184 Commits

Author SHA1 Message Date
George Sapkin
1a1c703287 golang: bump 1.26 to 1.26.2
Fixes: CVE-2026-27140
Fixes: CVE-2026-27143
Fixes: CVE-2026-27144
Fixes: CVE-2026-32280
Fixes: CVE-2026-32281
Fixes: CVE-2026-32282
Fixes: CVE-2026-32283
Fixes: CVE-2026-32288
Fixes: CVE-2026-32289
Fixes: CVE-2026-33810
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved

Signed-off-by: George Sapkin <george@sapk.in>
2026-04-12 19:15:03 +03:00
George Sapkin
ddb2995ef0 golang: bump 1.26 to 1.26.1
Fixes: CVE-2026-25679
Fixes: CVE-2026-27137
Fixes: CVE-2026-27138
Fixes: CVE-2026-27139
Fixes: CVE-2026-27142
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.26.1+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2026-03-07 01:15:09 +02:00
George Sapkin
b284c4de94 golang: remove broken mirror
Remove dl.google.com mirror because it's not responding.

Signed-off-by: George Sapkin <george@sapk.in>
2026-03-07 01:15:09 +02:00
George Sapkin
e9e8502f78 golang: replace 1.25 with to 1.26.0
Replace golang1.25 with golang1.26 with version 1.26.0.

Update OS/arch combinations.

Bump bootstrap to 1.24.13.

Link: https://go.dev/doc/go1.26
Link: https://github.com/openwrt/packages/pull/28552
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-11 13:24:21 +02:00
George Sapkin
5065a2ff8f golang: bump 1.25 to 1.25.7
Fixes: CVE-2025-61732
Fixes: CVE-2025-68121
Changes: https://github.com/golang/go/issues?q=milestone%3AGo1.25.7+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin
e013778bac golang: add support for release candidates
Support building release candidates by setting GO_VERSION_RC to the
release candidate number, e.g. GO_VERSION_RC:=2, and unsetting
GO_VERSION_PATCH.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin
35303fb1ab golang: add missing 386 and arm64 suffixes
Add missing 386 and arm64 suffixes to -installsuffix so as not to
accidentally mix incompatible binaries.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin
1eaa1f848b golang: use upstream OS/arch format
Use OS/arch format used by Go and reported by go tool dist list.

Update OS/arch combinations.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-05 22:04:26 +02:00
George Sapkin
9d8ac9df17 golang: add option to skip building bootstrap
Introduce a new configuration option - GOLANG_BUILD_BOOTSTRAP - that
defaults to enabled:

- When enabled, build the local bootstrap instead of using an external
  one for host Go. If GOLANG_EXTERNAL_BOOTSTRAP_ROOT is set, skip the
  initial 1.4 step.

- When disabled, let Go auto-detect the toolchain or use the toolchain
  specified in GOLANG_EXTERNAL_BOOTSTRAP_ROOT to skip building the
  bootstrap and build host Go using that toolchain directly. Configured
  toolchain must be compatible with the current version of Go.

HOST_BUILD_DEPENDS cannot be conditional, so some Makefile juggling is
needed.

Put menu config under bootstrap only.

Remove unnecessary package-related flags from host-only bootstrap.

Signed-off-by: George Sapkin <george@sapk.in>
2026-02-04 08:56:32 +02:00
George Sapkin
5657eb0e2e golang: split src into separate packages
Split misc sources and test data into separate packages. Reduces target
src package size by a third.

Move architecture-dependent generated source from src to the main
package.

Mark doc, misc, src and tests packages with PKGARCH:=all as they don't
have any architecture-specific files.

Fix stripping and strip compiler only.

Fixes: c137c382 ("golang: new packages")
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
6f4155c0a0 golang: install into lib instead of share
Installing into share and symlinking to lib breaks tests:

--- FAIL: TestAllDependencies (0.01s)

    moddeps_test.go:49: findGorootModules didn't find the well-known module "std"

--- FAIL: TestDependencyVersionsConsistent (0.00s)

    moddeps_test.go:356: findGorootModules didn't find the well-known module "std"

Install into lib directly instead.

Fixes: c137c382 ("golang: new packages")
Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
a6e94447f7 golang: fix missing dependency check
Add libraries used in test data to extra_provides to pass dependency
checks in package-pack.

Remove unnecessary dependencies.

Fixes: https://github.com/openwrt/packages/issues/27633
Fixes: b2119465 ("golang: Update to 1.24.0")
Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
4396682602 golang: fix generating zbootstrap
Fix setting architecture-specific defaults in zbootstrap.go.

Fixes: b2119465 ("golang: Update to 1.24.0")
Link: cce90c1eeb
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
d7e97387d1 golang: don't set GO_LDSO
Don't set GO_LDSO as it's determined automatically at link time.

Link: https://github.com/golang/go/issues/54197
Link: https://github.com/openwrt/packages/pull/28445
Suggested-by: Jeffery To <jeffery.to@gmail.com>
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
97566a8308 golang: avoid expanding Makefile variables
Replace Makefile variables in comments to avoid expanding them
unnecessarily.

Link: https://github.com/openwrt/packages/pull/28445
Signed-off-by: George Sapkin <george@sapk.in>
2026-02-02 10:10:03 +02:00
George Sapkin
8958c991c9 golang: add generic package definition
Move version definition to a helper file so multiple versions can be
easily defined using it.

Variables HOST_GO_VARS, PKG_GO_ASMFLAGS, PKG_GO_GCFLAGS,
PKG_GO_INSTALL_ARGS, PKG_GO_LDFLAGS, PKG_GO_VARS, and
PKG_GO_ZBOOTSTRAP_MODS are defined using conditional variable
assignment and can be overridden for each go version.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00
George Sapkin
ca501ee61e golang: add versioned package for 1.25
Add versioned package for 1.25 to enable having multiple host go
versions side by side.

Set default version to 1.25 in golang-values.mk

Add unversioned dummy package to allow go-based packages to continue
using the default go host version. Packages can use it by specifying:

PKG_BUILD_DEPENDS:=golang/host

or use a specific version out of the ones that are available in that
branch by specifying:

PKG_BUILD_DEPENDS:=golang1.25/host

Host go is exposed to each package through PATH set in
GO_PKG_BUILD_CONFIG_VARS and GO_PKG_VARS.

Target go is installed through alternatives with the default version
having higher priority.

Newer versions can reuse older ones as bootstraps by setting
GO_BOOTSTRAP_VERSION package variable to older version, e.g.:

GO_BOOTSTRAP_VERSION:=1.24

All subpackages provide suffix-less names, e.g. golang, golang-src, etc.
Default versions are marked as default variants.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00
George Sapkin
662972a252 golang: split bootstrap into a separate package
Split bootstrap into a new package to enable multiple versions of go to
reuse the same bootstrap.

Add more source mirrors.

Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00
George Sapkin
51aa478bea golang: add SPDX license identifiers
Link: https://spdx.org/licenses/GPL-2.0-only.html
Link: https://github.com/openwrt/packages/pull/28309
Signed-off-by: George Sapkin <george@sapk.in>
2026-01-25 19:23:45 +02:00
David Mandy
dbaeeb38d3 golang: bump to 1.25.6
Fixes: CVE-2025-61726
Fixes: CVE-2025-61728
Fixes: CVE-2025-61730
Fixes: CVE-2025-61731
Fixes: CVE-2025-68119
Fixes: CVE-2025-68121
Link: https://github.com/golang/go/issues?q=milestone%3AGo1.25.6+label%3ACherryPickApproved
Signed-off-by: David Mandy <smallprogramzhusir@gmail.com>
2026-01-25 15:29:44 +02:00
George Sapkin
c9895bfda8 golang: bump to 1.25.5
Fixes: CVE-2025-61727
Fixes: CVE-2025-61729
Link: https://github.com/golang/go/issues?q=milestone%3AGo1.25.5+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2025-12-04 14:05:58 +02:00
George Sapkin
bfd5e0e899 golang: set GOARM64 based on CONFIG_CPU_TYPE
Fixes: https://github.com/openwrt/packages/issues/26852
Signed-off-by: George Sapkin <george@sapk.in>
2025-11-09 15:23:50 +02:00
George Sapkin
9e5831ed42 golang: bump to 1.25.4
go1.25.4 (released 2025-11-05) includes fixes to the compiler, the
runtime, and the crypto/subtle, encoding/pem, net/url, and os packages.

Link: https://github.com/golang/go/issues?q=milestone%3AGo1.25.4+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2025-11-08 14:18:48 +01:00
Tianling Shen
23c3d208e8 golang: Update to 1.25.3
go1.25.2 (released 2025-10-07) includes security fixes to the
archive/tar, crypto/tls, crypto/x509, encoding/asn1, encoding/pem,
net/http, net/mail, net/textproto, and net/url packages, as well as
bug fixes to the compiler, the runtime, and the context, debug/pe,
net/http, os, and sync/atomic packages.

go1.25.3 (released 2025-10-13) includes fixes to the crypto/x509
package.

Changelog: https://go.dev/doc/devel/release#go1.25.minor

Fixes:
- CVE-2025-47912
- CVE-2025-58183
- CVE-2025-58185
- CVE-2025-58186
- CVE-2025-58187
- CVE-2025-58188
- CVE-2025-58189
- CVE-2025-61723
- CVE-2025-61724
- CVE-2025-61725

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2025-10-20 22:56:05 +08:00
Sandro Jäckel
e4b9245fcf golang: update to 1.25.1
Fixes: CVE-2025-47910
Link: https://github.com/golang/go/issues?q=milestone%3AGo1.25.1%20label%3ACherryPickApproved
Signed-off-by: Sandro Jäckel <sandro.jaeckel@gmail.com>
2025-09-16 22:04:00 +08:00
George Sapkin
bfd3058770 golang: bump to 1.25.0
Fixes: CVE-2025-47907
Link: https://go.dev/doc/go1.25
Signed-off-by: George Sapkin <george@sapk.in>
2025-08-24 22:25:17 +08:00
Tianling Shen
c8ad05854d golang: disable build for powerpc64
e5500 is the only powerpc64 target we have in tree, but it's not
supported by golang[1]. Since it's hard to opt e5500 out from the
supported arch list, simply remove powerpc64 from it for now.

1. https://github.com/golang/go/issues/19074

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2025-08-04 12:50:19 +08:00
George Sapkin
d0932ad76c golang: bump to 1.24.5
go1.24.5 (released 2025-07-08) includes security fixes to the go
command, as well as bug fixes to the compiler, the linker, the runtime,
and the go command.

Link: https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2025-07-10 15:44:43 +08:00
George Sapkin
09f434056d golang: bump to 1.24.4
go1.24.4 (released 2025-06-05) includes security fixes to the
crypto/x509, net/http, and os packages, as well as bug fixes to the
linker, the go command, and the hash/maphash and os packages.

Fixes CVE-2025-4673

Link: https://github.com/golang/go/issues?q=milestone%3AGo1.24.4+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2025-06-16 18:23:12 +08:00
Jeffery To
f7d2ebfe37 golang: Fix host build compatibility with GCC 15
Fixes https://github.com/openwrt/packages/issues/26446.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2025-06-05 20:45:14 +02:00
George Sapkin
4f9e5b37d0 golang: bump to 1.24.3
go1.24.3 (released 2025-05-06) includes security fixes to the os
package, as well as bug fixes to the runtime, the compiler, the linker,
the go command, and the crypto/tls and os packages.

Link: https://github.com/golang/go/issues?q=milestone%3AGo1.24.2+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2025-05-08 14:23:41 +08:00
George Sapkin
73c9031169 golang: bump to 1.24.2
go1.24.2 (released 2025-04-01) includes security fixes to the net/http
package, as well as bug fixes to the compiler, the runtime, the go
command, and the crypto/tls, go/types, net/http, and testing packages.

Link: https://github.com/golang/go/issues?q=milestone%3AGo1.24.2+label%3ACherryPickApproved
Signed-off-by: George Sapkin <george@sapk.in>
2025-04-05 02:33:53 +08:00
Tianling Shen
e28a0846d9 golang: Update to 1.24.1
go1.24.1 (released 2025-03-04) includes security fixes to the net/http
package, as well as bug fixes to cgo, the compiler, the go command,
and the reflect, runtime, and syscall packages.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2025-03-07 01:22:45 +08:00
Tianling Shen
b211946520 golang: Update to 1.24.0
Add libstdcpp and libtiff as dependencies, which are required by
debug/elf package.

Release note: https://go.dev/doc/go1.24

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2025-03-07 01:22:45 +08:00
Tianling Shen
86b0144211 golang: Update to 1.23.6
go1.23.5 (released 2025-01-16) includes security fixes to the
crypto/x509 and net/http packages, as well as bug fixes to the
compiler, the runtime, and the net package.

go1.23.6 (released 2025-02-04) includes security fixes to the
crypto/elliptic package, as well as bug fixes to the compiler
and the go command.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2025-02-09 17:54:10 +08:00
Tianling Shen
edab60b0f8 golang: Update to 1.23.4
go1.23.4 (released 2024-12-03) includes fixes to the compiler, the
runtime, the trace command, and the syscall package.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2024-12-30 11:31:27 +08:00
Tianling Shen
b9dc86034b golang: Update to 1.23.3
go1.23.3 (released 2024-11-06) includes fixes to the linker,
the runtime, and the net/http, os, and syscall packages.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2024-11-16 16:39:04 +08:00
Milinda Brantini
cd20d4c394 golang: Update to 1.23.2
go1.23.2 (released 2024-10-01) includes fixes to the compiler, cgo,
the runtime, and the maps, os, os/exec, time, and unique packages.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
2024-10-03 17:09:51 +08:00
Milinda Brantini
ae0d0879f5 golang: Optimized values to suit golang 1.23
Added GOARM64 and GORISCV64 in golang-build.sh.
Drop deprecated GOROOT_FINAL in GoCompiler/Default/Make.
Updated environment vars in golang-values.mk for GOARM64 and GORISCV64.
Refined host build in golang/Makefile for openbsd_riscv64.

Co-authored-by: Tianling Shen <cnsztl@immortalwrt.org>
Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
2024-10-01 18:18:11 +08:00
Milinda Brantini
bfb9e266dc golang: Update to 1.23.1
Go 1.23.1 (released 2024-09-05) includes security fixes to
the encoding/gob, go/build/constraint, and go/parser
packages. It also addresses bug fixes in the compiler,
go command, runtime, and the database/sql, go/types,
os, runtime/trace, and unique packages.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
2024-10-01 18:18:11 +08:00
Milinda Brantini
52fc48971d golang: Update to 1.22.7
go1.22.7(released 2024-09-05)includes security fixes to the encoding/gob,
go/build/constraint, and go/parser packages,
as well as bug fixes to the fix command and the runtime.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
2024-09-08 23:53:28 +08:00
Milinda Brantini
7b4fbfda5d golang: Update to 1.22.6
go1.22.6 (released 2024-08-06) includes fixes to the go command,
the compiler, the linker, the trace command, the covdata command,
and the bytes, go/types, and os/exec packages.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
2024-08-10 16:59:36 +08:00
Milinda Brantini
18aaf0cc44 golang: Update to 1.22.5
go1.22.5 (2024-07-02) includes security fixes to the net/http package, 
as well as bug fixes to the compiler, cgo, the go command, the linker, 
the runtime, and the crypto/tls, go/types, net, net/http, and os/exec.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
2024-07-08 16:49:12 -07:00
Milinda Brantini
b4ffdb4c42 golang: Update to 1.22.4
go1.22.4 (released 2024-06-04) includes
security fixes to the archive/zip and net/netip packages,
as well as bug fixes to the compiler,
the go command, the linker,
the runtime, and the os package.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
2024-06-10 04:45:29 +08:00
Tianling Shen
b642f337b2 golang: Update to 1.22.3
go1.22.3 (released 2024-05-07) includes security fixes to the go command
and the net package, as well as bug fixes to the compiler, the runtime,
and the net/http package.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2024-05-28 14:09:12 +08:00
Tianling Shen
32a22201db golang: Enable loongarch64 for Go compiler and packages
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2024-05-09 16:15:50 +08:00
Shi JiaYang
6095a031cd golang: update to 1.22.2
go1.22.2 (released 2024-04-03) includes a security fix to the
net/http package, as well as bug fixes to the compiler, the
go command, the linker, and the encoding/gob, go/types,
net/http, and runtime/trace packages.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.22.2
Find out more:
https://github.com/golang/go/issues?q=milestone%3AGo1.22.2

Signed-off-by: Shi JiaYang <shi05275@163.com>
2024-04-06 10:21:41 +08:00
Zephyr Lykos
456fa1f1b6 golang: Update to 1.22.1
Go 1.22.1 contains the following security fixes:

- CVE-2024-24783:
  crypto/x509: Verify panics on certificates with an unknown public key
  algorithm
- CVE-2023-45290
  net/http: memory exhaustion in Request.ParseMultipartForm
- CVE-2023-45289
  net/http, net/http/cookiejar: incorrect forwarding of sensitive headers
  and cookies on HTTP redirect
- CVE-2024-24785
  html/template: errors returned from MarshalJSON methods may break
  template escaping
- CVE-2024-24784
  net/mail: comments in display names are incorrectly handled

https://go.dev/doc/devel/release#go1.22.1
https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg

Signed-off-by: Zephyr Lykos <git@mochaa.ws>
2024-03-20 17:25:09 +08:00
Zephyr Lykos
a66a378669 golang: Update to 1.22.0
Added a third bootstrap stage since go1.22 (and onwards) requires
at least go1.20.14 to build.[1]

[1]: https://go.dev/doc/go1.22#bootstrap

Signed-off-by: Zephyr Lykos <git@mochaa.ws>
2024-03-20 17:25:09 +08:00
Tianling Shen
34867e83ca golang: Update to 1.21.7
go1.21.6 (released 2024-01-09) includes fixes to the compiler,
the runtime, and the crypto/tls, maps, and runtime/pprof packages.

go1.21.7 (released 2024-02-06) includes fixes to the compiler,
the go command, the runtime, and the crypto/x509 package.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
2024-03-02 19:16:06 +08:00