The commit b4006287f8 "package/go: security bump to version 1.23.6"
removed the go source from the go-bin package `.hash` file.
Since that commit, a number of autobuild errors for the host-go-bin
package started spawning during the 'legal-info' step.
Because the package 'go-bin' defines the '_ACTUAL_SOURCE_TARBALL'
variable the source hash is still required for the legal-info.
Similarly to the 'nodejs' package, the hash files for both the `go-bin`
and `go-src` package are shared in the `package/go` directory with the
help of a symbolic link used to make the subdirectories point to that
common `.hash` file.
Fixes:
https://autobuild.buildroot.org/results/337/33763441a065ddb07e944e26ad8f1f6d43b68592
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 8b79823577)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following CVEs:
CVE-2024-34155: go/parser: stack exhaustion in all Parse* functions
CVE-2024-34156: encoding/gob: stack exhaustion in Decoder.Decode
CVE-2024-34158: go/build/constraint: stack exhaustion in Parse
https://go.dev/doc/devel/release#go1.22.7
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The toolchain is needed to build the final-stage go compiler, when it
should have CGO support.
However, in commit 0290c543de (package/go: new subdirectory for go
variants), the HOST_GO_DEPENDENCIES assignment was only partially split
off to the new location; part of it was left in the ole go.mk to act as
common variables. With that commit, the go package had not been renamed,
which meant that the dependencies were still correct.
But in commit fa2536ec94 (package/go: make host package a virtual
package), the 'go' package was renamed to 'go-src', and replaced by a
'go' virtual package.
The variables in the go-src package were properly renamed, and the
variables in the go virtual package were properly _not_ renamed. As a
consequence, the go-src package lost its dependency on the toolchain
when needed, while the go virtual package still had it.
However, that was not correct when CGO is enabled (i.e. when the target
has threads): go-src then fails to build:
Building Go cmd/dist using [...]/host/lib/go-1.21.8. (go1.21.8 linux/amd64)
go tool dist: cannot invoke C compiler ["[...]/host/bin/aarch64-linux-gcc"]:
fork/exec [...]/host/bin/aarch64-linux-gcc: no such file or directory
Go needs a system C compiler for use with cgo.
To set a C compiler, set CC=the-compiler.
To disable cgo, set CGO_ENABLED=0.
After some retro-thinking, the reasoning behind this was that the
toolchain would _also_ be needed when using the prebuilt go-bin, which
is indeed correct, so by having it as a dependency of the virtual
package, it would ensure the toolchain be present in both cases, when
building from scratch or when using a prebuilt go.
The oversight being that the toolchain is _also_ needed to actually
build go when CGO is enabled.
We fix this by handling the toolchain dependency for CGO by exposing it
in a variable, that can be used as a dependency in go-src, like is done
to actually enable or disable CGO support.
We still ensure that host-go still depends on it, for a future go-bin
provider.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Turns host-go into a virtual package, with a single providers:
- host-go-src, which builds host-go from source based on the same logic
that was previously used in package/go/go/go.mk, now moved to
package/go/go-src/go-src.mk to remove any ambiguity on the role of
the package.
In later commits, we'll add host-go-bin a prebuilt binary host go compiler
as another provider.
A similar solution is proposed for host-rust.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Thomas Perale