CVS commit: pkgsrc/lang

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Thu Jun 13 12:55:15 UTC 2024

Modified Files:
        pkgsrc/lang/go: version.mk
        pkgsrc/lang/go122: PLIST distinfo
        pkgsrc/lang/go122/patches: patch-src_syscall_zerrors__solaris__amd64.go

Log Message:
go122: update to 1.22.4 (security)

This minor release includes 2 security fixes following the security policy:

- archive/zip: mishandling of corrupt central directory record

  The archive/zip package's handling of certain types of invalid zip files
  differed from the behavior of most zip implementations. This misalignment
  could be exploited to create an zip file with contents that vary depending on
  the implementation reading the file. The archive/zip package now rejects
  files containing these errors.

  Thanks to Yufan You (@ouuan) for reporting this issue.

  This is CVE-2024-24789 and Go issue https://go.dev/issue/66869.

- net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected
  for IPv4-mapped IPv6 addresses, returning false for addresses which would
  return true in their traditional IPv4 forms.

  Thanks to Enze Wang of Alioth (@zer0yu) and Jianjun Chen of Zhongguancun Lab
  (@chenjj) for reporting this issue.

  This is CVE-2024-24790 and Go issue https://go.dev/issue/67680.


To generate a diff of this commit:
cvs rdiff -u -r1.209 -r1.210 pkgsrc/lang/go/version.mk
cvs rdiff -u -r1.4 -r1.5 pkgsrc/lang/go122/PLIST
cvs rdiff -u -r1.6 -r1.7 pkgsrc/lang/go122/distinfo
cvs rdiff -u -r1.1 -r1.2 \
    pkgsrc/lang/go122/patches/patch-src_syscall_zerrors__solaris__amd64.go

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/go/version.mk
diff -u pkgsrc/lang/go/version.mk:1.209 pkgsrc/lang/go/version.mk:1.210
--- pkgsrc/lang/go/version.mk:1.209     Thu Jun 13 12:49:39 2024
+++ pkgsrc/lang/go/version.mk   Thu Jun 13 12:55:15 2024
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.209 2024/06/13 12:49:39 bsiegert Exp $
+# $NetBSD: version.mk,v 1.210 2024/06/13 12:55:15 bsiegert Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -6,7 +6,7 @@
 #
 .include "go-vars.mk"
 
-GO122_VERSION= 1.22.3
+GO122_VERSION= 1.22.4
 GO121_VERSION= 1.21.11
 GO120_VERSION= 1.20.14
 GO119_VERSION= 1.19.13

Index: pkgsrc/lang/go122/PLIST
diff -u pkgsrc/lang/go122/PLIST:1.4 pkgsrc/lang/go122/PLIST:1.5
--- pkgsrc/lang/go122/PLIST:1.4 Tue May  7 18:18:05 2024
+++ pkgsrc/lang/go122/PLIST     Thu Jun 13 12:55:15 2024
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.4 2024/05/07 18:18:05 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.5 2024/06/13 12:55:15 bsiegert Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go122/CONTRIBUTING.md
@@ -164,6 +164,7 @@ go122/src/archive/zip/reader.go
 go122/src/archive/zip/reader_test.go
 go122/src/archive/zip/register.go
 go122/src/archive/zip/struct.go
+go122/src/archive/zip/testdata/comment-truncated.zip
 go122/src/archive/zip/testdata/crc32-not-streamed.zip
 go122/src/archive/zip/testdata/dd.zip
 go122/src/archive/zip/testdata/dupdir.zip
@@ -1904,7 +1905,7 @@ go122/src/cmd/go/testdata/mod/golang.org
 go122/src/cmd/go/testdata/mod/golang.org_toolchain_v0.0.1-go1.18.linux-amd64.txt
 go122/src/cmd/go/testdata/mod/golang.org_toolchain_v0.0.1-go1.22.0.linux-amd64.txt
 go122/src/cmd/go/testdata/mod/golang.org_toolchain_v0.0.1-go1.22.1.linux-amd64.txt
-go122/src/cmd/go/testdata/mod/golang.org_toolchain_v0.0.1-go${PKGVERSION}.linux-amd64.txt
+go122/src/cmd/go/testdata/mod/golang.org_toolchain_v0.0.1-go1.22.3.linux-amd64.txt
 go122/src/cmd/go/testdata/mod/golang.org_toolchain_v0.0.1-go1.22.5.linux-amd64.txt
 go122/src/cmd/go/testdata/mod/golang.org_toolchain_v0.0.1-go1.22.7.linux-amd64.txt
 go122/src/cmd/go/testdata/mod/golang.org_toolchain_v0.0.1-go1.22.9.linux-amd64.txt
@@ -2202,6 +2203,7 @@ go122/src/cmd/go/testdata/script/gopath_
 go122/src/cmd/go/testdata/script/gopath_vendor_dup_err.txt
 go122/src/cmd/go/testdata/script/goroot_executable.txt
 go122/src/cmd/go/testdata/script/goroot_executable_trimpath.txt
+go122/src/cmd/go/testdata/script/gotoolchain_issue66175.txt
 go122/src/cmd/go/testdata/script/gotoolchain_local.txt
 go122/src/cmd/go/testdata/script/gotoolchain_loop.txt
 go122/src/cmd/go/testdata/script/gotoolchain_modcmds.txt
@@ -4636,7 +4638,6 @@ go122/src/crypto/x509/root.go
 go122/src/crypto/x509/root_aix.go
 go122/src/crypto/x509/root_bsd.go
 go122/src/crypto/x509/root_darwin.go
-go122/src/crypto/x509/root_darwin_test.go
 go122/src/crypto/x509/root_linux.go
 go122/src/crypto/x509/root_plan9.go
 go122/src/crypto/x509/root_solaris.go
@@ -4645,7 +4646,6 @@ go122/src/crypto/x509/root_unix.go
 go122/src/crypto/x509/root_unix_test.go
 go122/src/crypto/x509/root_wasm.go
 go122/src/crypto/x509/root_windows.go
-go122/src/crypto/x509/root_windows_test.go
 go122/src/crypto/x509/sec1.go
 go122/src/crypto/x509/sec1_test.go
 go122/src/crypto/x509/test-file.crt
@@ -11938,6 +11938,9 @@ go122/test/fixedbugs/issue6703w.go
 go122/test/fixedbugs/issue6703x.go
 go122/test/fixedbugs/issue6703y.go
 go122/test/fixedbugs/issue6703z.go
+go122/test/fixedbugs/issue67141.go
+go122/test/fixedbugs/issue67160.go
+go122/test/fixedbugs/issue67255.go
 go122/test/fixedbugs/issue6750.go
 go122/test/fixedbugs/issue6772.go
 go122/test/fixedbugs/issue6789.dir/a.go

Index: pkgsrc/lang/go122/distinfo
diff -u pkgsrc/lang/go122/distinfo:1.6 pkgsrc/lang/go122/distinfo:1.7
--- pkgsrc/lang/go122/distinfo:1.6      Tue May  7 18:18:05 2024
+++ pkgsrc/lang/go122/distinfo  Thu Jun 13 12:55:15 2024
@@ -1,12 +1,12 @@
-$NetBSD: distinfo,v 1.6 2024/05/07 18:18:05 bsiegert Exp $
+$NetBSD: distinfo,v 1.7 2024/06/13 12:55:15 bsiegert Exp $
 
-BLAKE2s (go1.22.3.src.tar.gz) = fc915cdf74ff63831716b752f88dde2bf42d82117761303bb063cc0226977a67
-SHA512 (go1.22.3.src.tar.gz) = e6756866d3cf195f1afd3d852015f32dfb2de3648e30a78e9238a863eae192e9e7ccbcfd19fd97b1d552f35d51d62bf2104d81e35b8854a40400b0d61cf93672
-Size (go1.22.3.src.tar.gz) = 27552410 bytes
+BLAKE2s (go1.22.4.src.tar.gz) = 0634d5823abbb1ba4dd5f320f55f33156ca8f8a0482fbdfb5804b28f9aceb38b
+SHA512 (go1.22.4.src.tar.gz) = 4855ba7e277b2eb79eb52e3ad2a52f18b3a4cd3adc20b7a17d29fabae74141265bf31399307b8d3f35110031d11ad7f583016aa903f3e36eeb6d1f64cfc8a5ad
+Size (go1.22.4.src.tar.gz) = 27555503 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 0a06403609cb7bce2e6f65444fd322f486761afe
 SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35
 SHA1 (patch-src_crypto_x509_root__solaris.go) = d636a1599ede225ac339388fba2b6e253112d461
 SHA1 (patch-src_syscall_syscall__solaris.go) = a23052ad13e128578c1c0cf46812f26d2d8ccdd1
-SHA1 (patch-src_syscall_zerrors__solaris__amd64.go) = f2a10b7436e1abedfe9491f8bde4c0bf3b2a893f
+SHA1 (patch-src_syscall_zerrors__solaris__amd64.go) = 9500319cf717106e1b4bb2ba28861358dffc781e
 SHA1 (patch-src_syscall_zsysnum__solaris__amd64.go) = ec28a0fa37ba9599ec1651c8e9337a2efc48a26b

Index: pkgsrc/lang/go122/patches/patch-src_syscall_zerrors__solaris__amd64.go
diff -u pkgsrc/lang/go122/patches/patch-src_syscall_zerrors__solaris__amd64.go:1.1 pkgsrc/lang/go122/patches/patch-src_syscall_zerrors__solaris__amd64.go:1.2
--- pkgsrc/lang/go122/patches/patch-src_syscall_zerrors__solaris__amd64.go:1.1  Tue Apr  9 16:57:46 2024
+++ pkgsrc/lang/go122/patches/patch-src_syscall_zerrors__solaris__amd64.go      Thu Jun 13 12:55:15 2024
@@ -1,14 +1,14 @@
-$NetBSD: patch-src_syscall_zerrors__solaris__amd64.go,v 1.1 2024/04/09 16:57:46 jperkin Exp $
+$NetBSD: patch-src_syscall_zerrors__solaris__amd64.go,v 1.2 2024/06/13 12:55:15 bsiegert Exp $
 
 Support O_DIRECT on illumos.
 
---- src/syscall/zerrors_solaris_amd64.go.orig  2024-04-09 15:36:45.882494751 +0000
+--- src/syscall/zerrors_solaris_amd64.go.orig  2024-05-30 19:26:07.000000000 +0000
 +++ src/syscall/zerrors_solaris_amd64.go
 @@ -634,6 +634,7 @@ const (
        O_APPEND                      = 0x8
        O_CLOEXEC                     = 0x800000
        O_CREAT                       = 0x100
 +      O_DIRECT                      = 0x2000000
+       O_DIRECTORY                   = 0x1000000
        O_DSYNC                       = 0x40
        O_EXCL                        = 0x400
-       O_EXEC                        = 0x400000