kumquat-buildroot/package/go/go.mk

151 lines
4.2 KiB
Makefile
Raw Normal View History

################################################################################
#
# go
#
################################################################################
package/go: security bump to 1.15.5 Fixes the following security issues: - math/big: panic during recursive division of very large numbers A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures). Multiple math/big.Rat methods are similarly affected. crypto/rsa.VerifyPSS, crypto/rsa.VerifyPKCS1v15, and crypto/dsa.Verify may panic when provided crafted public keys and signatures. crypto/ecdsa and crypto/elliptic operations may only be affected if custom CurveParams with unusually large field sizes (several times larger than the largest supported curve, P-521) are in use. Using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don’t chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Moreover, an application might crash invoking crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate request or during a golang.org/x/crypto/otr conversation. Parsing a golang.org/x/crypto/openpgp Entity or verifying a signature may crash. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key. Thanks to the Go Ethereum team and the OSS-Fuzz project for reporting this. Thanks to Rémy Oudompheng and Robert Griesemer for their help developing and validating the fix. This issue is CVE-2020-28362 and Go issue golang.org/issue/42552. - cmd/go: arbitrary code execution at build time through cgo The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious gcc flags specified via a #cgo directive, or by a malicious symbol name in a linked object file. Thanks to Imre Rad and to Chris Brown and Tempus Ex respectively for reporting these issues. These issues are CVE-2020-28367 and CVE-2020-28366, and Go issues golang.org/issue/42556 and golang.org/issue/42559 respectively. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-13 11:31:11 +01:00
GO_VERSION = 1.15.5
GO_SITE = https://storage.googleapis.com/golang
GO_SOURCE = go$(GO_VERSION).src.tar.gz
GO_LICENSE = BSD-3-Clause
GO_LICENSE_FILES = LICENSE
package/go: fix building host go toolchain when target isn't supported The go toolchain can cross-compile by default. So most of the time, building a toolchain that supports a target, allows us to also build go binaries for the host. This is how support for host go packages was added: we use the same toolchain that was initially built only for target. But we might want to build a go binary for the host, when compiling a target for which go isn't supported. Then, building host-go will fail: by default, we build go for a specific target, and give the toolchain bootstrap scripts the cross compiler we'll use. This change modifies this behaviour: we only assume the go toolchain is cross-capable if we know the current target is supported. Otherwise this is a simple host go tool. We don't need to set any of the options needed for cross-compilation in that case. Thus, only set all the target-specific go options under a condition that the target arch is supported. The only option we still set is HOST_GO_CGO_ENABLED, and we always set it to enabled. It was also considered to create a separate package to build the go-for-host compiler which would be used for host-go-packages, but that would lead to a lot of duplication and is completely unnecessary. Fixes: http://autobuild.buildroot.net/results/98b9c7aaff2af4d19adfedac00b768d92530ce94 http://autobuild.buildroot.net/results/bed228995ce3778720f991df9b41345a7c724a46 http://autobuild.buildroot.net/results/3b3ea148165b96513ea511ee0d4adb334a6afac8 Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Reviewed-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-04-15 22:49:51 +02:00
HOST_GO_DEPENDENCIES = host-go-bootstrap
HOST_GO_GOPATH = $(HOST_DIR)/usr/share/go-path
package/go: fix building host go toolchain when target isn't supported The go toolchain can cross-compile by default. So most of the time, building a toolchain that supports a target, allows us to also build go binaries for the host. This is how support for host go packages was added: we use the same toolchain that was initially built only for target. But we might want to build a go binary for the host, when compiling a target for which go isn't supported. Then, building host-go will fail: by default, we build go for a specific target, and give the toolchain bootstrap scripts the cross compiler we'll use. This change modifies this behaviour: we only assume the go toolchain is cross-capable if we know the current target is supported. Otherwise this is a simple host go tool. We don't need to set any of the options needed for cross-compilation in that case. Thus, only set all the target-specific go options under a condition that the target arch is supported. The only option we still set is HOST_GO_CGO_ENABLED, and we always set it to enabled. It was also considered to create a separate package to build the go-for-host compiler which would be used for host-go-packages, but that would lead to a lot of duplication and is completely unnecessary. Fixes: http://autobuild.buildroot.net/results/98b9c7aaff2af4d19adfedac00b768d92530ce94 http://autobuild.buildroot.net/results/bed228995ce3778720f991df9b41345a7c724a46 http://autobuild.buildroot.net/results/3b3ea148165b96513ea511ee0d4adb334a6afac8 Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Reviewed-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-04-15 22:49:51 +02:00
HOST_GO_HOST_CACHE = $(HOST_DIR)/usr/share/host-go-cache
HOST_GO_ROOT = $(HOST_DIR)/lib/go
HOST_GO_TARGET_CACHE = $(HOST_DIR)/usr/share/go-cache
# We pass an empty GOBIN, otherwise "go install: cannot install
# cross-compiled binaries when GOBIN is set"
HOST_GO_COMMON_ENV = \
GO111MODULE=on \
GOFLAGS=-mod=vendor \
GOROOT="$(HOST_GO_ROOT)" \
GOPATH="$(HOST_GO_GOPATH)" \
GOPROXY=off \
PATH=$(BR_PATH) \
GOBIN= \
CGO_ENABLED=$(HOST_GO_CGO_ENABLED)
package/go: fix building host go toolchain when target isn't supported The go toolchain can cross-compile by default. So most of the time, building a toolchain that supports a target, allows us to also build go binaries for the host. This is how support for host go packages was added: we use the same toolchain that was initially built only for target. But we might want to build a go binary for the host, when compiling a target for which go isn't supported. Then, building host-go will fail: by default, we build go for a specific target, and give the toolchain bootstrap scripts the cross compiler we'll use. This change modifies this behaviour: we only assume the go toolchain is cross-capable if we know the current target is supported. Otherwise this is a simple host go tool. We don't need to set any of the options needed for cross-compilation in that case. Thus, only set all the target-specific go options under a condition that the target arch is supported. The only option we still set is HOST_GO_CGO_ENABLED, and we always set it to enabled. It was also considered to create a separate package to build the go-for-host compiler which would be used for host-go-packages, but that would lead to a lot of duplication and is completely unnecessary. Fixes: http://autobuild.buildroot.net/results/98b9c7aaff2af4d19adfedac00b768d92530ce94 http://autobuild.buildroot.net/results/bed228995ce3778720f991df9b41345a7c724a46 http://autobuild.buildroot.net/results/3b3ea148165b96513ea511ee0d4adb334a6afac8 Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Reviewed-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-04-15 22:49:51 +02:00
ifeq ($(BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS),y)
ifeq ($(BR2_arm),y)
GO_GOARCH = arm
ifeq ($(BR2_ARM_CPU_ARMV5),y)
GO_GOARM = 5
else ifeq ($(BR2_ARM_CPU_ARMV6),y)
GO_GOARM = 6
else ifeq ($(BR2_ARM_CPU_ARMV7A),y)
GO_GOARM = 7
endif
else ifeq ($(BR2_aarch64),y)
GO_GOARCH = arm64
else ifeq ($(BR2_i386),y)
GO_GOARCH = 386
else ifeq ($(BR2_x86_64),y)
GO_GOARCH = amd64
else ifeq ($(BR2_powerpc64),y)
GO_GOARCH = ppc64
else ifeq ($(BR2_powerpc64le),y)
GO_GOARCH = ppc64le
else ifeq ($(BR2_mips64),y)
GO_GOARCH = mips64
else ifeq ($(BR2_mips64el),y)
GO_GOARCH = mips64le
else ifeq ($(BR2_s390x),y)
GO_GOARCH = s390x
endif
# For the convienience of target packages.
HOST_GO_TOOLDIR = $(HOST_GO_ROOT)/pkg/tool/linux_$(GO_GOARCH)
HOST_GO_TARGET_ENV = \
$(HOST_GO_COMMON_ENV) \
GOARCH=$(GO_GOARCH) \
GOCACHE="$(HOST_GO_TARGET_CACHE)" \
CC="$(TARGET_CC)" \
CXX="$(TARGET_CXX)" \
CGO_CFLAGS="$(TARGET_CFLAGS)" \
CGO_CXXFLAGS="$(TARGET_CXXFLAGS)" \
CGO_LDFLAGS="$(TARGET_LDFLAGS)" \
GOTOOLDIR="$(HOST_GO_TOOLDIR)"
# The go compiler's cgo support uses threads. If BR2_TOOLCHAIN_HAS_THREADS is
# set, build in cgo support for any go programs that may need it. Note that
# any target package needing cgo support must include
# 'depends on BR2_TOOLCHAIN_HAS_THREADS' in its config file.
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
HOST_GO_CGO_ENABLED = 1
else
HOST_GO_CGO_ENABLED = 0
endif
package/go: fix building host go toolchain when target isn't supported The go toolchain can cross-compile by default. So most of the time, building a toolchain that supports a target, allows us to also build go binaries for the host. This is how support for host go packages was added: we use the same toolchain that was initially built only for target. But we might want to build a go binary for the host, when compiling a target for which go isn't supported. Then, building host-go will fail: by default, we build go for a specific target, and give the toolchain bootstrap scripts the cross compiler we'll use. This change modifies this behaviour: we only assume the go toolchain is cross-capable if we know the current target is supported. Otherwise this is a simple host go tool. We don't need to set any of the options needed for cross-compilation in that case. Thus, only set all the target-specific go options under a condition that the target arch is supported. The only option we still set is HOST_GO_CGO_ENABLED, and we always set it to enabled. It was also considered to create a separate package to build the go-for-host compiler which would be used for host-go-packages, but that would lead to a lot of duplication and is completely unnecessary. Fixes: http://autobuild.buildroot.net/results/98b9c7aaff2af4d19adfedac00b768d92530ce94 http://autobuild.buildroot.net/results/bed228995ce3778720f991df9b41345a7c724a46 http://autobuild.buildroot.net/results/3b3ea148165b96513ea511ee0d4adb334a6afac8 Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Reviewed-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-04-15 22:49:51 +02:00
HOST_GO_CROSS_ENV = \
CC_FOR_TARGET="$(TARGET_CC)" \
CXX_FOR_TARGET="$(TARGET_CXX)" \
GOARCH=$(GO_GOARCH) \
$(if $(GO_GOARM),GOARM=$(GO_GOARM)) \
GO_ASSUME_CROSSCOMPILING=1
else # !BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
# host-go can still be used to build packages for the host. No need to set all
# the arch stuff since we will not be cross-compiling.
HOST_GO_CGO_ENABLED = 1
endif # BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
# For the convenience of host golang packages
HOST_GO_HOST_ENV = \
$(HOST_GO_COMMON_ENV) \
GOARCH="" \
GOCACHE="$(HOST_GO_HOST_CACHE)" \
CC="$(HOST_CCNOCCACHE)" \
CXX="$(HOST_CXXNOCCACHE)" \
CGO_CFLAGS="$(HOST_CFLAGS)" \
CGO_CXXFLAGS="$(HOST_CXXFLAGS)" \
CGO_LDFLAGS="$(HOST_LDFLAGS)"
# The go build system is not compatible with ccache, so use
# HOSTCC_NOCCACHE. See https://github.com/golang/go/issues/11685.
HOST_GO_MAKE_ENV = \
GO111MODULE=off \
GOCACHE=$(HOST_GO_HOST_CACHE) \
GOROOT_BOOTSTRAP=$(HOST_GO_BOOTSTRAP_ROOT) \
GOROOT_FINAL=$(HOST_GO_ROOT) \
GOROOT="$(@D)" \
GOBIN="$(@D)/bin" \
GOOS=linux \
CC=$(HOSTCC_NOCCACHE) \
CXX=$(HOSTCXX_NOCCACHE) \
package/go: fix building host go toolchain when target isn't supported The go toolchain can cross-compile by default. So most of the time, building a toolchain that supports a target, allows us to also build go binaries for the host. This is how support for host go packages was added: we use the same toolchain that was initially built only for target. But we might want to build a go binary for the host, when compiling a target for which go isn't supported. Then, building host-go will fail: by default, we build go for a specific target, and give the toolchain bootstrap scripts the cross compiler we'll use. This change modifies this behaviour: we only assume the go toolchain is cross-capable if we know the current target is supported. Otherwise this is a simple host go tool. We don't need to set any of the options needed for cross-compilation in that case. Thus, only set all the target-specific go options under a condition that the target arch is supported. The only option we still set is HOST_GO_CGO_ENABLED, and we always set it to enabled. It was also considered to create a separate package to build the go-for-host compiler which would be used for host-go-packages, but that would lead to a lot of duplication and is completely unnecessary. Fixes: http://autobuild.buildroot.net/results/98b9c7aaff2af4d19adfedac00b768d92530ce94 http://autobuild.buildroot.net/results/bed228995ce3778720f991df9b41345a7c724a46 http://autobuild.buildroot.net/results/3b3ea148165b96513ea511ee0d4adb334a6afac8 Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Reviewed-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-04-15 22:49:51 +02:00
CGO_ENABLED=$(HOST_GO_CGO_ENABLED) \
$(HOST_GO_CROSS_ENV)
define HOST_GO_BUILD_CMDS
cd $(@D)/src && \
package/go: fix building host go toolchain when target isn't supported The go toolchain can cross-compile by default. So most of the time, building a toolchain that supports a target, allows us to also build go binaries for the host. This is how support for host go packages was added: we use the same toolchain that was initially built only for target. But we might want to build a go binary for the host, when compiling a target for which go isn't supported. Then, building host-go will fail: by default, we build go for a specific target, and give the toolchain bootstrap scripts the cross compiler we'll use. This change modifies this behaviour: we only assume the go toolchain is cross-capable if we know the current target is supported. Otherwise this is a simple host go tool. We don't need to set any of the options needed for cross-compilation in that case. Thus, only set all the target-specific go options under a condition that the target arch is supported. The only option we still set is HOST_GO_CGO_ENABLED, and we always set it to enabled. It was also considered to create a separate package to build the go-for-host compiler which would be used for host-go-packages, but that would lead to a lot of duplication and is completely unnecessary. Fixes: http://autobuild.buildroot.net/results/98b9c7aaff2af4d19adfedac00b768d92530ce94 http://autobuild.buildroot.net/results/bed228995ce3778720f991df9b41345a7c724a46 http://autobuild.buildroot.net/results/3b3ea148165b96513ea511ee0d4adb334a6afac8 Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Reviewed-by: Anisse Astier <anisse@astier.eu> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-04-15 22:49:51 +02:00
$(HOST_GO_MAKE_ENV) ./make.bash $(if $(VERBOSE),-v)
endef
define HOST_GO_INSTALL_CMDS
$(INSTALL) -D -m 0755 $(@D)/bin/go $(HOST_GO_ROOT)/bin/go
$(INSTALL) -D -m 0755 $(@D)/bin/gofmt $(HOST_GO_ROOT)/bin/gofmt
ln -sf ../lib/go/bin/go $(HOST_DIR)/bin/
ln -sf ../lib/go/bin/gofmt $(HOST_DIR)/bin/
cp -a $(@D)/lib $(HOST_GO_ROOT)/
mkdir -p $(HOST_GO_ROOT)/pkg
cp -a $(@D)/pkg/include $(@D)/pkg/linux_* $(HOST_GO_ROOT)/pkg/
cp -a $(@D)/pkg/tool $(HOST_GO_ROOT)/pkg/
# There is a known issue which requires the go sources to be installed
# https://golang.org/issue/2775
cp -a $(@D)/src $(HOST_GO_ROOT)/
# Set all file timestamps to prevent the go compiler from rebuilding any
# built in packages when programs are built.
find $(HOST_GO_ROOT) -type f -exec touch -r $(@D)/bin/go {} \;
endef
$(eval $(host-generic-package))