[dev.boringcrypto] all: add boringcrypto build tags

A plain make.bash in this tree will produce a working, standard Go toolchain, not a BoringCrypto-enabled one. The BoringCrypto-enabled one will be created with: GOEXPERIMENT=boringcrypto ./make.bash For #51940. Change-Id: Ia9102ed993242eb1cb7f9b93eca97e81986a27b3 Reviewed-on: https://go-review.googlesource.com/c/go/+/395881 Run-TryBot: Russ Cox <[email protected]> Reviewed-by: Ian Lance Taylor <[email protected]> TryBot-Result: Gopher Robot <[email protected]> Reviewed-by: Ian Lance Taylor <[email protected]>
cloudflare · Apr 29, 2022 · f4c0f42 · f4c0f42
1 parent 1f0547c
commit f4c0f42
Show file tree

Hide file tree

Showing 37 changed files with 153 additions and 43 deletions.
diff --git a/api/go1.16.txt b/api/go1.16.txt
@@ -1,6 +1,5 @@
 pkg archive/zip, method (*ReadCloser) Open(string) (fs.File, error)
 pkg archive/zip, method (*Reader) Open(string) (fs.File, error)
-pkg crypto/boring, func Enabled() bool
 pkg crypto/x509, method (SystemRootsError) Unwrap() error
 pkg debug/elf, const DT_ADDRRNGHI = 1879047935
 pkg debug/elf, const DT_ADDRRNGHI DynTag

diff --git a/misc/boring/release.sh b/misc/boring/release.sh
@@ -18,7 +18,7 @@ git fetch
 git worktree add --track -b "$BRANCH" "$WORKTREE" origin/dev.boringcrypto
 
 cd "$WORKTREE/src"
-./make.bash
+GOEXPERIMENT=boringcrypto ./make.bash
 
 cd ../misc/boring
 for branch in "$@"; do

diff --git a/misc/cgo/testshared/shared_test.go b/misc/cgo/testshared/shared_test.go
@@ -57,7 +57,7 @@ func runWithEnv(t *testing.T, msg string, env []string, args ...string) {
 func goCmd(t *testing.T, args ...string) string {
  newargs := []string{args[0]}
  if *testX && args[0] != "env" {
- newargs = append(newargs, "-x")
+ newargs = append(newargs, "-x", "-ldflags=-v")
  }
  newargs = append(newargs, args[1:]...)
  c := exec.Command("go", newargs...)

diff --git a/src/cmd/api/goapi_boring_test.go b/src/cmd/api/goapi_boring_test.go
@@ -0,0 +1,17 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build boringcrypto
+
+package main
+
+import (
+ "fmt"
+ "os"
+)
+
+func init() {
+ fmt.Printf("SKIP with boringcrypto enabled\n")
+ os.Exit(0)
+}
diff --git a/src/cmd/go/go_boring_test.go b/src/cmd/go/go_boring_test.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 package main_test
 
 import "testing"

diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go
@@ -1060,6 +1060,7 @@ var hostobj []Hostobj
 // Others trigger external mode.
 var internalpkg = []string{
  "crypto/internal/boring",
+ "crypto/internal/boring/syso",
  "crypto/x509",
  "net",
  "os/user",

diff --git a/src/crypto/boring/boring.go b/src/crypto/boring/boring.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 // Package boring exposes functions that are only available when building with
 // Go+BoringCrypto. This package is available on all targets as long as the
 // Go+BoringCrypto toolchain is used. Use the Enabled function to determine

diff --git a/src/crypto/boring/boring_test.go b/src/crypto/boring/boring_test.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 package boring_test
 
 import (

diff --git a/src/crypto/boring/notboring_test.go b/src/crypto/boring/notboring_test.go
@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !boringcrypto
-// +build !boringcrypto
+//go:build (goexperiment.boringcrypto && !boringcrypto) || (!goexperiment.boringcrypto && boringcrypto)
+// +build goexperiment.boringcrypto,!boringcrypto !goexperiment.boringcrypto,boringcrypto
 
 package boring_test
 
 import "testing"
 
 func TestNotBoring(t *testing.T) {
- t.Error("a file tagged !boringcrypto should not build under Go+BoringCrypto")
+ t.Error("goexperiment.boringcrypto and boringcrypto should be equivalent build tags")
 }
diff --git a/src/crypto/ecdsa/boring.go b/src/crypto/ecdsa/boring.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 package ecdsa
 
 import (

diff --git a/src/crypto/ecdsa/notboring.go b/src/crypto/ecdsa/notboring.go
@@ -0,0 +1,16 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !boringcrypto
+
+package ecdsa
+
+import "crypto/internal/boring"
+
+func boringPublicKey(*PublicKey) (*boring.PublicKeyECDSA, error) {
+ panic("boringcrypto: not available")
+}
+func boringPrivateKey(*PrivateKey) (*boring.PrivateKeyECDSA, error) {
+ panic("boringcrypto: not available")
+}
diff --git a/src/crypto/internal/boring/Dockerfile b/src/crypto/internal/boring/Dockerfile
@@ -8,8 +8,8 @@
 #
 # $ podman build -t goboring:140sp3678 .
 # $ podman run -it --name goboring-140sp3678 goboring:140sp3678
-# $ podman cp goboring-140sp3678:/boring/godriver/goboringcrypto_linux_amd64.syso .
-# $ sha256sum goboringcrypto_linux_amd64.syso # compare to docker output
+# $ podman cp goboring-140sp3678:/boring/godriver/goboringcrypto_linux_amd64.syso syso
+# $ sha256sum syso/goboringcrypto_linux_amd64.syso # compare to docker output
 #
 # The podman commands may need to run under sudo to work around a subuid/subgid bug.
 

diff --git a/src/crypto/internal/boring/LICENSE b/src/crypto/internal/boring/LICENSE
@@ -1,6 +1,8 @@
 The Go source code and supporting files in this directory
 are covered by the usual Go license (see ../../../../LICENSE).
 
+When building with GOEXPERIMENT=boringcrypto, the following applies.
+
 The goboringcrypto_linux_amd64.syso object file is built
 from BoringSSL source code by build/build.sh and is covered
 by the BoringSSL license reproduced below and also at
@@ -40,7 +42,7 @@ record keeping.)
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer. 
+ * notice, this list of conditions and the following disclaimer.
  *
  * 2. Redistributions in binary form must reproduce the above copyright
  * notice, this list of conditions and the following disclaimer in
@@ -95,21 +97,21 @@ record keeping.)
  * This package is an SSL implementation written
  * by Eric Young ([email protected]).
  * The implementation was written so as to conform with Netscapes SSL.
- * 
+ *
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to. The following conditions
  * apply to all code found in this distribution, be it the RC4, RSA,
  * lhash, DES, etc., code; not just the SSL code. The SSL documentation
  * included with this distribution is covered by the same copyright terms
  * except that the holder is Tim Hudson ([email protected]).
- * 
+ *
  * Copyright remains Eric Young's, and as such any Copyright notices in
  * the code are not to be removed.
  * If this package is used in a product, Eric Young should be given attribution
  * as the author of the parts of the library used.
  * This can be in the form of a textual message at program startup or
  * in documentation (online or textual) provided with the package.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -124,10 +126,10 @@ record keeping.)
  * Eric Young ([email protected])"
  * The word 'cryptographic' can be left out if the rouines from the library
  * being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
+ * 4. If you include any Windows specific code (or a derivative thereof) from
  * the apps directory (application code) you must include an acknowledgement:
  * "This product includes software written by Tim Hudson ([email protected])"
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -139,7 +141,7 @@ record keeping.)
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- * 
+ *
  * The licence and distribution terms for any publically available version or
  * derivative of this code cannot be changed. i.e. this code cannot simply be
  * copied and put under another distribution licence

diff --git a/src/crypto/internal/boring/aes.go b/src/crypto/internal/boring/aes.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
 
 package boring
 

diff --git a/src/crypto/internal/boring/boring.go b/src/crypto/internal/boring/boring.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
 
 package boring
 
@@ -16,6 +16,7 @@ package boring
 import "C"
 import (
  "crypto/internal/boring/sig"
+ _ "crypto/internal/boring/syso"
  "math/big"
 )
 

diff --git a/src/crypto/internal/boring/ecdsa.go b/src/crypto/internal/boring/ecdsa.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
 
 package boring
 

diff --git a/src/crypto/internal/boring/fipstls/dummy.s → src/crypto/internal/boring/fipstls/stub.s b/src/crypto/internal/boring/fipstls/dummy.s → src/crypto/internal/boring/fipstls/stub.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 // runtime_arg0 is declared in tls.go without a body.
 // It's provided by package runtime,
 // but the go command doesn't know that.

diff --git a/src/crypto/internal/boring/fipstls/tls.go b/src/crypto/internal/boring/fipstls/tls.go
@@ -2,8 +2,11 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 // Package fipstls allows control over whether crypto/tls requires FIPS-approved settings.
-// This package's effects are independent of the use of the BoringCrypto implementation.
+// This package only exists with GOEXPERIMENT=boringcrypto, but the effects are independent
+// of the use of BoringCrypto.
 package fipstls
 
 import "sync/atomic"

diff --git a/src/crypto/internal/boring/hmac.go b/src/crypto/internal/boring/hmac.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
 
 package boring
 

diff --git a/src/crypto/internal/boring/notboring.go b/src/crypto/internal/boring/notboring.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !linux || !amd64 || !cgo || android || cmd_go_bootstrap || msan
-// +build !linux !amd64 !cgo android cmd_go_bootstrap msan
+//go:build !boringcrypto || !linux || !amd64 || !cgo || android || cmd_go_bootstrap || msan
+// +build !boringcrypto !linux !amd64 !cgo android cmd_go_bootstrap msan
 
 package boring
 

diff --git a/src/crypto/internal/boring/rand.go b/src/crypto/internal/boring/rand.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
 
 package boring
 

diff --git a/src/crypto/internal/boring/rsa.go b/src/crypto/internal/boring/rsa.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
 
 package boring
 

diff --git a/src/crypto/internal/boring/sha.go b/src/crypto/internal/boring/sha.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux && amd64 && !android && !cmd_go_bootstrap && !msan
-// +build linux,amd64,!android,!cmd_go_bootstrap,!msan
+//go:build boringcrypto && linux && amd64 && !android && !cmd_go_bootstrap && !msan
+// +build boringcrypto,linux,amd64,!android,!cmd_go_bootstrap,!msan
 
 package boring
 

diff --git a/...al/boring/goboringcrypto_linux_amd64.syso → ...ring/syso/goboringcrypto_linux_amd64.syso b/...al/boring/goboringcrypto_linux_amd64.syso → ...ring/syso/goboringcrypto_linux_amd64.syso
diff --git a/src/crypto/internal/boring/syso/syso.go b/src/crypto/internal/boring/syso/syso.go
@@ -0,0 +1,9 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build boringcrypto
+
+// This package only exists with GOEXPERIMENT=boringcrypto.
+// It provides the actual syso file.
+package syso
diff --git a/src/crypto/rsa/boring.go b/src/crypto/rsa/boring.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 package rsa
 
 import (

diff --git a/src/crypto/rsa/boring_test.go b/src/crypto/rsa/boring_test.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 // Note: Can run these tests against the non-BoringCrypto
 // version of the code by using "CGO_ENABLED=0 go test".
 

diff --git a/src/crypto/rsa/notboring.go b/src/crypto/rsa/notboring.go
@@ -0,0 +1,16 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !boringcrypto
+
+package rsa
+
+import "crypto/internal/boring"
+
+func boringPublicKey(*PublicKey) (*boring.PublicKeyRSA, error) {
+ panic("boringcrypto: not available")
+}
+func boringPrivateKey(*PrivateKey) (*boring.PrivateKeyRSA, error) {
+ panic("boringcrypto: not available")
+}
diff --git a/src/crypto/tls/boring.go b/src/crypto/tls/boring.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 package tls
 
 import (
@@ -124,5 +126,3 @@ func supportedSignatureAlgorithms() []SignatureScheme {
  }
  return fipsSupportedSignatureAlgorithms
 }
-
-var testingOnlyForceClientHelloSignatureAlgorithms []SignatureScheme
diff --git a/src/crypto/tls/boring_test.go b/src/crypto/tls/boring_test.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build boringcrypto
+
 package tls
 
 import (