Files
Christian Stewart 43d1323196 package/go: security bump to version 1.26.1
Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.

To support this we use Go version 1.25.8 as the version for
go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
go-bootstrap-stage5.

Go version 1.25.8 is the latest Go version we can build using
go-bootstrap-stage4.

The package build for go-bootstrap-stage5 is effectively identical to
go-bootstrap-stage4 with only the Go version and stage number changed.

Go 1.28 is expected to require a minor release of Go 1.26 for bootstrap.

Fixes the following security vulnerabilities:

- CVE-2026-25679: net/url: reject IPv6 literal not at start of host
- CVE-2026-27142: html/template: URLs in meta attribute actions not escaped
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
- CVE-2026-27138: crypto/x509: panic in name constraint checking: certificates
- CVE-2026-27139: os: FileInfo can escape from a Root

For full release notes, see:
https://go.dev/doc/devel/release#go1.26.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-03-12 19:42:12 +01:00

60 lines
1.5 KiB
Makefile

################################################################################
#
# go-src
#
################################################################################
GO_SRC_VERSION = $(GO_VERSION)
GO_SRC_SITE = https://go.dev/dl
GO_SRC_SOURCE = go$(GO_VERSION).src.tar.gz
GO_SRC_DL_SUBDIR = go
GO_SRC_LICENSE = BSD-3-Clause
GO_SRC_LICENSE_FILES = LICENSE
GO_SRC_CPE_ID_VENDOR = golang
GO_SRC_CPE_ID_PRODUCT = go
HOST_GO_SRC_PROVIDES = host-go
HOST_GO_SRC_DEPENDENCIES = \
host-go-bootstrap-stage5 \
$(HOST_GO_DEPENDENCIES_CGO)
ifeq ($(BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS),y)
HOST_GO_SRC_CROSS_ENV = \
CC_FOR_TARGET="$(TARGET_CC)" \
CXX_FOR_TARGET="$(TARGET_CXX)" \
GOOS="linux" \
GOARCH=$(GO_GOARCH) \
$(if $(GO_GO386),GO386=$(GO_GO386)) \
$(if $(GO_GOARM),GOARM=$(GO_GOARM)) \
GO_ASSUME_CROSSCOMPILING=1
endif
# The go build system is not compatible with ccache, so use
# HOSTCC_NOCCACHE. See https://github.com/golang/go/issues/11685.
HOST_GO_SRC_MAKE_ENV = \
GO111MODULE=off \
GOCACHE=$(HOST_GO_HOST_CACHE) \
GOROOT_BOOTSTRAP=$(HOST_GO_BOOTSTRAP_STAGE5_ROOT) \
GOROOT_FINAL=$(HOST_GO_ROOT) \
GOROOT="$(@D)" \
GOBIN="$(@D)/bin" \
GOOS=linux \
CC=$(HOSTCC_NOCCACHE) \
CXX=$(HOSTCXX_NOCCACHE) \
CGO_ENABLED=$(HOST_GO_CGO_ENABLED) \
$(HOST_GO_SRC_CROSS_ENV)
define HOST_GO_SRC_BUILD_CMDS
cd $(@D)/src && \
$(HOST_GO_SRC_MAKE_ENV) ./make.bash $(if $(VERBOSE),-v)
endef
define HOST_GO_SRC_INSTALL_CMDS
$(GO_BINARIES_INSTALL)
endef
$(eval $(host-generic-package))