[pkgsrc/trunk]: pkgsrc/lang Update go112 to 1.12.16 (security release).

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/3a4e8e768abf
branches:  trunk
changeset: 422738:3a4e8e768abf
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Sun Feb 02 09:26:39 2020 +0000

description:
Update go112 to 1.12.16 (security release).

Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte

On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.

The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.

Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue.

The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.

This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of
golang.org/x/crypto/cryptobyte.

diffstat:

 lang/go/version.mk  |   4 ++--
 lang/go112/distinfo |  10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diffs (36 lines):

diff -r 474f2e830502 -r 3a4e8e768abf lang/go/version.mk
--- a/lang/go/version.mk        Sun Feb 02 08:53:48 2020 +0000
+++ b/lang/go/version.mk        Sun Feb 02 09:26:39 2020 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.78 2020/01/10 12:56:35 bsiegert Exp $
+# $NetBSD: version.mk,v 1.79 2020/02/02 09:26:39 bsiegert Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -7,7 +7,7 @@
 .include "go-vars.mk"
 
 GO113_VERSION= 1.13.6
-GO112_VERSION= 1.12.15
+GO112_VERSION= 1.12.16
 GO111_VERSION= 1.11.13
 GO110_VERSION= 1.10.8
 GO19_VERSION=  1.9.7
diff -r 474f2e830502 -r 3a4e8e768abf lang/go112/distinfo
--- a/lang/go112/distinfo       Sun Feb 02 08:53:48 2020 +0000
+++ b/lang/go112/distinfo       Sun Feb 02 09:26:39 2020 +0000
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.10 2020/01/10 12:53:01 bsiegert Exp $
+$NetBSD: distinfo,v 1.11 2020/02/02 09:26:39 bsiegert Exp $
 
-SHA1 (go1.12.15.src.tar.gz) = 8f104d4718abe9e9301d6529bd83e2b7e2d3855e
-RMD160 (go1.12.15.src.tar.gz) = 26761a6ab380fd449e14d677b1b680c717284810
-SHA512 (go1.12.15.src.tar.gz) = 887e331c73b9d174e4a707a85be389fa0de43c77bc191ef5e0fe326ac7285374404450ca081cb8e92514a973d25d0314ca74eb17c8e53f8386e1798edd9d41aa
-Size (go1.12.15.src.tar.gz) = 20726294 bytes
+SHA1 (go1.12.16.src.tar.gz) = 4cc4b826a99268ae596e21447e2fe228baa2ef1b
+RMD160 (go1.12.16.src.tar.gz) = 8c33946ad3892c6f9f0de01c1875fa41d23dc0e6
+SHA512 (go1.12.16.src.tar.gz) = 715f9c10ff06a5475cf49a621e97df93808e42e48f534ca1a3377115a553e183f76b5277f2673bf5d418430c94efb35d87ebe0c63976ae71743997fe76a2598c
+Size (go1.12.16.src.tar.gz) = 20725779 bytes
 SHA1 (patch-misc_io_clangwrap.sh) = cd91c47ba0fe7b6eb8009dd261c0c26c7d581c29
 SHA1 (patch-src_cmd_dist_util.go) = 24e6f1b6ded842a8ce322a40e8766f7d344bc47e
 SHA1 (patch-src_cmd_link_internal_ld_elf.go) = 990a54e3baf239916e4c7f0c1d54240e2898601a