From b2a697bd06e01abade1d436f01be7186b1c38842 Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Mon, 8 Dec 2025 23:52:18 +0100 Subject: [PATCH] all: update to x/crypto@7dacc380ba00 This brings in CL 728480 for fips140only support in x/crypto/chacha20poly1305. This brings in also CL 726280 due to the lockstep x/ dependencies. Updates #70514 Change-Id: I5144a8b260c68c8649fa8d0edb648a0c6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/728501 LUCI-TryBot-Result: Go LUCI Reviewed-by: Dmitri Shuralyov Reviewed-by: Roland Shoemaker Auto-Submit: Filippo Valsorda --- src/cmd/go.mod | 8 ++++---- src/cmd/go.sum | 16 ++++++++-------- .../golang.org/x/sync/errgroup/errgroup.go | 4 ++-- src/cmd/vendor/modules.txt | 8 ++++---- src/go.mod | 6 +++--- src/go.sum | 12 ++++++------ .../crypto/chacha20poly1305/chacha20poly1305.go | 3 +++ .../chacha20poly1305/fips140only_compat.go | 9 +++++++++ .../chacha20poly1305/fips140only_go1.26.go | 11 +++++++++++ .../crypto/chacha20poly1305/xchacha20poly1305.go | 3 +++ src/vendor/modules.txt | 6 +++--- 11 files changed, 56 insertions(+), 30 deletions(-) create mode 100644 src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_compat.go create mode 100644 src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_go1.26.go diff --git a/src/cmd/go.mod b/src/cmd/go.mod index 90c3717334..c7d3cc6136 100644 --- a/src/cmd/go.mod +++ b/src/cmd/go.mod @@ -7,15 +7,15 @@ require ( golang.org/x/arch v0.23.0 golang.org/x/build v0.0.0-20251128064159-b9bfd88b30e8 golang.org/x/mod v0.30.1-0.20251115032019-269c237cf350 - golang.org/x/sync v0.18.0 - golang.org/x/sys v0.38.1-0.20251125153526-08e54827f670 + golang.org/x/sync v0.19.0 + golang.org/x/sys v0.39.0 golang.org/x/telemetry v0.0.0-20251128220624-abf20d0e57ec - golang.org/x/term v0.37.0 + golang.org/x/term v0.38.0 golang.org/x/tools v0.39.1-0.20251205000126-062ef7b6ced2 ) require ( github.com/ianlancetaylor/demangle v0.0.0-20250417193237-f615e6bd150b // indirect - golang.org/x/text v0.31.1-0.20251128220601-087616b6cde9 // indirect + golang.org/x/text v0.32.0 // indirect rsc.io/markdown v0.0.0-20240306144322-0bf8f97ee8ef // indirect ) diff --git a/src/cmd/go.sum b/src/cmd/go.sum index 774820d54c..b02c469a41 100644 --- a/src/cmd/go.sum +++ b/src/cmd/go.sum @@ -12,16 +12,16 @@ golang.org/x/build v0.0.0-20251128064159-b9bfd88b30e8 h1:Mp+uRtHbKFW85lGBTOkOOfk golang.org/x/build v0.0.0-20251128064159-b9bfd88b30e8/go.mod h1:Jx2RBBeTWGRSCwfSZ+w2Hg1f7LjWycsSkx+EciLAmPE= golang.org/x/mod v0.30.1-0.20251115032019-269c237cf350 h1:JGDMsCp8NahDR9HSvwrF6V8tzEf87m7Bo4oZ07vRxdU= golang.org/x/mod v0.30.1-0.20251115032019-269c237cf350/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc= -golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= -golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= -golang.org/x/sys v0.38.1-0.20251125153526-08e54827f670 h1:s8+qM6u6X24AFOioI7tH2p/6zxCHqt3G7zwUYm7MgUc= -golang.org/x/sys v0.38.1-0.20251125153526-08e54827f670/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= +golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= +golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/telemetry v0.0.0-20251128220624-abf20d0e57ec h1:dRVkWZl6bUOp+oxnOe4BuyhWSIPmt29N4ooHarm7Ic8= golang.org/x/telemetry v0.0.0-20251128220624-abf20d0e57ec/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ= -golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU= -golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= -golang.org/x/text v0.31.1-0.20251128220601-087616b6cde9 h1:IjQf87/qLz2y0SiCc0uY3DwajALXkAgP1Pxal0mmdrM= -golang.org/x/text v0.31.1-0.20251128220601-087616b6cde9/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= +golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q= +golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg= +golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= +golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= golang.org/x/tools v0.39.1-0.20251205000126-062ef7b6ced2 h1:2Qqv605Nus9iUp3ErvEU/q92Q3HAzeROztzl9pzAno8= golang.org/x/tools v0.39.1-0.20251205000126-062ef7b6ced2/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ= rsc.io/markdown v0.0.0-20240306144322-0bf8f97ee8ef h1:mqLYrXCXYEZOop9/Dbo6RPX11539nwiCNBb1icVPmw8= diff --git a/src/cmd/vendor/golang.org/x/sync/errgroup/errgroup.go b/src/cmd/vendor/golang.org/x/sync/errgroup/errgroup.go index 2f45dbc86e..f69fd75468 100644 --- a/src/cmd/vendor/golang.org/x/sync/errgroup/errgroup.go +++ b/src/cmd/vendor/golang.org/x/sync/errgroup/errgroup.go @@ -144,8 +144,8 @@ func (g *Group) SetLimit(n int) { g.sem = nil return } - if len(g.sem) != 0 { - panic(fmt.Errorf("errgroup: modify limit while %v goroutines in the group are still active", len(g.sem))) + if active := len(g.sem); active != 0 { + panic(fmt.Errorf("errgroup: modify limit while %v goroutines in the group are still active", active)) } g.sem = make(chan token, n) } diff --git a/src/cmd/vendor/modules.txt b/src/cmd/vendor/modules.txt index 7e48798071..7c122cd9d1 100644 --- a/src/cmd/vendor/modules.txt +++ b/src/cmd/vendor/modules.txt @@ -39,11 +39,11 @@ golang.org/x/mod/sumdb/dirhash golang.org/x/mod/sumdb/note golang.org/x/mod/sumdb/tlog golang.org/x/mod/zip -# golang.org/x/sync v0.18.0 +# golang.org/x/sync v0.19.0 ## explicit; go 1.24.0 golang.org/x/sync/errgroup golang.org/x/sync/semaphore -# golang.org/x/sys v0.38.1-0.20251125153526-08e54827f670 +# golang.org/x/sys v0.39.0 ## explicit; go 1.24.0 golang.org/x/sys/plan9 golang.org/x/sys/unix @@ -60,10 +60,10 @@ golang.org/x/telemetry/internal/crashmonitor golang.org/x/telemetry/internal/mmap golang.org/x/telemetry/internal/telemetry golang.org/x/telemetry/internal/upload -# golang.org/x/term v0.37.0 +# golang.org/x/term v0.38.0 ## explicit; go 1.24.0 golang.org/x/term -# golang.org/x/text v0.31.1-0.20251128220601-087616b6cde9 +# golang.org/x/text v0.32.0 ## explicit; go 1.24.0 golang.org/x/text/cases golang.org/x/text/internal diff --git a/src/go.mod b/src/go.mod index f79455c970..efc07451b5 100644 --- a/src/go.mod +++ b/src/go.mod @@ -3,11 +3,11 @@ module std go 1.26 require ( - golang.org/x/crypto v0.45.0 + golang.org/x/crypto v0.46.1-0.20251210140736-7dacc380ba00 golang.org/x/net v0.47.1-0.20251128220604-7c360367ab7e ) require ( - golang.org/x/sys v0.38.1-0.20251125153526-08e54827f670 // indirect - golang.org/x/text v0.31.1-0.20251128220601-087616b6cde9 // indirect + golang.org/x/sys v0.39.0 // indirect + golang.org/x/text v0.32.0 // indirect ) diff --git a/src/go.sum b/src/go.sum index e2cf9591bc..b6b841b44d 100644 --- a/src/go.sum +++ b/src/go.sum @@ -1,8 +1,8 @@ -golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= -golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= +golang.org/x/crypto v0.46.1-0.20251210140736-7dacc380ba00 h1:JgcPM1rzpSOZS8y69FQvnY0xN0ciHlpQqwTXJcuZIA4= +golang.org/x/crypto v0.46.1-0.20251210140736-7dacc380ba00/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0= golang.org/x/net v0.47.1-0.20251128220604-7c360367ab7e h1:PAAT9cIDvIAIRQVz2txQvUFRt3jOlhiO84ihd8XMGlg= golang.org/x/net v0.47.1-0.20251128220604-7c360367ab7e/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= -golang.org/x/sys v0.38.1-0.20251125153526-08e54827f670 h1:s8+qM6u6X24AFOioI7tH2p/6zxCHqt3G7zwUYm7MgUc= -golang.org/x/sys v0.38.1-0.20251125153526-08e54827f670/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.31.1-0.20251128220601-087616b6cde9 h1:IjQf87/qLz2y0SiCc0uY3DwajALXkAgP1Pxal0mmdrM= -golang.org/x/text v0.31.1-0.20251128220601-087616b6cde9/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= +golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= +golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= +golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= diff --git a/src/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go b/src/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go index 8cf5d8112e..956795524f 100644 --- a/src/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go +++ b/src/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305.go @@ -38,6 +38,9 @@ type chacha20poly1305 struct { // New returns a ChaCha20-Poly1305 AEAD that uses the given 256-bit key. func New(key []byte) (cipher.AEAD, error) { + if fips140Enforced() { + return nil, errors.New("chacha20poly1305: use of ChaCha20Poly1305 is not allowed in FIPS 140-only mode") + } if len(key) != KeySize { return nil, errors.New("chacha20poly1305: bad key length") } diff --git a/src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_compat.go b/src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_compat.go new file mode 100644 index 0000000000..9b9d5643ec --- /dev/null +++ b/src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_compat.go @@ -0,0 +1,9 @@ +// Copyright 2025 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build !go1.26 + +package chacha20poly1305 + +func fips140Enforced() bool { return false } diff --git a/src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_go1.26.go b/src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_go1.26.go new file mode 100644 index 0000000000..f71089c486 --- /dev/null +++ b/src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_go1.26.go @@ -0,0 +1,11 @@ +// Copyright 2025 The Go Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build go1.26 + +package chacha20poly1305 + +import "crypto/fips140" + +func fips140Enforced() bool { return fips140.Enforced() } diff --git a/src/vendor/golang.org/x/crypto/chacha20poly1305/xchacha20poly1305.go b/src/vendor/golang.org/x/crypto/chacha20poly1305/xchacha20poly1305.go index 1cebfe946f..b4299b718c 100644 --- a/src/vendor/golang.org/x/crypto/chacha20poly1305/xchacha20poly1305.go +++ b/src/vendor/golang.org/x/crypto/chacha20poly1305/xchacha20poly1305.go @@ -22,6 +22,9 @@ type xchacha20poly1305 struct { // preferred when nonce uniqueness cannot be trivially ensured, or whenever // nonces are randomly generated. func NewX(key []byte) (cipher.AEAD, error) { + if fips140Enforced() { + return nil, errors.New("chacha20poly1305: use of ChaCha20Poly1305 is not allowed in FIPS 140-only mode") + } if len(key) != KeySize { return nil, errors.New("chacha20poly1305: bad key length") } diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt index 7932adddfa..b6f6376eac 100644 --- a/src/vendor/modules.txt +++ b/src/vendor/modules.txt @@ -1,4 +1,4 @@ -# golang.org/x/crypto v0.45.0 +# golang.org/x/crypto v0.46.1-0.20251210140736-7dacc380ba00 ## explicit; go 1.24.0 golang.org/x/crypto/chacha20 golang.org/x/crypto/chacha20poly1305 @@ -15,10 +15,10 @@ golang.org/x/net/http2/hpack golang.org/x/net/idna golang.org/x/net/lif golang.org/x/net/nettest -# golang.org/x/sys v0.38.1-0.20251125153526-08e54827f670 +# golang.org/x/sys v0.39.0 ## explicit; go 1.24.0 golang.org/x/sys/cpu -# golang.org/x/text v0.31.1-0.20251128220601-087616b6cde9 +# golang.org/x/text v0.32.0 ## explicit; go 1.24.0 golang.org/x/text/secure/bidirule golang.org/x/text/transform -- 2.52.0