Sync from SUSE:SLFO:1.1 go1.25 revision e75a78dbde2b64d329607af8b8116394

gcc-go.patch

@@ -1,64 +0,0 @@
---- go.orig/src/cmd/dist/buildtool.go
-+++ go/src/cmd/dist/buildtool.go
-@@ -203,7 +203,7 @@
- 	// Use the purego build tag to disable other assembly code,
- 	// such as in cmd/internal/notsha256.
- 	cmd := []string{
--		pathf("%s/bin/go", goroot_bootstrap),
-+		pathf("%s/bin/go-$gcc_go_version", goroot_bootstrap),
- 		"install",
- 		"-tags=math_big_pure_go compiler_bootstrap purego",
- 	}
---- go.orig/src/make.bash
-+++ go/src/make.bash
-@@ -175,8 +175,8 @@
- 		fi
- 	fi
- done; unset IFS
--if [ ! -x "$GOROOT_BOOTSTRAP/bin/go" ]; then
--	echo "ERROR: Cannot find $GOROOT_BOOTSTRAP/bin/go." >&2
-+if [ ! -x "$GOROOT_BOOTSTRAP/bin/go-$gcc_go_version" ]; then
-+	echo "ERROR: Cannot find $GOROOT_BOOTSTRAP/bin/go-$gcc_go_version." >&2
- 	echo "Set \$GOROOT_BOOTSTRAP to a working Go tree >= Go $bootgo." >&2
- 	exit 1
- fi
-@@ -194,7 +194,7 @@
- 	exit 1
- fi
- rm -f cmd/dist/dist
--GOROOT="$GOROOT_BOOTSTRAP" GOOS="" GOARCH="" GO111MODULE=off GOEXPERIMENT="" GOENV=off GOFLAGS="" "$GOROOT_BOOTSTRAP/bin/go" build -o cmd/dist/dist ./cmd/dist
-+GOROOT="$GOROOT_BOOTSTRAP" GOOS="" GOARCH="" GO111MODULE=off GOEXPERIMENT="" GOENV=off GOFLAGS="" "$GOROOT_BOOTSTRAP/bin/go-$gcc_go_version" build -o cmd/dist/dist ./cmd/dist
- 
- # -e doesn't propagate out of eval, so check success by hand.
- eval $(./cmd/dist/dist env -p || echo FAIL=true)
---- go.orig/src/make.rc	
-+++ go/src/make.rc
-@@ -58,7 +58,7 @@
- 			GOROOT_BOOTSTRAP = $home/$d
- }
- for(p in $path){
--	if(! test -x $GOROOT_BOOTSTRAP/bin/go){
-+	if(! test -x $GOROOT_BOOTSTRAP/bin/go-$gcc_go_version){
- 		if(go_exe = `{path=$p whatis go}){
- 			goroot = `{GOROOT='' $go_exe env GOROOT}
- 			if(! ~ $goroot $GOROOT){
-@@ -71,8 +71,8 @@
- 		}
- 	}
- }
--if(! test -x $GOROOT_BOOTSTRAP/bin/go){
--	echo 'ERROR: Cannot find '$GOROOT_BOOTSTRAP'/bin/go.' >[1=2]
-+if(! test -x $GOROOT_BOOTSTRAP/bin/go-$gcc_go_version){
-+	echo 'ERROR: Cannot find '$GOROOT_BOOTSTRAP'/bin/go-$gcc_go_version.' >[1=2]
- 	echo 'Set $GOROOT_BOOTSTRAP to a working Go tree >= Go '$bootgo'.' >[1=2]
- 	exit bootstrap
- }
-@@ -89,7 +89,7 @@
- echo 'Building Go cmd/dist using '$GOROOT_BOOTSTRAP'. ('$"GOROOT_BOOTSTRAP_VERSION')'
- if(~ $#vflag 1)
- 	echo cmd/dist
--GOROOT=$GOROOT_BOOTSTRAP GOOS='' GOARCH='' GOEXPERIMENT='' GO111MODULE=off GOENV=off GOFLAGS='' $GOROOT_BOOTSTRAP/bin/go build -o cmd/dist/dist ./cmd/dist
-+GOROOT=$GOROOT_BOOTSTRAP GOOS='' GOARCH='' GOEXPERIMENT='' GO111MODULE=off GOENV=off GOFLAGS='' $GOROOT_BOOTSTRAP/bin/go-$gcc_go_version build -o cmd/dist/dist ./cmd/dist
- 
- eval `{./cmd/dist/dist env -9}
- if(~ $#vflag 1)

go1.25.changes

@@ -1,3 +1,82 @@
+-------------------------------------------------------------------
+Mon Oct 13 21:14:41 UTC 2025 - Jeff Kowalczyk <jkowalczyk@suse.com>
+
+- go1.25.3 (released 2025-10-13) includes fixes to the crypto/x509
+  package.
+  Refs boo#1244485 go1.25 release tracking
+  * go#75861 crypto/x509: TLS validation fails for FQDNs with trailing dot
+  * go#75777 spec: Go1.25 spec should be dated closer to actual release date
+
+-------------------------------------------------------------------
+Tue Oct  7 18:16:13 UTC 2025 - Jeff Kowalczyk <jkowalczyk@suse.com>
+
+- go1.25.2 (released 2025-10-07) includes security fixes to the
+  archive/tar, crypto/tls, crypto/x509, encoding/asn1,
+  encoding/pem, net/http, net/mail, net/textproto, and net/url
+  packages, as well as bug fixes to the compiler, the runtime, and
+  the context, debug/pe, net/http, os, and sync/atomic packages.
+  Refs boo#1244485 go1.25 release tracking
+  CVE-2025-58189 CVE-2025-61725 CVE-2025-58188 CVE-2025-58185 CVE-2025-58186 CVE-2025-61723 CVE-2025-58183 CVE-2025-47912 CVE-2025-58187 CVE-2025-61724
+  * go#75661 go#75652 boo#1251255 security: fix CVE-2025-58189 crypto/tls: ALPN negotiation error contains attacker controlled information
+  * go#75701 go#75680 boo#1251253 security: fix CVE-2025-61725 net/mail: excessive CPU consumption in ParseAddress
+  * go#75703 go#75675 boo#1251260 security: fix CVE-2025-58188 crypto/x509: panic when validating certificates with DSA public keys
+  * go#75705 go#75671 boo#1251258 security: fix CVE-2025-58185 encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion
+  * go#75707 go#75672 boo#1251259 security: fix CVE-2025-58186 net/http: lack of limit when parsing cookies can cause memory exhaustion
+  * go#75709 go#75676 boo#1251256 security: fix CVE-2025-61723 encoding/pem: quadratic complexity when parsing some invalid inputs
+  * go#75711 go#75677 boo#1251261 security: fix CVE-2025-58183 archive/tar: unbounded allocation when parsing GNU sparse map
+  * go#75713 go#75678 boo#1251257 security: fix CVE-2025-47912 net/url: insufficient validation of bracketed IPv6 hostnames
+  * go#75715 go#75681 boo#1251254 security: fix CVE-2025-58187 crypto/x509: quadratic complexity when checking name constraints
+  * go#75718 go#75716 boo#1251262 security: fix CVE-2025-61724 net/textproto: excessive CPU consumption in Reader.ReadResponse
+  * go#75111 os, syscall: volume handles with FILE_FLAG_OVERLAPPED fail when calling ReadAt
+  * go#75116 os: Root.MkdirAll can return "file exists" when called concurrently on the same path
+  * go#75139 os: Root.OpenRoot sets incorrect name, losing prefix of original root
+  * go#75221 debug/pe: pe.Open fails on object files produced by llvm-mingw 21
+  * go#75255 cmd/compile: export to DWARF types only referenced through interfaces
+  * go#75347 testing/synctest: test timeout with no runnable goroutines
+  * go#75357 net: new test TestIPv4WriteMsgUDPAddrPortTargetAddrIPVersion fails on plan9
+  * go#75524 crypto/internal/fips140/rsa: requires a panic if self-tests fail
+  * go#75537 context: Err can return non-nil before Done channel is closed
+  * go#75539 net/http: internal error: connCount underflow
+  * go#75595 cmd/compile: internal compiler error with GOEXPERIMENT=cgocheck2 on github.com/leodido/go-urn
+  * go#75610 sync/atomic: comment for Uintptr.Or incorrectly describes return value
+  * go#75669 runtime: debug.decoratemappings don't work as expected
+
+-------------------------------------------------------------------
+Fri Sep 19 15:54:46 UTC 2025 - Aleksa Sarai <asarai@suse.com>
+
+- Package svgpan.js to fix issues with "go tool pprof". boo#1249985
+
+-------------------------------------------------------------------
+Wed Sep  3 17:46:11 UTC 2025 - Jeff Kowalczyk <jkowalczyk@suse.com>
+
+- go1.25.1 (released 2025-09-03) includes security fixes to the
+  net/http package, as well as bug fixes to the go command, and the
+  net, os, os/exec, and testing/synctest packages.
+  Refs boo#1244485 go1.25 release tracking
+  CVE-2025-47910
+  * go#75160 go#75054 boo#1249141 security: fix CVE-2025-47910 net/http: CrossOriginProtection insecure bypass patterns not limited to exact matches
+  * go#74822 cmd/go: "get toolchain@latest" should ignore release candidates
+  * go#74999 net: WriteMsgUDPAddrPort should accept IPv4-mapped IPv6 destination addresses on IPv4 UDP sockets
+  * go#75008 os/exec: TestLookPath fails on plan9 after CL 685755
+  * go#75021 testing/synctest: bubble not terminating
+  * go#75083 os: File.Seek doesn't set the correct offset with Windows overlapped handles
+
+-------------------------------------------------------------------
+Thu Aug 14 14:52:35 UTC 2025 - Jeff Kowalczyk <jkowalczyk@suse.com>
+
+- Packaging improvements:
+  * Remove conditional gccgo bootstrap sections and gcc-go.patch.
+    gccgo cannot be used in any version newer than go1.21. Removal
+    simplifies go1.x package code.
+  * go1.21 can optionally be bootstrapped with gccgo and serve as
+    the inital version of go1.x.
+  * go1.21 will be the initial version of Go in the bootstrap chain
+    until gcc gccgo is updated to support a language level newer
+    than go1.18.
+  * Drop gcc-go.patch
+  * Refs boo#1247816 bootstrap go1.21 with gccgo
+  * Refs boo#1248082 drop unused gccgo bootstrap code in go1.22+
+
 -------------------------------------------------------------------
 Tue Aug 12 20:50:10 UTC 2025 - Jeff Kowalczyk <jkowalczyk@suse.com>
 

go1.25.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package go1.25
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,34 +17,7 @@
 
 
 # Specify Go toolchain version used to bootstrap this package's Go toolchain
-# go_bootstrap_version bootstrap go toolchain with specific existing go1.x package
-# gcc_go_version       bootstrap go toolchain with specific version of gcc-go
-%if 0%{?suse_version} > 1500
-# openSUSE Tumbleweed
-# Usually ahead of bootstrap version specified by upstream Go
-# Use Tumbleweed default gccgo and N-1 go1.x for testing
-%define gcc_go_version 13
 %define go_bootstrap_version go1.22
-%else
-# Use gccgo and go1.x specified by upstream Go
-%define gcc_go_version 11
-%define go_bootstrap_version go1.22
-%endif
-
-# Bootstrap go toolchain using existing go package go_bootstrap_version
-# To bootstrap using gccgo use '--with gccgo'
-%bcond_with gccgo
-
-# gccgo on ppc64le with default PIE enabled fails with:
-# error while loading shared libraries:
-# R_PPC64_ADDR16_HA re10143fb0c for symbol `' out of range
-# track https://github.com/golang/go/issues/28531
-# linuxppc-dev discussion:
-# "PIE binaries are no longer mapped below 4 GiB on ppc64le"
-# https://lists.ozlabs.org/pipermail/linuxppc-dev/2018-November/180862.html
-%ifarch ppc64le
-#!BuildIgnore: gcc-PIE
-%endif
 
 # Build go-race only on platforms where C++14 is supported (SLE-15)
 %if 0%{?suse_version} >= 1500 || 0%{?sle_version} >= 150000
@@ -78,15 +51,11 @@
 
 # shared library support
 %if "%{rpm_vercmp %{go_api} 1.5}" > "0"
-%if %{with gccgo}
-%define with_shared 1
-%else
 %ifarch %ix86 %arm x86_64 aarch64
 %define with_shared 1
 %else
 %define with_shared 0
 %endif
-%endif
 %else
 %define with_shared 0
 %endif
@@ -122,7 +91,7 @@
 %endif
 
 Name:           go1.25
-Version:        1.25.0
+Version:        1.25.3
 Release:        0
 Summary:        A compiled, garbage-collected, concurrent programming language
 License:        BSD-3-Clause
@@ -138,17 +107,10 @@ Source6:        go.gdbinit
 Source100:      llvm-51bfeff0e4b0757ff773da6882f4d538996c9b04.tar.xz
 # PATCH-FIX-OPENSUSE: https://go-review.googlesource.com/c/go/+/391115
 Patch7:         dont-force-gold-on-arm64.patch
-# PATCH-FIX-UPSTREAM marguerite@opensuse.org - find /usr/bin/go-8 when bootstrapping with gcc8-go
-Patch8:         gcc-go.patch
 Patch9:         go-fixseccomp.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 # boostrap
-%if %{with gccgo}
-BuildRequires:  gcc%{gcc_go_version}-go
-%else
-# no gcc-go
 BuildRequires:  %{go_bootstrap_version}
-%endif
 BuildRequires:  fdupes
 Suggests:       %{name}-doc = %{version}
 %if 0%{?suse_version} > 1500
@@ -235,15 +197,6 @@ Go standard library compiled to a dynamically loadable shared object libstd.so
 %patch -P 9 -p1
 %endif
 
-%if %{with gccgo}
-# Currently gcc-go does not manage an update-alternatives entry and will
-# never be symlinked as "go", even if gcc-go is the only installed go toolchain.
-# Patch go bootstrap scripts to find hardcoded go-(gcc-go-version) e.g. go-8
-# Substitute defined gcc_go_version into gcc-go.patch
-sed -i "s/\$gcc_go_version/%{gcc_go_version}/" $RPM_SOURCE_DIR/gcc-go.patch
-%patch -P 8 -p1
-%endif
-
 cp %{SOURCE4} .
 
 %build
@@ -262,11 +215,7 @@ cp -v "$TSAN_DIR/race_linux_%{go_arch}.syso" src/runtime/race/
 %endif
 
 # Now, compile Go.
-%if %{with gccgo}
-export GOROOT_BOOTSTRAP=%{_prefix}
-%else
 export GOROOT_BOOTSTRAP=%{_libdir}/%{go_bootstrap_version}
-%endif
 # Ensure ARM arch is set properly - boo#1169832
 %ifarch armv6l armv6hl
 export GOARCH=arm
@@ -370,16 +319,22 @@ done
 find src -name "*.bash" -exec install -Dm655 \{\} %{buildroot}%{_datadir}/go/%{go_label}/\{\} \;
 # VERSION file referenced by go tool dist and go tool distpack
 find . -name VERSION -exec install -Dm655 \{\} %{buildroot}%{_datadir}/go/%{go_label}/\{\} \;
-# Trace viewer html and javascript files have moved in recent Go versions
-# Prior to go1.19   misc/trace
-# go1.19 to go1.21  src/cmd/trace/static
-# go1.22            src/internal/trace/traceviewer/static
-# Static contains pprof trace viewer html javascript and markdown
-install -d  %{buildroot}%{_datadir}/go/%{go_label}/src/internal/trace/traceviewer/static
-install -Dm644 src/internal/trace/traceviewer/static/* %{buildroot}%{_datadir}/go/%{go_label}/src/internal/trace/traceviewer/static
-# pprof viewer html templates are needed for import runtime/pprof
-install -d  %{buildroot}%{_datadir}/go/%{go_label}/src/cmd/vendor/github.com/google/pprof/internal/driver/html
-install -Dm644 src/cmd/vendor/github.com/google/pprof/internal/driver/html/* %{buildroot}%{_datadir}/go/%{go_label}/src/cmd/vendor/github.com/google/pprof/internal/driver/html
+
+extra_dirs=(
+	# Trace viewer html and javascript files have moved in recent Go versions
+	# Prior to go1.19   misc/trace
+	# go1.19 to go1.21  src/cmd/trace/static
+	# go1.22            src/internal/trace/traceviewer/static
+	# Static contains pprof trace viewer html javascript and markdown
+	src/internal/trace/traceviewer/static
+	# pprof viewer html templates are needed for import runtime/pprof
+	src/cmd/vendor/github.com/google/pprof/internal/driver/html
+	# pprof svgpan javascript is embedded with go:embed
+	src/cmd/vendor/github.com/google/pprof/third_party/svgpan
+)
+for dir in "${extra_dirs[@]}"; do
+	find "$dir" -exec install -Dm644 {} "%{buildroot}%{_datadir}/go/%{go_label}/{}" \;
+done
 
 mkdir -p $GOROOT/src
 for i in $(ls %{buildroot}/usr/share/go/%{go_label}/src);do