Mobil

.config/tsa/tsaoptions.json

@@ -8,7 +8,7 @@
   ],
   "instanceUrl": "https://devdiv.visualstudio.com/",
   "projectName": "DEVDIV",
-  "areaPath": "DevDiv\\NET Compilers\\GoLang",
+  "areaPath": "DevDiv\\GoLang",
   "iterationPath": "DevDiv",
   "allTools": true
 }

.github/CODEOWNERS

@@ -1,8 +1,9 @@
-# Require review from golang-compiler team for changes in any file. This keeps us in the loop on
-# auto-merge PRs. The review bot is also an owner so that it can still trigger auto-merge for sync
-# PRs on its own. We may remove this rule once auto-merges are routine.
-* @microsoft/golang-compiler @microsoft-golang-review-bot
+# Require review from golang-compiler team for changes in all files.
 
-# Automatically request review from golang-compiler team for changes in the Microsoft-specific
-# files. This takes precedence over earlier rules in the file.
-/eng/ @microsoft/golang-compiler
+* @microsoft/golang-compiler
+
+# Don't assign a code owner to automatically updated files to allow GitHub apps to use the
+# auto-merge flow without human intervention.
+/go
+/MICROSOFT_REVISION
+/VERSION

VERSION

@@ -0,0 +1 @@
+go1.23.12

eng/pipeline/pr-outerloop-pipeline.yml

@@ -24,6 +24,8 @@ resources:
       image: golangpublicimages.azurecr.io/go-infra-images/prereqs:cbl-mariner-1.0.20211027-20211201-0cccc22
     - container: mariner1arm64
       image: golangpublicimages.azurecr.io/go-infra-images/prereqs:cbl-mariner-arm64-1.0-20220314-a003148
+    - container: azurelinux3
+      image: mcr.microsoft.com/microsoft-go/infra-images:azurelinux-3.0-amd64-default-20241024144202-a3a1203
 
 stages:
   - template: stages/go-builder-matrix-stages.yml

eng/pipeline/pr-pipeline.yml

@@ -21,6 +21,8 @@ resources:
       image: golangpublicimages.azurecr.io/go-infra-images/prereqs:cbl-mariner-1.0.20211027-20211201-0cccc22
     - container: mariner1arm64
       image: golangpublicimages.azurecr.io/go-infra-images/prereqs:cbl-mariner-arm64-1.0-20220314-a003148
+    - container: azurelinux3
+      image: mcr.microsoft.com/microsoft-go/infra-images:azurelinux-3.0-amd64-default-20241024144202-a3a1203
 
 stages:
   - template: stages/go-builder-matrix-stages.yml

eng/pipeline/rolling-innerloop-pipeline.yml

@@ -30,6 +30,10 @@ resources:
 extends:
   template: v1/1ES.Unofficial.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
+    featureFlags:
+      # Network Isolation causes standard library DNS net tests on Windows to fail.
+      # See https://github.com/microsoft/go-lab/issues/206
+      disableNetworkIsolation: true
     sdl:
       sourceAnalysisPool:
         name: NetCore1ESPool-Internal
@@ -44,6 +48,8 @@ extends:
         image: golangpublicimages.azurecr.io/go-infra-images/prereqs:cbl-mariner-1.0.20211027-20211201-0cccc22
       mariner1arm64:
         image: golangpublicimages.azurecr.io/go-infra-images/prereqs:cbl-mariner-arm64-1.0-20220314-a003148
+      azurelinux3:
+        image: mcr.microsoft.com/microsoft-go/infra-images:azurelinux-3.0-amd64-default-20241024144202-a3a1203
 
     stages:
       - template: stages/go-builder-matrix-stages.yml

eng/pipeline/rolling-pipeline.yml

@@ -37,6 +37,8 @@ extends:
         image: golangpublicimages.azurecr.io/go-infra-images/prereqs:cbl-mariner-1.0.20211027-20211201-0cccc22
       mariner1arm64:
         image: golangpublicimages.azurecr.io/go-infra-images/prereqs:cbl-mariner-arm64-1.0-20220314-a003148
+      azurelinux3:
+        image: mcr.microsoft.com/microsoft-go/infra-images:azurelinux-3.0-amd64-default-20241024144202-a3a1203
 
     stages:
       - template: stages/go-builder-matrix-stages.yml

eng/pipeline/stages/builders-to-stages.yml

@@ -5,7 +5,7 @@
 # This template expands a list of builders into a list of jobs.
 
 parameters:
-  # [] of { id, os, arch, hostarch, config, distro?, experiment? }
+  # [] of { id, os, arch, hostarch, config, distro?, experiment?, broken? }
   builders: []
   # If true, include a signing stage+job that depends on all 'buildandpack' builder jobs finishing.
   sign: false

eng/pipeline/stages/go-builder-matrix-stages.yml

@@ -77,13 +77,16 @@ stages:
           - { os: linux, arch: amd64, config: devscript }
           - { os: linux, arch: amd64, config: test }
           - { os: linux, arch: amd64, config: test, distro: ubuntu }
+          - { os: linux, arch: amd64, config: test, distro: azurelinux3 }
           - { experiment: opensslcrypto, os: linux, arch: amd64, config: test }
           - { experiment: opensslcrypto, os: linux, arch: amd64, config: test, fips: true }
           - { experiment: opensslcrypto, os: linux, arch: amd64, config: test, distro: ubuntu }
+          - { experiment: opensslcrypto, os: linux, arch: amd64, config: test, distro: azurelinux3, broken: true }
           - { experiment: boringcrypto, os: linux, arch: amd64, config: test }
           - { experiment: boringcrypto, os: linux, arch: amd64, config: test, distro: ubuntu }
           - { os: windows, arch: amd64, config: devscript }
           - { os: windows, arch: amd64, config: test }
+          - { experiment: ms_tls_config_schannel, os: windows, arch: amd64, config: test }
           - { experiment: cngcrypto, os: windows, arch: amd64, config: test }
           - { experiment: cngcrypto, os: windows, arch: amd64, config: test, fips: true }
           # Test that buildandpack works on Windows x86-32, but don't release it.

eng/pipeline/stages/public-publish-stage.yml

@@ -48,7 +48,7 @@ stages:
           - name: GoBinariesDir
             value: $(Pipeline.Workspace)/Binaries Signed
           - name: NetCorePublishingScripts
-            value: $(Build.SourcesDirectory)/eng/release-studio/bin/Debug/net7.0/MsGoPublishingScripts
+            value: $(Build.SourcesDirectory)/eng/release-studio/bin/MsGoPublishingScripts
 
           # This is read directly by release studio scripts through env.
           - name: RMExecutionEnvironment
@@ -70,6 +70,7 @@ stages:
               projects: '$(Build.SourcesDirectory)/eng/release-studio/ReleaseStudio.csproj'
               custom: build
               arguments: >-
+                /p:NetCorePublishingScripts=$(NetCorePublishingScripts)
                 /bl:eng/release-studio/Build.binlog
                 /v:n
 

eng/pipeline/stages/run-stage.yml

@@ -5,7 +5,7 @@
 # This job runs a builder for any OS.
 
 parameters:
-  # { id, os, arch, hostArch, config, distro?, experiment?, fips? }
+  # { id, os, arch, hostArch, config, distro?, experiment?, fips?, broken? }
   - name: builder
     type: object
 
@@ -57,10 +57,12 @@ stages:
           # longtest has been seen to succeed after 53 minutes. Give around 3x headroom. In the future,
           # we should also give the tests a shorter timeout to make sure this doesn't balloon too far:
           # https://github.com/microsoft/go/issues/568
-          timeoutInMinutes: 180
-        ${{ if startsWith(parameters.builder.config, 'codeql') }}:
+          timeoutInMinutes: 240
+        ${{ elseif startsWith(parameters.builder.config, 'codeql') }}:
           # Allow CodeQL to take a while. https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/codeql/configuring-codeql3000-ado-pipelines#other-issues
-          timeoutInMinutes: 360
+          timeoutInMinutes: 420
+        ${{ else }}:
+          timeoutInMinutes: 120
 
         pool: ${{ parameters.pool }}
 
@@ -69,6 +71,8 @@ stages:
             ${{ if eq(parameters.builder.hostArch, 'amd64') }}:
               ${{ if eq(parameters.builder.distro, 'ubuntu') }}:
                 container: ubuntu2204
+              ${{ elseif eq(parameters.builder.distro, 'azurelinux3') }}:
+                container: azurelinux3
               ${{ else }}:
                 container: mariner1
             ${{ elseif eq(parameters.builder.hostArch, 'arm64') }}:
@@ -264,6 +268,9 @@ stages:
                 condition: and(ne(variables['TEST_BUILDER_SUCCESSFUL'], 'true'), succeeded())
                 ${{ if ne(attempt, 'FINAL') }}:
                   ignoreLASTEXITCODE: true
+                ${{ elseif eq(parameters.builder.broken, true) }}:
+                  # Don't fail the job if we are at the last retry and the builder is marked as broken.
+                  continueOnError: true
 
           # - ${{ if eq(parameters.builder.config, 'buildandpack' ) }}:
           #   - ${{ if ne(parameters.releaseVersion, 'nil') }}:

eng/pipeline/stages/shorthand-builders-to-builders.yml

@@ -11,13 +11,13 @@
 # to be used by template expressions, as of writing.
 
 parameters:
-  # [] of { os, arch, hostArch, config, distro?, experiment? }
+  # [] of { os, arch, hostArch, config, distro?, experiment?, broken? }
   # If hostArch is not defined, defaults to the arch value.
   # The job ID is generated based on these values.
   shorthandBuilders: []
   # The inner jobs template to pass the filed-out builders into.
   #
-  # It should accept parameter "builders", [] of { id, os, arch, hostArch, config, distro?, fips? }
+  # It should accept parameter "builders", [] of { id, os, arch, hostArch, config, distro?, fips?, broken? }
   jobsTemplate: ""
   jobsParameters: {}
 

eng/pipeline/stages/sign-stage.yml

@@ -6,7 +6,7 @@
 # publishes the signed files and signatures into a consolidated pipeline artifact.
 
 parameters:
-  # [] of { id, os, arch, config, distro?, experiment? }
+  # [] of { id, os, arch, config, distro?, experiment?, broken? }
   builders: []
 
 stages:

eng/release-studio/NuGet.config

@@ -6,6 +6,7 @@
 <configuration>
   <packageSources>
     <clear />
+    <!-- Only one feed is allowed. https://aka.ms/cfs/nuget -->
     <add key="MicroBuildToolset" value="https://pkgs.dev.azure.com/dnceng/_packaging/MicroBuildToolset/nuget/v3/index.json" />
   </packageSources>
   <disabledPackageSources>

eng/release-studio/ReleaseStudio.csproj

@@ -3,11 +3,38 @@
 
   <!-- Minimal info for '.csproj' to work. -->
   <PropertyGroup>
-    <TargetFramework>net7.0</TargetFramework>
+    <!--
+      We only have a single NuGet feed, and that feed doesn't have any targeting
+      packs (Microsoft.NETCore.App.Ref, Microsoft.WindowsDesktop.App.Ref, and
+      Microsoft.AspNetCore.App.Ref). To avoid downloading any targeting packs,
+      we need the Target Framework to match the .NET SDK exactly. The SDK may be
+      upgraded without our knowledge, so a hard-coded version is fragile. Use
+      BundledNETCoreAppTargetFrameworkVersion to be flexible.
+
+      We aren't actually building an app anyway, we just need the RM package.
+    -->
+    <TargetFramework>net$(BundledNETCoreAppTargetFrameworkVersion)</TargetFramework>
+
+    <!-- Default value for simple local repro. -->
+    <MsGoPublishingScripts>$(MSBuildThisFileDirectory)bin\MsGoPublishingScripts</MsGoPublishingScripts>
   </PropertyGroup>
 
   <ItemGroup>
     <PackageReference Include="DevDiv.RM.MS.Go.Publishing" Version="20240703.4.0" />
   </ItemGroup>
 
+  <!--
+    The scripts end up in a dir with Debug/Release and TargetFramework in the
+    path, which we don't want to rely on. So, copy them to a known place too.
+    Use the ScriptFilesToCopy items gathered by MsGoPublishingScriptsCopy.
+  -->
+  <Target
+    Name="CopyPublishingScriptsToStableLocation"
+    AfterTargets="MsGoPublishingScriptsCopy">
+
+    <Copy
+      SourceFiles="@(ScriptFilesToCopy)"
+      DestinationFolder="$([MSBuild]::NormalizeDirectory('$(MsGoPublishingScripts)', '%(RecursiveDir)'))" />
+  </Target>
+
 </Project>

eng/signing/NuGet.config

@@ -6,6 +6,7 @@
 <configuration>
   <packageSources>
     <clear />
+    <!-- Multiple feeds are allowed, but only because they are both in dnceng/public. -->
     <add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
     <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
   </packageSources>

patches/0002-Add-crypto-backend-foundation.patch

@@ -48,14 +48,15 @@ Subject: [PATCH] Add crypto backend foundation
  src/crypto/tls/cipher_suites.go              |   2 +-
  src/crypto/tls/handshake_client.go           |  25 ++-
  src/crypto/tls/handshake_server.go           |  25 ++-
+ src/crypto/tls/handshake_server_tls13.go     |  10 +
  src/crypto/tls/key_schedule.go               |  18 +-
  src/crypto/tls/prf.go                        |  77 +++++---
  src/crypto/tls/prf_test.go                   |  12 +-
  src/crypto/x509/boring_test.go               |   5 +
  src/go/build/deps_test.go                    |   4 +
  src/net/smtp/smtp_test.go                    |  72 ++++---
  src/runtime/runtime_boring.go                |   5 +
- 51 files changed, 764 insertions(+), 93 deletions(-)
+ 52 files changed, 774 insertions(+), 93 deletions(-)
  create mode 100644 src/crypto/ed25519/boring.go
  create mode 100644 src/crypto/ed25519/notboring.go
  create mode 100644 src/crypto/internal/backend/backend_test.go
@@ -1338,6 +1339,34 @@ index ac3d915d1746d7..631db82b9ab3ae 100644
  	if _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil {
  		return err
  	}
+diff --git a/src/crypto/tls/handshake_server_tls13.go b/src/crypto/tls/handshake_server_tls13.go
+index 503a732e05765e..53dfce967b3c2a 100644
+--- a/src/crypto/tls/handshake_server_tls13.go
++++ b/src/crypto/tls/handshake_server_tls13.go
+@@ -10,6 +10,7 @@ import (
+ 	"crypto"
+ 	"crypto/hmac"
+ 	"crypto/internal/mlkem768"
++	boring "crypto/internal/backend"
+ 	"crypto/rsa"
+ 	"errors"
+ 	"hash"
+@@ -435,6 +436,15 @@ func (hs *serverHandshakeStateTLS13) checkForResumption() error {
+ // interfaces implemented by standard library hashes to clone the state of in
+ // to a new instance of h. It returns nil if the operation fails.
+ func cloneHash(in hash.Hash, h crypto.Hash) hash.Hash {
++	if boring.Enabled {
++		// CNG and OpenSSL with SymCrypt hash functions do not implement the
++		// encoding.BinaryMarshaler interface, but they do implement the Clone method.
++		if cloner, ok := in.(interface{ Clone() (hash.Hash, error) }); ok {
++			if out, err := cloner.Clone(); err == nil {
++				return out
++			}
++		}
++	}
+ 	// Recreate the interface to avoid importing encoding.
+ 	type binaryMarshaler interface {
+ 		MarshalBinary() (data []byte, err error)
 diff --git a/src/crypto/tls/key_schedule.go b/src/crypto/tls/key_schedule.go
 index 1636baf79e7288..c9a5877d3d504f 100644
 --- a/src/crypto/tls/key_schedule.go

patches/0004-Add-OpenSSL-crypto-backend.patch

@@ -58,10 +58,10 @@ index f0e3575637c62a..0e9aceeb832d3b 100644
  package main
 
 diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
-index d7cbadf7b17aef..61685c5359bfde 100644
+index 0ffcabe4164af6..056f3ea5ae9beb 100644
 --- a/src/cmd/dist/test.go
 +++ b/src/cmd/dist/test.go
-@@ -1238,12 +1238,11 @@ func (t *tester) registerCgoTests(heading string) {
+@@ -1225,12 +1225,11 @@ func (t *tester) registerCgoTests(heading string) {
  			// a C linker warning on Linux.
  			// in function `bio_ip_and_port_to_socket_and_addr':
  			// warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
@@ -108,7 +108,7 @@ index 4aaf46b5d0f0dc..6fe798cf4a94e9 100644
 
  go list -f '{{.Dir}}' vendor/golang.org/x/net/http2/hpack
 diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
-index 755c889585e729..bcb591a380b74c 100644
+index d66027387b97f8..8e4dfab49f6b6b 100644
 --- a/src/cmd/link/internal/ld/lib.go
 +++ b/src/cmd/link/internal/ld/lib.go
 @@ -1162,6 +1162,7 @@ var hostobj []Hostobj
@@ -714,29 +714,29 @@ index c83a7272c9f01f..a0548a7f9179c5 100644
  package x509
 
 diff --git a/src/go.mod b/src/go.mod
-index b38dee7e6ddc28..097f35ca01aa5b 100644
+index 96513ccfc92eab..70a4909e7b7bc1 100644
 --- a/src/go.mod
 +++ b/src/go.mod
 @@ -3,6 +3,7 @@ module std
  go 1.23
 
  require (
-+	github.com/golang-fips/openssl/v2 v2.0.3
++	github.com/golang-fips/openssl/v2 v2.0.4-0.20241114123251-c5672cc7ce15
  	golang.org/x/crypto v0.23.1-0.20240603234054-0b431c7de36a
- 	golang.org/x/net v0.25.1-0.20240603202750-6249541f2a6c
+ 	golang.org/x/net v0.25.1-0.20250304182835-b70a9e3eaa27
  )
 diff --git a/src/go.sum b/src/go.sum
-index c5eab7d4b2f93b..fac8a0626146bc 100644
+index 7d2f0b01d502fb..b7b1b65177e1b4 100644
 --- a/src/go.sum
 +++ b/src/go.sum
 @@ -1,3 +1,5 @@
-+github.com/golang-fips/openssl/v2 v2.0.3 h1:9+J2R0BQio6Jz8+dPZf/0ylISByl0gZWjTEKm+J+y7Y=
-+github.com/golang-fips/openssl/v2 v2.0.3/go.mod h1:7tuBqX2Zov8Yq5mJ2yzlKhpnxOnWyEzi38AzeWRuQdg=
++github.com/golang-fips/openssl/v2 v2.0.4-0.20241114123251-c5672cc7ce15 h1:6Mb55x7RlLVNEPY6liVYeVTMR5FuZqHViyyrr7tih7A=
++github.com/golang-fips/openssl/v2 v2.0.4-0.20241114123251-c5672cc7ce15/go.mod h1:7tuBqX2Zov8Yq5mJ2yzlKhpnxOnWyEzi38AzeWRuQdg=
  golang.org/x/crypto v0.23.1-0.20240603234054-0b431c7de36a h1:37MIv+iGfwMYzWJECGyrPCtd5nuqcciRUeJfkNCkCf0=
  golang.org/x/crypto v0.23.1-0.20240603234054-0b431c7de36a/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
- golang.org/x/net v0.25.1-0.20240603202750-6249541f2a6c h1:CR/7/SLUhIJw6g675eeoDiwggElO2MV9rGkNYjqi8GM=
+ golang.org/x/net v0.25.1-0.20250304182835-b70a9e3eaa27 h1:BLroQt2NWk69+mgdbJFxbd1Y6nc8r9UCc/iPQ0FgpNs=
 diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
-index 68d3b0578d18b1..15f4bb124b8528 100644
+index 6eea04ef9269af..4bf45495afa19b 100644
 --- a/src/go/build/deps_test.go
 +++ b/src/go/build/deps_test.go
 @@ -459,6 +459,8 @@ var depsRules = `
@@ -756,7 +756,7 @@ index 68d3b0578d18b1..15f4bb124b8528 100644
  	< crypto/internal/boring/bbig
  	< crypto/internal/backend/bbig
  	< crypto/rand
-@@ -793,7 +796,7 @@ var buildIgnore = []byte("\n//go:build ignore")
+@@ -796,7 +799,7 @@ var buildIgnore = []byte("\n//go:build ignore")
 
  func findImports(pkg string) ([]string, error) {
  	vpkg := pkg
@@ -765,7 +765,7 @@ index 68d3b0578d18b1..15f4bb124b8528 100644
  		vpkg = "vendor/" + pkg
  	}
  	dir := filepath.Join(Default.GOROOT, "src", vpkg)
-@@ -803,7 +806,7 @@ func findImports(pkg string) ([]string, error) {
+@@ -806,7 +809,7 @@ func findImports(pkg string) ([]string, error) {
  	}
  	var imports []string
  	var haveImport = map[string]bool{}
@@ -829,7 +829,7 @@ index 777337d92d3c72..ef00871d619651 100644
  	// SystemCrypto enables the OpenSSL or CNG crypto experiment depending on
  	// which one is appropriate on the target GOOS.
 diff --git a/src/os/exec/exec_test.go b/src/os/exec/exec_test.go
-index dbe59fea119e70..c3df1f9ac49b82 100644
+index a0bb89e203ddf1..2b4a2680dcdd7e 100644
 --- a/src/os/exec/exec_test.go
 +++ b/src/os/exec/exec_test.go
 @@ -14,6 +14,7 @@ import (