Skip to content

Commit 1a144bd

Browse files
coypoopcoypoop
committed
Pullup ticket #6983 - requested by bsiegert
lang/go123: Security fix lang/go124: Security fix Revisions pulled up: - lang/go/version.mk 1.233 - lang/go123/PLIST 1.11 - lang/go123/distinfo 1.13 - lang/go124/PLIST 1.6 - lang/go124/distinfo 1.6 --- Module Name: pkgsrc Committed By: bsiegert Date: Wed Jul 9 07:41:36 UTC 2025 Modified Files: pkgsrc/lang/go: version.mk pkgsrc/lang/go123: PLIST distinfo pkgsrc/lang/go124: PLIST distinfo Log Message: go: update to 1.23.11 and 1.24.5 These minor releases include 1 security fixes following the security policy= : cmd/go: unexpected command execution in untrusted VCS repositories Various uses of the Go toolchain in untrusted VCS repositories can resu= lt in unexpected code execution. When using the Go toolchain in directories fetched using various VCS tools (such as directly cloning Git or Mercurial repositories) can cause the toolchain to execute unexpected commands, if said directo= ry contains multiple VCS configuration metadata (such as a ".hg" directory in a Git repository). This is due to how the Go toolchain attempts to resolve which VCS is being used in order to embed build information in binaries and deter= mine module versions. The toolchain will now abort attempting to resolve which VCS is being used if it detects multiple VCS configuration metadata in a module directory or nested VCS configuration metadata (such as a ".git" directoy in a parent directory and a ".hg" directory in a child directory). This will not prevent the toolchain from building modules, but will result in binaries omitting VCS related buil= d information. If this behavior is expected by the user, the old behavior can be re-enabled by setting GODEBUG=3Dallowmultiplevcs=3D1. This should only be done in tru= sted repositories. Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting this issue. This is CVE-2025-4674 and https://go.dev/issue/74380.
1 parent 621ff62 commit 1a144bd

5 files changed

Lines changed: 27 additions & 13 deletions

File tree

‎lang/go/version.mk‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
# $NetBSD: version.mk,v 1.232 2025/06/06 13:45:14 bsiegert Exp $
1+
# $NetBSD: version.mk,v 1.232.2.1 2025/07/09 14:42:51 maya Exp $
22

33
#
44
# If bsd.prefs.mk is included before go-package.mk in a package, then this
55
# file must be included directly in the package prior to bsd.prefs.mk.
66
#
77
.include "go-vars.mk"
88

9-
GO124_VERSION= 1.24.4
10-
GO123_VERSION= 1.23.10
9+
GO124_VERSION= 1.24.5
10+
GO123_VERSION= 1.23.11
1111
GO122_VERSION= 1.22.12
1212
GO120_VERSION= 1.20.14
1313
GO118_VERSION= 1.18.10

‎lang/go123/PLIST‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
@comment $NetBSD: PLIST,v 1.10 2025/06/06 13:45:14 bsiegert Exp $
1+
@comment $NetBSD: PLIST,v 1.10.2.1 2025/07/09 14:42:51 maya Exp $
22
bin/go${GOVERSSUFFIX}
33
bin/gofmt${GOVERSSUFFIX}
44
go123/CONTRIBUTING.md
@@ -635,6 +635,10 @@ go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_global2_fail.go
635635
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_global3_fail.go
636636
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_global4_fail.go
637637
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_global5.go
638+
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_global_asm/asm.s
639+
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_global_asm/main.go
640+
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_global_asm2_fail/asm.s
641+
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_global_asm2_fail/main.go
638642
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_linkerx/main.go
639643
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_linkerx/p/p.go
640644
go123/src/cmd/cgo/internal/testsanitizers/testdata/asan_unsafe_fail1.go
@@ -2786,6 +2790,7 @@ go123/src/cmd/go/testdata/script/test_match_only_subtests.txt
27862790
go123/src/cmd/go/testdata/script/test_match_only_subtests_parallel.txt
27872791
go123/src/cmd/go/testdata/script/test_match_only_tests.txt
27882792
go123/src/cmd/go/testdata/script/test_minus_n.txt
2793+
go123/src/cmd/go/testdata/script/test_multivcs.txt
27892794
go123/src/cmd/go/testdata/script/test_n_cover_std.txt
27902795
go123/src/cmd/go/testdata/script/test_no_run_example.txt
27912796
go123/src/cmd/go/testdata/script/test_no_tests.txt
@@ -12354,6 +12359,8 @@ go123/test/fixedbugs/issue7310.go
1235412359
go123/test/fixedbugs/issue7316.go
1235512360
go123/test/fixedbugs/issue7346.go
1235612361
go123/test/fixedbugs/issue7366.go
12362+
go123/test/fixedbugs/issue73748a.go
12363+
go123/test/fixedbugs/issue73748b.go
1235712364
go123/test/fixedbugs/issue7405.go
1235812365
go123/test/fixedbugs/issue7419.go
1235912366
go123/test/fixedbugs/issue7525.go

‎lang/go123/distinfo‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
$NetBSD: distinfo,v 1.12 2025/06/06 13:45:14 bsiegert Exp $
1+
$NetBSD: distinfo,v 1.12.2.1 2025/07/09 14:42:51 maya Exp $
22

33
BLAKE2s (80344887818a2321296ce7fa71cca8ca2520611d.diff) = 80c77c55780bbd3b61f54698a5790169566a5c1c142ea9cf6b3de4ff261375f6
44
SHA512 (80344887818a2321296ce7fa71cca8ca2520611d.diff) = a72fe9c2bba6191df1fb796fe55cc0fea2eb1809f7a4f148230a8be798e3b6820405e48a92a57da59d8fbe23d7d624b49cef9761852a62b4e81ba9dcaa7deaa6
55
Size (80344887818a2321296ce7fa71cca8ca2520611d.diff) = 3273 bytes
6-
BLAKE2s (go1.23.10.src.tar.gz) = 15ae1f8f571ac69bfb71a67724772d1e0ab0a2e2efb66af17b067e5a22a91e30
7-
SHA512 (go1.23.10.src.tar.gz) = 20639185b05720aa8bb295c54e3eaa7cf56739763544d28ce14a6f0323bf890900d5fad13086032291fbefad4482f1442772875bbdf16a94e2286eb405c8f327
8-
Size (go1.23.10.src.tar.gz) = 28183775 bytes
6+
BLAKE2s (go1.23.11.src.tar.gz) = 1dcbc120e60fe40f920bb440fbcf914434b085115d0c716cc6b7303267d13a59
7+
SHA512 (go1.23.11.src.tar.gz) = 108b86d384de01617b7c58fba8a2c6446f6d1e8d07b720de2c49854e664c8c2660f6a3700827bf77cb7f018f78c7f3dc4f9c9f3a8fba8ca5e91cadde2df98a95
8+
Size (go1.23.11.src.tar.gz) = 28185977 bytes
99
SHA1 (patch-misc_ios_clangwrap.sh) = 28ea4426336155d6720f7e16b43f0207b47a6dd8
1010
SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
1111
SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35

‎lang/go124/PLIST‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
@comment $NetBSD: PLIST,v 1.5 2025/06/06 13:45:14 bsiegert Exp $
1+
@comment $NetBSD: PLIST,v 1.5.2.1 2025/07/09 14:42:51 maya Exp $
22
bin/go${GOVERSSUFFIX}
33
bin/gofmt${GOVERSSUFFIX}
44
go124/CONTRIBUTING.md
@@ -647,6 +647,10 @@ go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_global2_fail.go
647647
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_global3_fail.go
648648
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_global4_fail.go
649649
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_global5.go
650+
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_global_asm/asm.s
651+
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_global_asm/main.go
652+
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_global_asm2_fail/asm.s
653+
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_global_asm2_fail/main.go
650654
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_linkerx/main.go
651655
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_linkerx/p/p.go
652656
go124/src/cmd/cgo/internal/testsanitizers/testdata/asan_unsafe_fail1.go
@@ -2840,6 +2844,7 @@ go124/src/cmd/go/testdata/script/test_match_only_subtests.txt
28402844
go124/src/cmd/go/testdata/script/test_match_only_subtests_parallel.txt
28412845
go124/src/cmd/go/testdata/script/test_match_only_tests.txt
28422846
go124/src/cmd/go/testdata/script/test_minus_n.txt
2847+
go124/src/cmd/go/testdata/script/test_multivcs.txt
28432848
go124/src/cmd/go/testdata/script/test_n_cover_std.txt
28442849
go124/src/cmd/go/testdata/script/test_no_run_example.txt
28452850
go124/src/cmd/go/testdata/script/test_no_tests.txt
@@ -13242,6 +13247,8 @@ go124/test/fixedbugs/issue7310.go
1324213247
go124/test/fixedbugs/issue7316.go
1324313248
go124/test/fixedbugs/issue7346.go
1324413249
go124/test/fixedbugs/issue7366.go
13250+
go124/test/fixedbugs/issue73748a.go
13251+
go124/test/fixedbugs/issue73748b.go
1324513252
go124/test/fixedbugs/issue7405.go
1324613253
go124/test/fixedbugs/issue7419.go
1324713254
go124/test/fixedbugs/issue7525.go

‎lang/go124/distinfo‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
$NetBSD: distinfo,v 1.5 2025/06/06 13:45:14 bsiegert Exp $
1+
$NetBSD: distinfo,v 1.5.2.1 2025/07/09 14:42:51 maya Exp $
22

3-
BLAKE2s (go1.24.4.src.tar.gz) = 1338f7e0026c21a04feceefe7ccfbcb2c69102162cb26915852aa18b9a707470
4-
SHA512 (go1.24.4.src.tar.gz) = b785583fc53d62094b2de793a0e3281a26d2de17897a35b378fc2d13cb912ca473c37a7bae54a50660141809d5d0a70a97663d406cf30d7f0221ecbb5ffddec6
5-
Size (go1.24.4.src.tar.gz) = 30788576 bytes
3+
BLAKE2s (go1.24.5.src.tar.gz) = c6e8ca8692a0f6fdadfa9e1484a345017480d48aced9c40387cb344857aea29d
4+
SHA512 (go1.24.5.src.tar.gz) = 917cd6ac83e3370227da40f8490697e8638847e9279ed1806044a173d3b52829c67c429990db92d8aadcfba6a37bfc00114c1ecec3ac387a781bb7edc8dcab22
5+
Size (go1.24.5.src.tar.gz) = 30792943 bytes
66
SHA1 (patch-misc_ios_clangwrap.sh) = 28ea4426336155d6720f7e16b43f0207b47a6dd8
77
SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
88
SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35

0 commit comments

Comments
 (0)