[pkgsrc/trunk]: pkgsrc/lang/go Update Go to 1.6.3.

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/9194e71d3751
branches:  trunk
changeset: 349906:9194e71d3751
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Mon Jul 18 20:37:40 2016 +0000

description:
Update Go to 1.6.3.

A security-related issue was recently reported in Go's net/http/cgi package and
net/http package when used in a CGI environment. Go 1.6.3 and Go 1.7rc2 contain
a fix for this issue.

Go versions 1.0-1.6.2 and 1.7rc1 are vulnerable to an input validation flaw in
the CGI components resulting in the HTTP_PROXY environment variable being set
by the incoming Proxy header. This environment variable was also used to set
the outgoing proxy, enabling an attacker to insert a proxy into outgoing
requests of a CGI program.

This is CVE-2016-5386 and was addressed by this change:
https://golang.org/cl/25010, tracked in this issue:
https://golang.org/issue/16405

The Go team would like to thank Dominic Scheirlinck for coordinating disclosure
of this issue across multiple languages and CGI environments. Read more about
"httpoxy" here: https://httpoxy.org/

Go 1.6.3 also adds support for macOS Sierra. See https://golang.org/issue/16354
for details.

diffstat:

 lang/go/Makefile   |   3 +--
 lang/go/distinfo   |  10 +++++-----
 lang/go/version.mk |   4 ++--
 3 files changed, 8 insertions(+), 9 deletions(-)

diffs (43 lines):

diff -r 81ff57b83664 -r 9194e71d3751 lang/go/Makefile
--- a/lang/go/Makefile  Mon Jul 18 17:07:19 2016 +0000
+++ b/lang/go/Makefile  Mon Jul 18 20:37:40 2016 +0000
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.42 2016/07/09 06:38:25 wiz Exp $
+# $NetBSD: Makefile,v 1.43 2016/07/18 20:37:40 bsiegert Exp $
 
-PKGREVISION= 1
 .include "version.mk"
 
 DISTNAME=      go${GO_VERSION}.src
diff -r 81ff57b83664 -r 9194e71d3751 lang/go/distinfo
--- a/lang/go/distinfo  Mon Jul 18 17:07:19 2016 +0000
+++ b/lang/go/distinfo  Mon Jul 18 20:37:40 2016 +0000
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.36 2016/04/30 11:22:28 bsiegert Exp $
+$NetBSD: distinfo,v 1.37 2016/07/18 20:37:40 bsiegert Exp $
 
-SHA1 (go1.6.2.src.tar.gz) = 09232ac0e76635cc9e0a1f33a81bf03ae9cb9db5
-RMD160 (go1.6.2.src.tar.gz) = 012b5845dad83c47cbc2d915ab062bf4341803cb
-SHA512 (go1.6.2.src.tar.gz) = e148022f9e18b5d5b05744f1aa9fa3ef82e255752179545711ade077e271216aa5b450859a764fdfb028ae4faa26adad8d0a0a5268b31396ab9d14de3cb2f20a
-Size (go1.6.2.src.tar.gz) = 12617724 bytes
+SHA1 (go1.6.3.src.tar.gz) = b487b9127afba37e6c62305165bf840758d6adaf
+RMD160 (go1.6.3.src.tar.gz) = 215142f0c2f67a49fec97056974113caca95672b
+SHA512 (go1.6.3.src.tar.gz) = 43e9b01220788112a185500bd53f091e7a0023a790092f428e2f40fc1a334dd148558b99d2a1c871b8cc79ad7d2d87a092b93eee7b5a27c2ee675c494de35306
+Size (go1.6.3.src.tar.gz) = 12617426 bytes
 SHA1 (patch-lib_time_update.bash) = bcf565b97ae7898a9e5cef7686fe42c69bc0bba1
 SHA1 (patch-misc_io_clangwrap.sh) = cd91c47ba0fe7b6eb8009dd261c0c26c7d581c29
 SHA1 (patch-src_cmd_go_pkg.go) = ccc470577951bd00741c39229599c0c06be52d0a
diff -r 81ff57b83664 -r 9194e71d3751 lang/go/version.mk
--- a/lang/go/version.mk        Mon Jul 18 17:07:19 2016 +0000
+++ b/lang/go/version.mk        Mon Jul 18 20:37:40 2016 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: version.mk,v 1.14 2016/04/30 11:22:28 bsiegert Exp $
+# $NetBSD: version.mk,v 1.15 2016/07/18 20:37:40 bsiegert Exp $
 
 .include "../../mk/bsd.prefs.mk"
 
-GO_VERSION=    1.6.2
+GO_VERSION=    1.6.3
 GO14_VERSION=  1.4.3
 
 ONLY_FOR_PLATFORM=     *-*-i386 *-*-x86_64 *-*-evbarm