go, branch go1.20.13

[release-branch.go1.20] go1.20.13

2024-01-09T18:15:45Z

Change-Id: I8982d80d8221bf6b5a4b1efd559192b74886aab2 Reviewed-on: https://go-review.googlesource.com/c/go/+/555015 Commit-Queue: Gopher Robot Reviewed-by: Dmitri Shuralyov Reviewed-by: Matthew Dempsky Auto-Submit: Gopher Robot TryBot-Bypass: Dmitri Shuralyov

[release-branch.go1.20] crypto/tls: align FIPS-only mode with BoringSSL policy

2024-01-04T22:45:14Z

This enables TLS 1.3, disables P-521, and disables non-ECDHE suites. Updates #64717 Updates #62372 Fixes #64718 Change-Id: I3a65b239ef0198bbdbe5e55e0810e7128f90a091 Reviewed-on: https://go-review.googlesource.com/c/go/+/549975 Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: Go LUCI Reviewed-by: Than McIntosh Reviewed-on: https://go-review.googlesource.com/c/go/+/553876 Run-TryBot: Matthew Dempsky Auto-Submit: Matthew Dempsky Reviewed-by: Matthew Dempsky TryBot-Result: Gopher Robot

[release-branch.go1.20] crypto/internal/boring: upgrade module to fips-20220613

2024-01-04T22:34:11Z

Also, add EVP_aead_aes_*_gcm_tls13 to the build, which we will need in a following CL, to avoid rebuilding the syso twice. Updates #64717 Updates #62372 Updates #64718 Change-Id: Ie4d853ad9b914c1095cad60694a1ae6f77dc22ce Cq-Include-Trybots: luci.golang.try:go1.20-linux-amd64-boringcrypto Reviewed-on: https://go-review.googlesource.com/c/go/+/549695 Reviewed-by: Than McIntosh Reviewed-by: Roland Shoemaker Reviewed-on: https://go-review.googlesource.com/c/go/+/553875 Auto-Submit: Matthew Dempsky Reviewed-by: Matthew Dempsky LUCI-TryBot-Result: Go LUCI

[release-branch.go1.20] runtime: put ReadMemStats debug assertions behind a double-check mode

2024-01-04T21:33:30Z

ReadMemStats has a few assertions it makes about the consistency of the stats it's about to produce. Specifically, how those stats line up with runtime-internal stats. These checks are generally useful, but crashing just because some stats are wrong is a heavy price to pay. For a long time this wasn't a problem, but very recently it became a real problem. It turns out that there's real benign skew that can happen wherein sysmon (which doesn't synchronize with a STW) generates a trace event when tracing is enabled, and may mutate some stats while ReadMemStats is running its checks. Fix this by synchronizing with both sysmon and the tracer. This is a bit heavy-handed, but better that than false positives. Also, put the checks behind a debug mode. We want to reduce the risk of backporting this change, and again, it's not great to crash just because user-facing stats are off. Still, enable this debug mode during the runtime tests so we don't lose quite as much coverage from disabling these checks by default. For #64401. Fixes #64409. Change-Id: I9adb3e5c7161d207648d07373a11da8a5f0fda9a Reviewed-on: https://go-review.googlesource.com/c/go/+/545277 LUCI-TryBot-Result: Go LUCI Reviewed-by: Michael Pratt Reviewed-by: Felix Geisendörfer (cherry picked from commit b2efd1de97402ec4b8fb4e9e0ec29c8e49e8e200) Reviewed-on: https://go-review.googlesource.com/c/go/+/545556 Auto-Submit: Matthew Dempsky TryBot-Bypass: Matthew Dempsky TryBot-Result: Gopher Robot Run-TryBot: Matthew Dempsky

[release-branch.go1.20] os/signal: skip nohup tests on darwin builders

2023-12-08T18:47:53Z

The new LUCI builders have a temporary limitation that breaks nohup. Skip nohup tests there. For #63875. Fixes #63910. Cq-Include-Trybots: luci.golang.try:go1.20-darwin-amd64_13 Change-Id: Ia9ffecea7310f84a21f6138d8f8cdfc5e1392307 Reviewed-on: https://go-review.googlesource.com/c/go/+/538698 Reviewed-by: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI Reviewed-by: Bryan Mills (cherry picked from commit a334c452731e7becc2dc879e253c7198202af126) Reviewed-on: https://go-review.googlesource.com/c/go/+/546376 TryBot-Bypass: Carlos Amedee

[release-branch.go1.20] os/signal: remove go t.Run from TestNohup

2023-12-07T21:49:00Z

Since CL 226138, TestNohup has a bit of a strange construction: it wants to run the "uncaught" subtests in parallel with each other, and the "nohup" subtests in parallel with each other, but also needs join between "uncaught" and "nohop" so it can Stop notifying for SIGHUP. It achieves this by doing `go t.Run` with a WaitGroup rather than using `t.Parallel` in the subtest (which would make `t.Run` return immediately). However, this makes things more difficult to understand than necessary. As noted on https://pkg.go.dev/testing#hdr-Subtests_and_Sub_benchmarks, a second layer of subtest can be used to join parallel subtests. Switch to this form, which makes the test simpler to follow (particularly the cleanup that goes with "uncaught"). For #63799. For #63910. Change-Id: Ibfce0f439508a7cfca848c7ccfd136c9c453ad8b Reviewed-on: https://go-review.googlesource.com/c/go/+/538899 LUCI-TryBot-Result: Go LUCI Reviewed-by: Bryan Mills (cherry picked from commit 5622a4b2054664edcdd64974b9df73b440aedfae) Reviewed-on: https://go-review.googlesource.com/c/go/+/546375

[release-branch.go1.20] go1.20.12

2023-12-05T18:12:58Z

Change-Id: I79ae17037f1b4a126d9ca04106b7943c0961d967 Reviewed-on: https://go-review.googlesource.com/c/go/+/547435 Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI Reviewed-by: Carlos Amedee Auto-Submit: Gopher Robot

[release-branch.go1.20] net/http: limit chunked data overhead

2023-12-05T17:18:16Z

The chunked transfer encoding adds some overhead to the content transferred. When writing one byte per chunk, for example, there are five bytes of overhead per byte of data transferred: "1\r\nX\r\n" to send "X". Chunks may include "chunk extensions", which we skip over and do not use. For example: "1;chunk extension here\r\nX\r\n". A malicious sender can use chunk extensions to add about 4k of overhead per byte of data. (The maximum chunk header line size we will accept.) Track the amount of overhead read in chunked data, and produce an error if it seems excessive. Updates #64433 Fixes #64434 Fixes CVE-2023-39326 Change-Id: I40f8d70eb6f9575fb43f506eb19132ccedafcf39 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2076135 Reviewed-by: Tatiana Bradley Reviewed-by: Roland Shoemaker (cherry picked from commit 3473ae72ee66c60744665a24b2fde143e8964d4f) Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2095407 Run-TryBot: Roland Shoemaker TryBot-Result: Security TryBots Reviewed-by: Damien Neil Reviewed-on: https://go-review.googlesource.com/c/go/+/547355 Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI

[release-branch.go1.20] crypto/rand,runtime: revert "switch RtlGenRandom for ProcessPrng"

2023-11-29T20:58:26Z

This reverts CL 545356. Reason for revert: 1.20 still supports Windows versions before ProcessPrng was introduced. Change-Id: I224b8c4e7d0ca9ad5e733819b24dd92d14e61ab8 Reviewed-on: https://go-review.googlesource.com/c/go/+/545995 Reviewed-by: Dmitri Shuralyov TryBot-Bypass: Dmitri Shuralyov TryBot-Result: Gopher Robot Run-TryBot: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov

[release-branch.go1.20] cmd/compile: fix findIndVar so it does not match disjointed loop headers

2023-11-28T20:11:58Z

Fix #63983 parseIndVar, prove and maybe more are on the assumption that the loop header is a single block. This can be wrong, ensure we don't match theses cases we don't know how to handle. In the future we could update them so that they know how to handle such cases but theses cases seems rare so I don't think the value would be really high. We could also run a loop canonicalization pass first which could handle this. The repro case looks weird because I massaged it so it would crash with the previous compiler. Change-Id: I4aa8afae9e90a17fa1085832250fc1139c97faa6 Reviewed-on: https://go-review.googlesource.com/c/go/+/539977 Reviewed-by: Heschi Kreinick Reviewed-by: Keith Randall Reviewed-by: Keith Randall LUCI-TryBot-Result: Go LUCI (cherry picked from commit 8b4e1259d0e82c8fe38a1456f997a4e9d63573a2) Reviewed-on: https://go-review.googlesource.com/c/go/+/539936 Run-TryBot: Dmitri Shuralyov Reviewed-by: Mauri de Souza Meneguzzo TryBot-Bypass: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov Reviewed-by: Jorropo Reviewed-by: Michael Knyszek TryBot-Result: Gopher Robot Reviewed-by: Dmitri Shuralyov Auto-Submit: Dmitri Shuralyov