go, branch go1.12.17

[release-branch.go1.12] go1.12.17

2020-02-12T19:55:29Z

Change-Id: I9d398ed495011487544b1e5d0a469ae73c6f5927 Reviewed-on: https://go-review.googlesource.com/c/go/+/219218 Run-TryBot: Alexander Rakoczy TryBot-Result: Gobot Gobot Reviewed-by: Carlos Amedee

[release-branch.go1.12] doc: document Go 1.12.17

2020-02-12T17:52:48Z

Change-Id: I95f81f269e742ac058cb3e6404cc43beb2428926 Reviewed-on: https://go-review.googlesource.com/c/go/+/219200 Run-TryBot: Alexander Rakoczy TryBot-Result: Gobot Gobot Reviewed-by: Carlos Amedee

[release-branch.go1.12] all: merge release-branch.go1.12-security into release-branch.go1.12

2020-01-31T00:14:28Z

Change-Id: Ic8ed07ad2c77042a67d7e1d4e9c0d5953610cf07

[release-branch.go1.12-security] go1.12.16

2020-01-27T22:27:19Z

Change-Id: Iea658e285670a897a45eca3756004f050763c64d Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/649301 Reviewed-by: Katie Hockman

[release-branch.go1.12-security] doc: document Go 1.12.16

2020-01-27T21:15:08Z

Change-Id: Ib8ac9bf5020d9ab126a8069378978d7dce3509dc Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/648870 Reviewed-by: Dmitri Shuralyov

[release-branch.go1.12-security] internal/x/crypto/cryptobyte: import security fix for 32-bit archs

2020-01-27T20:31:21Z

cryptobyte: fix panic due to malformed ASN.1 inputs on 32-bit archs When int is 32 bits wide (on 32-bit architectures like 386 and arm), an overflow could occur, causing a panic, due to malformed ASN.1 being passed to any of the ASN1 methods of String. Tested on linux/386 and darwin/amd64. This fixes CVE-2020-7919 and was found thanks to the Project Wycheproof test vectors. Change-Id: I8c9696a8bfad1b40ec877cd740dba3467d66ab54 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/645211 Reviewed-by: Katie Hockman Reviewed-by: Adam Langley x/crypto/cryptobyte is used in crypto/x509 for parsing certificates. Malformed certificates might cause a panic during parsing on 32-bit architectures (like arm and 386). Change-Id: I3c619af508bacff84023be4d5a7c4992c2f20a56 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/647483 Reviewed-by: Dmitri Shuralyov

[release-branch.go1.12-security] crypto/x509: mitigate CVE-2020-0601 verification bypass on Windows

2020-01-24T19:25:49Z

An attacker can trick the Windows system verifier to use a poisoned set of elliptic curve parameters for a trusted root, allowing it to generate spoofed signatures. When this happens, the returned chain will present the unmodified original root, so the actual signatures won't verify (as they are invalid for the correct parameters). Simply double check them as a safety measure and mitigation. Windows users should still install the system security patch ASAP. This is the same mitigation adopted by Chromium: https://chromium-review.googlesource.com/c/chromium/src/+/1994434 Change-Id: I2c734f6fb2cb51d906c7fd77034318ffeeb3e146 Reviewed-on: https://go-review.googlesource.com/c/go/+/215905 Run-TryBot: Filippo Valsorda TryBot-Result: Gobot Gobot Reviewed-by: Ryan Sleevi Reviewed-by: Katie Hockman Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/647124 Reviewed-by: Filippo Valsorda

[release-branch.go1.12] runtime: ignore power notification error seen on Windows Docker

2020-01-16T19:05:18Z

Updates #36557 Fixes #36574 Change-Id: Ia8125f382d5e14e5612da811268a58971cc9ac08 Reviewed-on: https://go-review.googlesource.com/c/go/+/214917 Run-TryBot: Ian Lance Taylor TryBot-Result: Gobot Gobot Reviewed-by: Brad Fitzpatrick Reviewed-by: Jason A. Donenfeld Reviewed-by: Austin Clements (cherry picked from commit d2de9bd59c068c1bfcb4293de4286196dacf2e43) Reviewed-on: https://go-review.googlesource.com/c/go/+/215017

[release-branch.go1.12] cmd/go/internal/modload: remove erroneous test case

2020-01-10T21:56:50Z

Commit e0cf3de987e6 of the vcs-test.golang.org/git/querytest repo includes a go.mod file specifying path vcs-test.golang.org/git/querytest.git, as does the latest commit. Since the repository also lacks v3 tags, a query for "latest" with a v3 path should fail. Due to a bug, that query does not fail as expected with Go 1.12. However, we do not need to continue to test for buggy behavior that was fixed in a subsequent release. Updates #36489 Change-Id: I766390c962fc75ba98fad02831310d90abf3055f Reviewed-on: https://go-review.googlesource.com/c/go/+/214281 Run-TryBot: Bryan C. Mills TryBot-Result: Gobot Gobot Reviewed-by: Dmitri Shuralyov

[release-branch.go1.12] go1.12.15

2020-01-09T19:00:28Z

Change-Id: I6e47da51c3687ae9590554d003d803270f50911e Reviewed-on: https://go-review.googlesource.com/c/go/+/214082 Run-TryBot: Carlos Amedee TryBot-Result: Gobot Gobot Reviewed-by: Alexander Rakoczy