Sat Aug 12 13:02:54 2023 UTC ()
Update go119 to 1.19.12 (security).

crypto/tls: restrict RSA keys in certificates to <= 8192 bits

Extremely large RSA keys in certificate chains can cause a client/server
to expend significant CPU time verifying signatures. Limit this by
restricting the size of RSA keys transmitted during handshakes to <=
8192 bits.

Based on a survey of publicly trusted RSA keys, there are currently only
three certificates in circulation with keys larger than this, and all
three appear to be test certificates that are not actively deployed. It
is possible there are larger keys in use in private PKIs, but we target
the web PKI, so causing breakage here in the interests of increasing the
default safety of users of crypto/tls seems reasonable.

Thanks to Mateusz Poliwczak for reporting this issue.


(bsiegert)
diff -r1.183 -r1.184 pkgsrc/lang/go/version.mk
diff -r1.5 -r1.6 pkgsrc/lang/go119/Makefile
diff -r1.13 -r1.14 pkgsrc/lang/go119/distinfo
cvs diff -r1.183 -r1.184 pkgsrc/lang/go/version.mk (expand / switch to unified diff)

--- pkgsrc/lang/go/version.mk 2023/07/15 10:40:37 1.183
+++ pkgsrc/lang/go/version.mk 2023/08/12 13:02:54 1.184
@@ -1,23 +1,23 @@ @@ -1,23 +1,23 @@
1# $NetBSD: version.mk,v 1.183 2023/07/15 10:40:37 bsiegert Exp $ 1# $NetBSD: version.mk,v 1.184 2023/08/12 13:02:54 bsiegert Exp $
2 2
3# 3#
4# If bsd.prefs.mk is included before go-package.mk in a package, then this 4# If bsd.prefs.mk is included before go-package.mk in a package, then this
5# file must be included directly in the package prior to bsd.prefs.mk. 5# file must be included directly in the package prior to bsd.prefs.mk.
6# 6#
7.include "go-vars.mk" 7.include "go-vars.mk"
8 8
9GO120_VERSION= 1.20.6 9GO120_VERSION= 1.20.6
10GO119_VERSION= 1.19.11 10GO119_VERSION= 1.19.12
11GO118_VERSION= 1.18.10 11GO118_VERSION= 1.18.10
12GO14_VERSION= 1.4.3 12GO14_VERSION= 1.4.3
13 13
14.include "../../mk/bsd.prefs.mk" 14.include "../../mk/bsd.prefs.mk"
15 15
16GO_VERSION_DEFAULT?= 120 16GO_VERSION_DEFAULT?= 120
17 17
18.if !empty(GO_VERSION_DEFAULT) 18.if !empty(GO_VERSION_DEFAULT)
19GOVERSSUFFIX= ${GO_VERSION_DEFAULT} 19GOVERSSUFFIX= ${GO_VERSION_DEFAULT}
20.endif 20.endif
21 21
22# How to find the Go tool 22# How to find the Go tool
23GO= ${PREFIX}/go${GOVERSSUFFIX}/bin/go 23GO= ${PREFIX}/go${GOVERSSUFFIX}/bin/go
cvs diff -r1.5 -r1.6 pkgsrc/lang/go119/Makefile (expand / switch to unified diff)

--- pkgsrc/lang/go119/Makefile 2023/07/15 10:52:59 1.5
+++ pkgsrc/lang/go119/Makefile 2023/08/12 13:02:54 1.6
@@ -1,16 +1,15 @@ @@ -1,16 +1,15 @@
1# $NetBSD: Makefile,v 1.5 2023/07/15 10:52:59 bsiegert Exp $ 1# $NetBSD: Makefile,v 1.6 2023/08/12 13:02:54 bsiegert Exp $
2 2
3PKGREVISION= 1 
4.include "../../lang/go/version.mk" 3.include "../../lang/go/version.mk"
5.include "../../lang/go/bootstrap.mk" 4.include "../../lang/go/bootstrap.mk"
6 5
7GOVERSSUFFIX= 119 6GOVERSSUFFIX= 119
8 7
9DISTNAME= go${GO${GOVERSSUFFIX}_VERSION}.src 8DISTNAME= go${GO${GOVERSSUFFIX}_VERSION}.src
10PKGNAME= go${GOVERSSUFFIX}-${GO${GOVERSSUFFIX}_VERSION} 9PKGNAME= go${GOVERSSUFFIX}-${GO${GOVERSSUFFIX}_VERSION}
11CATEGORIES= lang 10CATEGORIES= lang
12MASTER_SITES= https://storage.googleapis.com/golang/ 11MASTER_SITES= https://storage.googleapis.com/golang/
13 12
14MAINTAINER= bsiegert@NetBSD.org 13MAINTAINER= bsiegert@NetBSD.org
15HOMEPAGE= https://golang.org/ 14HOMEPAGE= https://golang.org/
16COMMENT= The Go programming language 15COMMENT= The Go programming language
cvs diff -r1.13 -r1.14 pkgsrc/lang/go119/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/go119/distinfo 2023/07/15 10:35:14 1.13
+++ pkgsrc/lang/go119/distinfo 2023/08/12 13:02:54 1.14
@@ -1,10 +1,10 @@ @@ -1,10 +1,10 @@
1$NetBSD: distinfo,v 1.13 2023/07/15 10:35:14 bsiegert Exp $ 1$NetBSD: distinfo,v 1.14 2023/08/12 13:02:54 bsiegert Exp $
2 2
3BLAKE2s (go1.19.11.src.tar.gz) = 1e7f9fcb9e9fe1ccedaded7d9a550c1af4bfe0b0e7b2c0763193646061ce7e27 3BLAKE2s (go1.19.12.src.tar.gz) = a9c0766535f14e96d143ac8271613f61fb3feaac3c6834d3a6c9b502d137f224
4SHA512 (go1.19.11.src.tar.gz) = da95a1f007a1aff3bd6eeb4b7560654e1ed990e9f6d14663c5309e72714718287a2eb2937f9ec9a041adf384454a2a3bbf8f1671f11c4bd55c76d95e03e7538b 4SHA512 (go1.19.12.src.tar.gz) = 15488e6f9ce86a4ca5650bb9df7845abb11ada0d11fb9a1b048f8c1f7047ad677b45e6c4026eff41c81a14adaa1bf78826f8e81000e7083dbbb6055a31b894e1
5Size (go1.19.11.src.tar.gz) = 26568253 bytes 5Size (go1.19.12.src.tar.gz) = 26575152 bytes
6SHA1 (patch-misc_ios_clangwrap.sh) = 0a06403609cb7bce2e6f65444fd322f486761afe 6SHA1 (patch-misc_ios_clangwrap.sh) = 0a06403609cb7bce2e6f65444fd322f486761afe
7SHA1 (patch-src_cmd_dist_util.go) = 2d9c2f59e27672d56f5f1a0e3f9d5101a05546a7 7SHA1 (patch-src_cmd_dist_util.go) = 2d9c2f59e27672d56f5f1a0e3f9d5101a05546a7
8SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35 8SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35
9SHA1 (patch-src_crypto_x509_root__solaris.go) = d636a1599ede225ac339388fba2b6e253112d461 9SHA1 (patch-src_crypto_x509_root__solaris.go) = d636a1599ede225ac339388fba2b6e253112d461
10SHA1 (patch-src_syscall_zsysnum__solaris__amd64.go) = ec28a0fa37ba9599ec1651c8e9337a2efc48a26b 10SHA1 (patch-src_syscall_zsysnum__solaris__amd64.go) = ec28a0fa37ba9599ec1651c8e9337a2efc48a26b