pkg archive/zip, method (*ReadCloser) Open(string) (fs.File, error)
pkg archive/zip, method (*Reader) Open(string) (fs.File, error)
-pkg crypto/boring, func Enabled() bool
pkg crypto/x509, method (SystemRootsError) Unwrap() error
pkg debug/elf, const DT_ADDRRNGHI = 1879047935
pkg debug/elf, const DT_ADDRRNGHI DynTag
git worktree add --track -b "$BRANCH" "$WORKTREE" origin/dev.boringcrypto
cd "$WORKTREE/src"
-./make.bash
+GOEXPERIMENT=boringcrypto ./make.bash
cd ../misc/boring
for branch in "$@"; do
func goCmd(t *testing.T, args ...string) string {
newargs := []string{args[0]}
if *testX && args[0] != "env" {
- newargs = append(newargs, "-x")
+ newargs = append(newargs, "-x", "-ldflags=-v")
}
newargs = append(newargs, args[1:]...)
c := exec.Command("go", newargs...)
--- /dev/null
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build boringcrypto
+
+package main
+
+import (
+ "fmt"
+ "os"
+)
+
+func init() {
+ fmt.Printf("SKIP with boringcrypto enabled\n")
+ os.Exit(0)
+}
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
package main_test
import "testing"
// Others trigger external mode.
var internalpkg = []string{
"crypto/internal/boring",
+ "crypto/internal/boring/syso",
"crypto/x509",
"net",
"os/user",
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
// Package boring exposes functions that are only available when building with
// Go+BoringCrypto. This package is available on all targets as long as the
// Go+BoringCrypto toolchain is used. Use the Enabled function to determine
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
package boring_test
import (
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build !boringcrypto
-// +build !boringcrypto
+//go:build (goexperiment.boringcrypto && !boringcrypto) || (!goexperiment.boringcrypto && boringcrypto)
+// +build goexperiment.boringcrypto,!boringcrypto !goexperiment.boringcrypto,boringcrypto
package boring_test
import "testing"
func TestNotBoring(t *testing.T) {
- t.Error("a file tagged !boringcrypto should not build under Go+BoringCrypto")
+ t.Error("goexperiment.boringcrypto and boringcrypto should be equivalent build tags")
}
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
package ecdsa
import (
--- /dev/null
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !boringcrypto
+
+package ecdsa
+
+import "crypto/internal/boring"
+
+func boringPublicKey(*PublicKey) (*boring.PublicKeyECDSA, error) {
+ panic("boringcrypto: not available")
+}
+func boringPrivateKey(*PrivateKey) (*boring.PrivateKeyECDSA, error) {
+ panic("boringcrypto: not available")
+}
#
# $ podman build -t goboring:140sp3678 .
# $ podman run -it --name goboring-140sp3678 goboring:140sp3678
-# $ podman cp goboring-140sp3678:/boring/godriver/goboringcrypto_linux_amd64.syso .
-# $ sha256sum goboringcrypto_linux_amd64.syso # compare to docker output
+# $ podman cp goboring-140sp3678:/boring/godriver/goboringcrypto_linux_amd64.syso syso
+# $ sha256sum syso/goboringcrypto_linux_amd64.syso # compare to docker output
#
# The podman commands may need to run under sudo to work around a subuid/subgid bug.
The Go source code and supporting files in this directory
are covered by the usual Go license (see ../../../../LICENSE).
+When building with GOEXPERIMENT=boringcrypto, the following applies.
+
The goboringcrypto_linux_amd64.syso object file is built
from BoringSSL source code by build/build.sh and is covered
by the BoringSSL license reproduced below and also at
* are met:
*
* 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
+ * notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
- *
+ *
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
+ *
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
- *
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
+ * 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
+ *
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
- *
+ *
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
package boring
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
package boring
import "C"
import (
"crypto/internal/boring/sig"
+ _ "crypto/internal/boring/syso"
"math/big"
)
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
package boring
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
// runtime_arg0 is declared in tls.go without a body.
// It's provided by package runtime,
// but the go command doesn't know that.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
// Package fipstls allows control over whether crypto/tls requires FIPS-approved settings.
-// This package's effects are independent of the use of the BoringCrypto implementation.
+// This package only exists with GOEXPERIMENT=boringcrypto, but the effects are independent
+// of the use of BoringCrypto.
package fipstls
import "sync/atomic"
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
package boring
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build !linux || !amd64 || !cgo || android || cmd_go_bootstrap || msan
-// +build !linux !amd64 !cgo android cmd_go_bootstrap msan
+//go:build !boringcrypto || !linux || !amd64 || !cgo || android || cmd_go_bootstrap || msan
+// +build !boringcrypto !linux !amd64 !cgo android cmd_go_bootstrap msan
package boring
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
package boring
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
package boring
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
package boring
--- /dev/null
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build boringcrypto
+
+// This package only exists with GOEXPERIMENT=boringcrypto.
+// It provides the actual syso file.
+package syso
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
package rsa
import (
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
// Note: Can run these tests against the non-BoringCrypto
// version of the code by using "CGO_ENABLED=0 go test".
--- /dev/null
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !boringcrypto
+
+package rsa
+
+import "crypto/internal/boring"
+
+func boringPublicKey(*PublicKey) (*boring.PublicKeyRSA, error) {
+ panic("boringcrypto: not available")
+}
+func boringPrivateKey(*PrivateKey) (*boring.PrivateKeyRSA, error) {
+ panic("boringcrypto: not available")
+}
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
package tls
import (
}
return fipsSupportedSignatureAlgorithms
}
-
-var testingOnlyForceClientHelloSignatureAlgorithms []SignatureScheme
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
package tls
import (
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
// Package fipsonly restricts all TLS configuration to FIPS-approved settings.
//
// The effect is triggered by importing the package anywhere in a program, as in:
//
// import _ "crypto/tls/fipsonly"
//
-// This package only exists in the dev.boringcrypto branch of Go.
+// This package only exists when using Go compiled with GOEXPERIMENT=boringcrypto.
package fipsonly
// This functionality is provided as a side effect of an import to make
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
+//go:build boringcrypto
+
package fipsonly
import (
session *ClientSessionState
}
+var testingOnlyForceClientHelloSignatureAlgorithms []SignatureScheme
+
func (c *Conn) makeClientHello() (*clientHelloMsg, ecdheParameters, error) {
config := c.config
if len(config.ServerName) == 0 && !config.InsecureSkipVerify {
if !c.config.InsecureSkipVerify {
opts := x509.VerifyOptions{
- IsBoring: isBoringCertificate,
-
Roots: c.config.RootCAs,
CurrentTime: c.config.time(),
DNSName: c.config.ServerName,
Intermediates: x509.NewCertPool(),
}
+ if needFIPS() {
+ opts.IsBoring = isBoringCertificate
+ }
for _, cert := range certs[1:] {
opts.Intermediates.AddCert(cert)
}
if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
opts := x509.VerifyOptions{
- IsBoring: isBoringCertificate,
-
Roots: c.config.ClientCAs,
CurrentTime: c.config.time(),
Intermediates: x509.NewCertPool(),
KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
}
+ if needFIPS() {
+ opts.IsBoring = isBoringCertificate
+ }
for _, cert := range certs[1:] {
opts.Intermediates.AddCert(cert)
--- /dev/null
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !boringcrypto
+
+package tls
+
+import "crypto/x509"
+
+func needFIPS() bool { return false }
+
+func supportedSignatureAlgorithms() []SignatureScheme {
+ return defaultSupportedSignatureAlgorithms
+}
+
+func fipsMinVersion(c *Config) uint16 { panic("fipsMinVersion") }
+func fipsMaxVersion(c *Config) uint16 { panic("fipsMaxVersion") }
+func fipsCurvePreferences(c *Config) []CurveID { panic("fipsCurvePreferences") }
+func fipsCipherSuites(c *Config) []uint16 { panic("fipsCipherSuites") }
+func isBoringCertificate(c *x509.Certificate) bool { panic("isBoringCertificate") }
+
+var fipsSupportedSignatureAlgorithms []SignatureScheme
if name == "unix" && unixOS[ctxt.GOOS] {
return true
}
- // Let applications know that the Go+BoringCrypto toolchain is in use.
if name == "boringcrypto" {
- return true
+ name = "goexperiment.boringcrypto" // boringcrypto is an old name for goexperiment.boringcrypto
}
// other tags
NET, log
< net/mail;
- NONE < crypto/internal/boring/sig;
+ NONE < crypto/internal/boring/sig, crypto/internal/boring/syso;
sync/atomic < crypto/internal/boring/fipstls;
encoding/binary, golang.org/x/sys/cpu, hash,
FMT, math/big, embed,
- CGO, crypto/internal/boring/sig, crypto/internal/boring/fipstls
+ CGO, crypto/internal/boring/sig, crypto/internal/boring/fipstls, crypto/internal/boring/syso
< crypto
< crypto/subtle
< crypto/internal/subtle