Skip to content

Commit d27fb39

Browse files
[AUTO-CHERRYPICK] Upgrade default golang to 1.22.5 and backport the fix for 1.18 - branch main (#9968)
Co-authored-by: bhagyapathak <bhagyapathak@users.noreply.github.com>
1 parent 21b41f2 commit d27fb39

5 files changed

Lines changed: 244 additions & 36 deletions

File tree

SPECS/golang/CVE-2024-24790.patch

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
diff --git a/src/net/netip/inlining_test.go b/src/net/netip/inlining_test.go
2+
index 107fe1f083..1250c37725 100644
3+
--- a/src/net/netip/inlining_test.go
4+
+++ b/src/net/netip/inlining_test.go
5+
@@ -41,8 +41,6 @@ func TestInlining(t *testing.T) {
6+
"Addr.Is4",
7+
"Addr.Is4In6",
8+
"Addr.Is6",
9+
- "Addr.IsLoopback",
10+
- "Addr.IsMulticast",
11+
"Addr.IsInterfaceLocalMulticast",
12+
"Addr.IsValid",
13+
"Addr.IsUnspecified",
14+
diff --git a/src/net/netip/netip.go b/src/net/netip/netip.go
15+
index f27984ab57..310e4e5bf4 100644
16+
--- a/src/net/netip/netip.go
17+
+++ b/src/net/netip/netip.go
18+
@@ -75,6 +75,9 @@ var (
19+
// address ff02::1.
20+
func IPv6LinkLocalAllNodes() Addr { return AddrFrom16([16]byte{0: 0xff, 1: 0x02, 15: 0x01}) }
21+
22+
+// IPv6Loopback returns the IPv6 loopback address ::1.
23+
+func IPv6Loopback() Addr { return AddrFrom16([16]byte{15: 0x01}) }
24+
+
25+
// IPv6Unspecified returns the IPv6 unspecified address "::".
26+
func IPv6Unspecified() Addr { return Addr{z: z6noz} }
27+
28+
@@ -515,6 +518,9 @@ func (ip Addr) hasZone() bool {
29+
30+
// IsLinkLocalUnicast reports whether ip is a link-local unicast address.
31+
func (ip Addr) IsLinkLocalUnicast() bool {
32+
+ if ip.Is4In6() {
33+
+ ip = ip.Unmap()
34+
+ }
35+
// Dynamic Configuration of IPv4 Link-Local Addresses
36+
// https://datatracker.ietf.org/doc/html/rfc3927#section-2.1
37+
if ip.Is4() {
38+
@@ -530,6 +536,9 @@ func (ip Addr) IsLinkLocalUnicast() bool {
39+
40+
// IsLoopback reports whether ip is a loopback address.
41+
func (ip Addr) IsLoopback() bool {
42+
+ if ip.Is4In6() {
43+
+ ip = ip.Unmap()
44+
+ }
45+
// Requirements for Internet Hosts -- Communication Layers (3.2.1.3 Addressing)
46+
// https://datatracker.ietf.org/doc/html/rfc1122#section-3.2.1.3
47+
if ip.Is4() {
48+
@@ -545,6 +554,9 @@ func (ip Addr) IsLoopback() bool {
49+
50+
// IsMulticast reports whether ip is a multicast address.
51+
func (ip Addr) IsMulticast() bool {
52+
+ if ip.Is4In6() {
53+
+ ip = ip.Unmap()
54+
+ }
55+
// Host Extensions for IP Multicasting (4. HOST GROUP ADDRESSES)
56+
// https://datatracker.ietf.org/doc/html/rfc1112#section-4
57+
if ip.Is4() {
58+
@@ -563,7 +575,7 @@ func (ip Addr) IsMulticast() bool {
59+
func (ip Addr) IsInterfaceLocalMulticast() bool {
60+
// IPv6 Addressing Architecture (2.7.1. Pre-Defined Multicast Addresses)
61+
// https://datatracker.ietf.org/doc/html/rfc4291#section-2.7.1
62+
- if ip.Is6() {
63+
+ if ip.Is6() && !ip.Is4In6() {
64+
return ip.v6u16(0)&0xff0f == 0xff01
65+
}
66+
return false // zero value
67+
@@ -571,6 +583,9 @@ func (ip Addr) IsInterfaceLocalMulticast() bool {
68+
69+
// IsLinkLocalMulticast reports whether ip is a link-local multicast address.
70+
func (ip Addr) IsLinkLocalMulticast() bool {
71+
+ if ip.Is4In6() {
72+
+ ip = ip.Unmap()
73+
+ }
74+
// IPv4 Multicast Guidelines (4. Local Network Control Block (224.0.0/24))
75+
// https://datatracker.ietf.org/doc/html/rfc5771#section-4
76+
if ip.Is4() {
77+
@@ -599,6 +614,9 @@ func (ip Addr) IsGlobalUnicast() bool {
78+
return false
79+
}
80+
81+
+ if ip.Is4In6() {
82+
+ ip = ip.Unmap()
83+
+ }
84+
// Match package net's IsGlobalUnicast logic. Notably private IPv4 addresses
85+
// and ULA IPv6 addresses are still considered "global unicast".
86+
if ip.Is4() && (ip == IPv4Unspecified() || ip == AddrFrom4([4]byte{255, 255, 255, 255})) {
87+
@@ -616,6 +634,10 @@ func (ip Addr) IsGlobalUnicast() bool {
88+
// ip is in 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or fc00::/7. This is the
89+
// same as net.IP.IsPrivate.
90+
func (ip Addr) IsPrivate() bool {
91+
+ if ip.Is4In6() {
92+
+ ip = ip.Unmap()
93+
+ }
94+
+
95+
// Match the stdlib's IsPrivate logic.
96+
if ip.Is4() {
97+
// RFC 1918 allocates 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as
98+
diff --git a/src/net/netip/netip_test.go b/src/net/netip/netip_test.go
99+
index d988864827..c7e458af43 100644
100+
--- a/src/net/netip/netip_test.go
101+
+++ b/src/net/netip/netip_test.go
102+
@@ -554,10 +554,13 @@ func TestIPProperties(t *testing.T) {
103+
ilm6 = mustIP("ff01::1")
104+
ilmZone6 = mustIP("ff01::1%eth0")
105+
106+
- private4a = mustIP("10.0.0.1")
107+
- private4b = mustIP("172.16.0.1")
108+
- private4c = mustIP("192.168.1.1")
109+
- private6 = mustIP("fd00::1")
110+
+ private4a = mustIP("10.0.0.1")
111+
+ private4b = mustIP("172.16.0.1")
112+
+ private4c = mustIP("192.168.1.1")
113+
+ private6 = mustIP("fd00::1")
114+
+ private6mapped4a = mustIP("::ffff:10.0.0.1")
115+
+ private6mapped4b = mustIP("::ffff:172.16.0.1")
116+
+ private6mapped4c = mustIP("::ffff:192.168.1.1")
117+
118+
unspecified4 = AddrFrom4([4]byte{})
119+
unspecified6 = IPv6Unspecified()
120+
@@ -584,6 +587,11 @@ func TestIPProperties(t *testing.T) {
121+
ip: unicast4,
122+
globalUnicast: true,
123+
},
124+
+ {
125+
+ name: "unicast v6 mapped v4Addr",
126+
+ ip: AddrFrom16(unicast4.As16()),
127+
+ globalUnicast: true,
128+
+ },
129+
{
130+
name: "unicast v6Addr",
131+
ip: unicast6,
132+
@@ -605,6 +613,12 @@ func TestIPProperties(t *testing.T) {
133+
linkLocalMulticast: true,
134+
multicast: true,
135+
},
136+
+ {
137+
+ name: "multicast v6 mapped v4Addr",
138+
+ ip: AddrFrom16(multicast4.As16()),
139+
+ linkLocalMulticast: true,
140+
+ multicast: true,
141+
+ },
142+
{
143+
name: "multicast v6Addr",
144+
ip: multicast6,
145+
@@ -622,6 +636,11 @@ func TestIPProperties(t *testing.T) {
146+
ip: llu4,
147+
linkLocalUnicast: true,
148+
},
149+
+ {
150+
+ name: "link-local unicast v6 mapped v4Addr",
151+
+ ip: AddrFrom16(llu4.As16()),
152+
+ linkLocalUnicast: true,
153+
+ },
154+
{
155+
name: "link-local unicast v6Addr",
156+
ip: llu6,
157+
@@ -647,6 +666,11 @@ func TestIPProperties(t *testing.T) {
158+
ip: loopback6,
159+
loopback: true,
160+
},
161+
+ {
162+
+ name: "loopback v6 mapped v4Addr",
163+
+ ip: AddrFrom16(IPv6Loopback().As16()),
164+
+ loopback: true,
165+
+ },
166+
{
167+
name: "interface-local multicast v6Addr",
168+
ip: ilm6,
169+
@@ -683,6 +707,24 @@ func TestIPProperties(t *testing.T) {
170+
globalUnicast: true,
171+
private: true,
172+
},
173+
+ {
174+
+ name: "private v6 mapped v4Addr 10/8",
175+
+ ip: private6mapped4a,
176+
+ globalUnicast: true,
177+
+ private: true,
178+
+ },
179+
+ {
180+
+ name: "private v6 mapped v4Addr 172.16/12",
181+
+ ip: private6mapped4b,
182+
+ globalUnicast: true,
183+
+ private: true,
184+
+ },
185+
+ {
186+
+ name: "private v6 mapped v4Addr 192.168/16",
187+
+ ip: private6mapped4c,
188+
+ globalUnicast: true,
189+
+ private: true,
190+
+ },
191+
{
192+
name: "unspecified v4Addr",
193+
ip: unspecified4,

SPECS/golang/golang-1.18.spec

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
Summary: Go
1414
Name: golang
1515
Version: 1.18.8
16-
Release: 3%{?dist}
16+
Release: 4%{?dist}
1717
License: BSD-3-Clause
1818
Vendor: Microsoft Corporation
1919
Distribution: Mariner
@@ -24,10 +24,13 @@ Source1: https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz
2424
Patch0: go14_bootstrap_aarch64.patch
2525
# CVE-2022-41717 is fixed in 1.18.9
2626
Patch1: CVE-2022-41717.patch
27+
# CVE-2024-24790 is fixed in 1.18.8
28+
Patch2: CVE-2024-24790.patch
2729
Obsoletes: %{name} < %{version}
2830
Provides: %{name} = %{version}
2931
Provides: go = %{version}-%{release}
3032

33+
3134
%description
3235
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
3336

@@ -40,7 +43,7 @@ mv -v go go-bootstrap
4043

4144
%setup -q -n go
4245
patch -Np1 --ignore-whitespace < %{PATCH1}
43-
46+
patch -Np1 --ignore-whitespace < %{PATCH2}
4447
%build
4548
# Build go 1.4 bootstrap
4649
pushd %{_topdir}/BUILD/go-bootstrap/src
@@ -120,6 +123,9 @@ fi
120123
%{_bindir}/*
121124

122125
%changelog
126+
* Mon July 29 2024 Bhagyashri Pathak bhapathak@microsoft.com - 1.18.8.4
127+
- Patch CVE-2024-24790
128+
123129
* Mon Jan 23 2022 Nicolas Guibourge <nicolasg@microsoft.com> - 1.18.8-3
124130
- Create spec file for golang 1.18
125131

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
{
2-
"Signatures": {
3-
"go1.19.12.src.tar.gz": "ee5d50e0a7fd74ba1b137cb879609aaaef9880bf72b5d1742100e38ae72bb557",
4-
"go1.4-bootstrap-20171003.tar.gz": "f4ff5b5eb3a3cae1c993723f3eab519c5bae18866b5e5f96fe1102f0cb5c3e52",
5-
"go1.21.11.src.tar.gz": "42aee9bf2b6956c75a7ad6aa3f0a51b5821ffeac57f5a2e733a2d6eae1e6d9d2"
6-
}
7-
}
2+
"Signatures": {
3+
"go1.17.13.src.tar.gz": "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd",
4+
"go1.21.6.src.tar.gz": "124926a62e45f78daabbaedb9c011d97633186a33c238ffc1e25320c02046248",
5+
"go1.22.5.src.tar.gz": "ac9c723f224969aee624bc34fd34c9e13f2a212d75c71c807de644bb46e112f6",
6+
"go1.4-bootstrap-20171003.tar.gz": "f4ff5b5eb3a3cae1c993723f3eab519c5bae18866b5e5f96fe1102f0cb5c3e52"
7+
}
8+
}

SPECS/golang/golang.spec

Lines changed: 34 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
%global bootstrap_compiler_version 1.19.12
1+
%global bootstrap_compiler_version_0 1.17.13
2+
%global bootstrap_compiler_version_1 1.21.6
23
%global goroot %{_libdir}/golang
34
%global gopath %{_datadir}/gocode
45
%ifarch aarch64
@@ -13,7 +14,7 @@
1314
%define __find_requires %{nil}
1415
Summary: Go
1516
Name: golang
16-
Version: 1.21.11
17+
Version: 1.22.5
1718
Release: 1%{?dist}
1819
License: BSD-3-Clause
1920
Vendor: Microsoft Corporation
@@ -22,7 +23,8 @@ Group: System Environment/Security
2223
URL: https://golang.org
2324
Source0: https://golang.org/dl/go%{version}.src.tar.gz
2425
Source1: https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz
25-
Source2: https://dl.google.com/go/go%{bootstrap_compiler_version}.src.tar.gz
26+
Source2: https://dl.google.com/go/go%{bootstrap_compiler_version_0}.src.tar.gz
27+
Source3: https://dl.google.com/go/go%{bootstrap_compiler_version_1}.src.tar.gz
2628
Patch0: go14_bootstrap_aarch64.patch
2729
Obsoletes: %{name} < %{version}
2830
Provides: %{name} = %{version}
@@ -41,11 +43,13 @@ mv -v go go-bootstrap
4143
%setup -q -n go
4244

4345
%build
44-
# (go >= 1.20 bootstraps with go >= 1.17)
45-
# This condition makes go compiler >= 1.20 build a 3 step process:
46+
# Go 1.22 requires the final point release of Go 1.20 or later for bootstrap.
47+
# And Go 1.20 requires the Go 1.17.
48+
# This condition makes go compiler >= 1.22 build a 4 step process:
4649
# - Build the bootstrap compiler 1.4 (bootstrap bits in c)
47-
# - Use the 1.4 compiler to build %{bootstrap_compiler_version}
48-
# - Use the %{bootstrap_compiler_version} compiler to build go >= 1.20 compiler
50+
# - Use the 1.4 compiler to build %{bootstrap_compiler_version_0}
51+
# - Use the %{bootstrap_compiler_version_0} compiler to build %{bootstrap_compiler_version_1}
52+
# - Use %{bootstrap_compiler_version_1} to build %{version}
4953
# PS: Since go compiles fairly quickly, the extra overhead is arounnd 2-3 minutes
5054
# on a reasonable machine.
5155

@@ -56,21 +60,32 @@ popd
5660
mv -v %{_topdir}/BUILD/go-bootstrap %{_libdir}/golang
5761
export GOROOT=%{_libdir}/golang
5862

59-
# Use go1.4 bootstrap to compile go%{bootstrap_compiler_version} (bootstrap)
63+
# Use go1.4 bootstrap to compile go%{bootstrap_compiler_version_0}
6064
export GOROOT_BOOTSTRAP=%{_libdir}/golang
61-
mkdir -p %{_topdir}/BUILD/go%{bootstrap_compiler_version}
62-
tar xf %{SOURCE2} -C %{_topdir}/BUILD/go%{bootstrap_compiler_version} --strip-components=1
63-
pushd %{_topdir}/BUILD/go%{bootstrap_compiler_version}/src
65+
mkdir -p %{_topdir}/BUILD/go%{bootstrap_compiler_version_0}
66+
tar xf %{SOURCE2} -C %{_topdir}/BUILD/go%{bootstrap_compiler_version_0} --strip-components=1
67+
pushd %{_topdir}/BUILD/go%{bootstrap_compiler_version_0}/src
6468
CGO_ENABLED=0 ./make.bash
6569
popd
66-
67-
# Nuke the older go1.4 bootstrap
70+
# Nuke the older %{bootstrap_compiler_version_0}
6871
rm -rf %{_libdir}/golang
72+
mv -v %{_topdir}/BUILD/go%{bootstrap_compiler_version_0} %{_libdir}/golang
73+
export GOROOT=%{_libdir}/golang
6974

70-
# Make go%{bootstrap_compiler_version} as the new bootstrapper
71-
mv -v %{_topdir}/BUILD/go1.19.12 %{_libdir}/golang
7275

73-
# Build current go version
76+
# Use go%{bootstrap_compiler_version_0} bootstrap to compile go%{bootstrap_compiler_version_1} (bootstrap)
77+
export GOROOT_BOOTSTRAP=%{_libdir}/golang
78+
mkdir -p %{_topdir}/BUILD/go%{bootstrap_compiler_version_1}
79+
tar xf %{SOURCE3} -C %{_topdir}/BUILD/go%{bootstrap_compiler_version_1} --strip-components=1
80+
pushd %{_topdir}/BUILD/go%{bootstrap_compiler_version_1}/src
81+
CGO_ENABLED=0 ./make.bash
82+
popd
83+
# Nuke the older %{bootstrap_compiler_version_1}
84+
rm -rf %{_libdir}/golang
85+
mv -v %{_topdir}/BUILD/go%{bootstrap_compiler_version_1} %{_libdir}/golang
86+
export GOROOT=%{_libdir}/golang
87+
88+
# Use %{bootstrap_compiler_version_1} to compile %{version}
7489
export GOHOSTOS=linux
7590
export GOHOSTARCH=%{gohostarch}
7691
export GOROOT_BOOTSTRAP=%{goroot}
@@ -141,6 +156,9 @@ fi
141156
%{_bindir}/*
142157

143158
%changelog
159+
* Mon Jul 29 2024 Bhagyashri Pathak <bhapathak@microsoft.com> - 1.22.5
160+
- Bump version to 1.22.5
161+
144162
* Fri Jun 07 2024 Muhammad Falak <mwani@microsoft.com> - 1.21.11-1
145163
- Bump version to 1.21.11 to address CVE-2024-24790
146164

cgmanifest.json

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4620,18 +4620,8 @@
46204620
"type": "other",
46214621
"other": {
46224622
"name": "golang",
4623-
"version": "1.19.12",
4624-
"downloadUrl": "https://golang.org/dl/go1.19.12.src.tar.gz"
4625-
}
4626-
}
4627-
},
4628-
{
4629-
"component": {
4630-
"type": "other",
4631-
"other": {
4632-
"name": "golang",
4633-
"version": "1.21.11",
4634-
"downloadUrl": "https://golang.org/dl/go1.21.11.src.tar.gz"
4623+
"version": "1.22.5",
4624+
"downloadUrl": "https://golang.org/dl/go1.22.5.src.tar.gz"
46354625
}
46364626
}
46374627
},

0 commit comments

Comments
 (0)