under heavy development. Early adopters should expect a bumpy ride, but we welcome the community to get involved. The language change is a tweak to the syntax of for-range loops. You may now write "for range s {" to loop over each item from s, without having to assign the value, loop index, or map key. See the release notes for details. The go command has a new subcommand, go generate, to automate the running of tools to generate source code before compilation. For example, it can be used to automate the generation of String methods for typed constants using the new stringer tool. For more information, see the design document. Most programs will run about the same speed or slightly faster in 1.4 than in 1.3; some will be slightly slower. There are many changes, making it hard to be precise about what to expect. See the release notes for more discussion. And, of course, there are many more improvements and bug fixes. In case you missed it, a few weeks ago the sub-repositories were moved to new locations. For example, the go.tools packages are now imported from "golang.org/x/tools". See the announcement post for details. This release also coincides with the project's move from Mercurial to Git (for source control), Rietveld to Gerrit (for code review), and Google Code to Github (for issue tracking and wiki). The move affects the core Go repository and its sub-repositories. You can find the canonical Git repositories at go.googlesource.com, and the issue tracker and wiki at the golang/go GitHub repo.
2014-11-18Add a separate Makefile for the version string plus GOARCH. To be usedbsiegert2-22/+25
by Go packages.
2014-10-12Update to 1.3.3:wiz2-7/+6
go1.3.3 (released 2014/09/30) includes further bug fixes to cgo, the runtime package, and the nacl port.
2014-10-11Also look for the right path for the SSL certificate repository on NetBSD.khorben3-2/+18
Fixes "go get code.google.com/p/..." for me, once security/mozilla-rootcerts installed and configured (with the default settings). Bumps PKGREVISION, since the package is modified. ok bsiegert@
2014-09-26Update to 1.3.2 for a security fix:wiz3-7/+10
We've just released Go version 1.3.2, a minor point release. This release includes bug fixes to cgo and the crypto/tls package. https://golang.org/doc/devel/release.html#go1.3.minor The crpyto/tls fix addresses a security bug that affects programs that use crypto/tls to implement a TLS server from Go 1.1 onwards. If the server enables TLS client authentication using certificates (this is rare) and explicitly sets SessionTicketsDisabled to true in the tls.Config, then a malicious client can falsely assert ownership of any client certificate it wishes. This issue was discovered internally and there is no evidence of exploitation.
2014-08-17Update to 1.3.1:wiz3-8/+9
This release includes bug fixes to the compiler and the runtime, net, and crypto/rsa packages. Ok bsiegert@
2014-07-30SunOS-*-i386 is not supported yet, don't bother building for now.fhajny1-6/+7
2014-07-07PLIST fixes for SunOS.jperkin2-3/+12
2014-06-22Update go to 1.3. One of our patches was accepted upstream.bsiegert4-140/+478
Note that this is a leaf package. schmonz says it is ok to update this now.
2014-06-14Regenjoerg1-2/+2
2014-06-14If libgcc.a doesn't exist, don't fail.joerg2-1/+18
2014-06-14Generalize the orig removal.joerg1-2/+2
2014-05-31Remove go/pkg/obj from the PLIST once and for all, and delete the directorybsiegert2-215/+4
in do-install. The obj files are build artifacts. Fixes breakage reported by wiz in private mail (I hope).
2014-05-29Bump for perl-5.20.0.wiz1-1/+2
Do it for all packages that * mention perl, or * have a directory name starting with p5-*, or * depend on a package starting with p5- like last time, for 5.18, where this didn't lead to complaints. Let me know if you have any this time.
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-18 19:35:05 +0000