[pkgsrc/trunk]: pkgsrc/lang Update go114 to 1.14.14.

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/c8bfe56240f6
branches:  trunk
changeset: 445410:c8bfe56240f6
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Fri Jan 22 20:08:32 2021 +0000

description:
Update go114 to 1.14.14.

* cmd/go: packages using cgo can cause arbitrary code execution at build time

The go command may execute arbitrary code at build time when cgo is in use on
Windows. This may occur when running “go get”, or any other command that builds
code. Only users who build untrusted code (and don’t execute it) are affected.

In addition to Windows users, this can also affect Unix users who have “.”
listed explicitly in their PATH and are running “go get” or build commands
outside of a module or with module mode disabled.

Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

This issue is CVE-2021-3115 and Go issue golang.org/issue/43783.

For more background on the cmd/go change and help deciding whether your own
programs might have similar issues, see our blog post at
https://blog.golang.org/path-security.

* crypto/elliptic: incorrect operations on the P-224 curve

The P224() Curve implementation can in rare circumstances generate incorrect
outputs, including returning invalid points from ScalarMult.

The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages
support P-224 ECDSA keys, but they are not supported by publicly trusted
certificate authorities. No other standard library or golang.org/x/crypto
package supports or uses the P-224 curve.

The incorrect output was found by the elliptic-curve-differential-fuzzer
project running on OSS-Fuzz and reported by Philippe Antoine (Catena cyber).

This issue is CVE-2021-3114 and Go issue golang.org/issue/43786.

diffstat:

 lang/go/version.mk  |   4 ++--
 lang/go114/PLIST    |   9 ++++++++-
 lang/go114/distinfo |  10 +++++-----
 3 files changed, 15 insertions(+), 8 deletions(-)

diffs (94 lines):

diff -r 9cd087f24520 -r c8bfe56240f6 lang/go/version.mk
--- a/lang/go/version.mk        Fri Jan 22 17:27:58 2021 +0000
+++ b/lang/go/version.mk        Fri Jan 22 20:08:32 2021 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.107 2020/12/19 18:03:52 bsiegert Exp $
+# $NetBSD: version.mk,v 1.108 2021/01/22 20:08:32 bsiegert Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -8,7 +8,7 @@
 
 GO116_VERSION= 1.16.beta1
 GO115_VERSION= 1.15.5
-GO114_VERSION= 1.14.12
+GO114_VERSION= 1.14.14
 GO113_VERSION= 1.13.15
 GO110_VERSION= 1.10.8
 GO19_VERSION=  1.9.7
diff -r 9cd087f24520 -r c8bfe56240f6 lang/go114/PLIST
--- a/lang/go114/PLIST  Fri Jan 22 17:27:58 2021 +0000
+++ b/lang/go114/PLIST  Fri Jan 22 20:08:32 2021 +0000
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.7 2020/11/13 18:27:35 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.8 2021/01/22 20:08:32 bsiegert Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go114/AUTHORS
@@ -791,6 +791,7 @@
 go114/pkg/${GO_PLATFORM}/internal/bytealg.a
 go114/pkg/${GO_PLATFORM}/internal/cfg.a
 go114/pkg/${GO_PLATFORM}/internal/cpu.a
+go114/pkg/${GO_PLATFORM}/internal/execabs.a
 go114/pkg/${GO_PLATFORM}/internal/fmtsort.a
 go114/pkg/${GO_PLATFORM}/internal/goroot.a
 go114/pkg/${GO_PLATFORM}/internal/goversion.a
@@ -1923,6 +1924,7 @@
 go114/src/cmd/go/testdata/script/cache_unix.txt
 go114/src/cmd/go/testdata/script/cache_vet.txt
 go114/src/cmd/go/testdata/script/cgo_asm_error.txt
+go114/src/cmd/go/testdata/script/cgo_path.txt
 go114/src/cmd/go/testdata/script/cgo_syso_issue29253.txt
 go114/src/cmd/go/testdata/script/clean_testcache.txt
 go114/src/cmd/go/testdata/script/cmd_import_error.txt
@@ -1968,6 +1970,7 @@
 go114/src/cmd/go/testdata/script/install_cross_gobin.txt
 go114/src/cmd/go/testdata/script/install_rebuild_gopath.txt
 go114/src/cmd/go/testdata/script/install_rebuild_removed.txt
+go114/src/cmd/go/testdata/script/ldflag.txt
 go114/src/cmd/go/testdata/script/link_syso_issue33139.txt
 go114/src/cmd/go/testdata/script/linkname.txt
 go114/src/cmd/go/testdata/script/list_ambiguous_path.txt
@@ -4527,6 +4530,8 @@
 go114/src/internal/cpu/cpu_x86.s
 go114/src/internal/cpu/cpu_x86_test.go
 go114/src/internal/cpu/export_test.go
+go114/src/internal/execabs/execabs.go
+go114/src/internal/execabs/execabs_test.go
 go114/src/internal/fmtsort/export_test.go
 go114/src/internal/fmtsort/sort.go
 go114/src/internal/fmtsort/sort_test.go
@@ -6312,6 +6317,7 @@
 go114/src/runtime/testdata/testprogcgo/lockosthread.c
 go114/src/runtime/testdata/testprogcgo/lockosthread.go
 go114/src/runtime/testdata/testprogcgo/main.go
+go114/src/runtime/testdata/testprogcgo/needmdeadlock.go
 go114/src/runtime/testdata/testprogcgo/numgoroutine.go
 go114/src/runtime/testdata/testprogcgo/pprof.go
 go114/src/runtime/testdata/testprogcgo/raceprof.go
@@ -8636,6 +8642,7 @@
 go114/test/fixedbugs/issue4252.dir/main.go
 go114/test/fixedbugs/issue4252.go
 go114/test/fixedbugs/issue4264.go
+go114/test/fixedbugs/issue42753.go
 go114/test/fixedbugs/issue4283.go
 go114/test/fixedbugs/issue4313.go
 go114/test/fixedbugs/issue4316.go
diff -r 9cd087f24520 -r c8bfe56240f6 lang/go114/distinfo
--- a/lang/go114/distinfo       Fri Jan 22 17:27:58 2021 +0000
+++ b/lang/go114/distinfo       Fri Jan 22 20:08:32 2021 +0000
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.13 2020/11/13 18:27:35 bsiegert Exp $
+$NetBSD: distinfo,v 1.14 2021/01/22 20:08:32 bsiegert Exp $
 
-SHA1 (go1.14.12.src.tar.gz) = b23a42c9085b5bcef74c23f4ffed41f16ee3a33c
-RMD160 (go1.14.12.src.tar.gz) = 161c44071a0cc8fa992dfcf7d1e42f74d241b3c0
-SHA512 (go1.14.12.src.tar.gz) = cba26b97878d5bd57d75bd1541932786779ddb7e9fa0bfb7bf003c7ae9e7bee8318c0d2108ce918453b863892b8f562e481bd0ed6cfc44e43d901522603adff2
-Size (go1.14.12.src.tar.gz) = 22553834 bytes
+SHA1 (go1.14.14.src.tar.gz) = 5bfb2ce853ede2d63ba75760cc2b455554599152
+RMD160 (go1.14.14.src.tar.gz) = 3394b7b351aeb074a1fd926a4003742857df965c
+SHA512 (go1.14.14.src.tar.gz) = 76213b19eeec66ca6c6b5bdef875bea0b64c3877c70eec64dd65f7869ceb8db016ff19193f01771f8944fd5f0ae3b54c68185e158f2622d1db5552fec1f37976
+Size (go1.14.14.src.tar.gz) = 22557733 bytes
 SHA1 (patch-misc_io_clangwrap.sh) = cd91c47ba0fe7b6eb8009dd261c0c26c7d581c29
 SHA1 (patch-src_cmd_dist_util.go) = 24e6f1b6ded842a8ce322a40e8766f7d344bc47e
 SHA1 (patch-src_cmd_link_internal_ld_elf.go) = 990a54e3baf239916e4c7f0c1d54240e2898601a