CVS commit: pkgsrc/lang

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Thu Jun  2 18:19:26 UTC 2022

Modified Files:
        pkgsrc/lang/go: version.mk
        pkgsrc/lang/go117: PLIST distinfo

Log Message:
Update go117 to 1.17.11

This minor release includes 4 security fixes following the security policy
<https://go.dev/security>:

   - crypto/rand: rand.Read hangs with extremely large buffers

   On Windows, rand.Read will hang indefinitely if passed a buffer larger
   than 1 << 32 - 1 bytes.

   Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go
   toolset, for reporting this issue.

   This is CVE-2022-30634 and Go issue https://go.dev/issue/52561.

   - crypto/tls: session tickets lack random ticket_age_add

   Session tickets generated by crypto/tls did not contain a randomly
   generated ticket_age_add. This allows an attacker that can observe TLS
   handshakes to correlate successive connections by comparing ticket ages
   during session resumption.

   Thanks to GitHub user @nervuri for reporting this.

   This is CVE-2022-30629 and Go issue https://go.dev/issue/52814.

   - os/exec: empty Cmd.Path can result in running unintended binary on
   Windows

   If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput
   are executed when Cmd.Path is unset and, in the working directory, there
   are binaries named either "..com" or "..exe", they will be executed.

   Thanks to Chris Darroch (chrisd8088%github.com@localhost), brian m. carlson (
   bk2204%github.com@localhost), and Mikhail Shcherbakov (https://twitter.com/yu5k3)
   for reporting this.

   This is CVE-2022-30580 and Go issue https://go.dev/issue/52574.

   - path/filepath: Clean(`.\c:`) returns `c:` on Windows

   On Windows, the filepath.Clean function could convert an invalid path to
   a valid, absolute path. For example, Clean(`.\c:`) returned `c:`.

   Thanks to Unrud for reporting this issue.

   This is CVE-2022-29804 and Go issue https://go.dev/issue/52476.


To generate a diff of this commit:
cvs rdiff -u -r1.149 -r1.150 pkgsrc/lang/go/version.mk
cvs rdiff -u -r1.9 -r1.10 pkgsrc/lang/go117/PLIST
cvs rdiff -u -r1.16 -r1.17 pkgsrc/lang/go117/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/go/version.mk
diff -u pkgsrc/lang/go/version.mk:1.149 pkgsrc/lang/go/version.mk:1.150
--- pkgsrc/lang/go/version.mk:1.149     Wed May 11 19:00:55 2022
+++ pkgsrc/lang/go/version.mk   Thu Jun  2 18:19:26 2022
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.149 2022/05/11 19:00:55 bsiegert Exp $
+# $NetBSD: version.mk,v 1.150 2022/06/02 18:19:26 bsiegert Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -7,7 +7,7 @@
 .include "go-vars.mk"
 
 GO118_VERSION= 1.18.2
-GO117_VERSION= 1.17.10
+GO117_VERSION= 1.17.11
 GO116_VERSION= 1.16.15
 GO110_VERSION= 1.10.8
 GO19_VERSION=  1.9.7

Index: pkgsrc/lang/go117/PLIST
diff -u pkgsrc/lang/go117/PLIST:1.9 pkgsrc/lang/go117/PLIST:1.10
--- pkgsrc/lang/go117/PLIST:1.9 Wed Apr 13 19:37:39 2022
+++ pkgsrc/lang/go117/PLIST     Thu Jun  2 18:19:26 2022
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.9 2022/04/13 19:37:39 jperkin Exp $
+@comment $NetBSD: PLIST,v 1.10 2022/06/02 18:19:26 bsiegert Exp $
 bin/go117
 bin/gofmt117
 go117/AUTHORS
@@ -1704,6 +1704,7 @@ go117/src/cmd/dist/buildgo.go
 go117/src/cmd/dist/buildruntime.go
 go117/src/cmd/dist/buildtool.go
 go117/src/cmd/dist/doc.go
+go117/src/cmd/dist/exec.go
 go117/src/cmd/dist/imports.go
 go117/src/cmd/dist/main.go
 go117/src/cmd/dist/sys_default.go

Index: pkgsrc/lang/go117/distinfo
diff -u pkgsrc/lang/go117/distinfo:1.16 pkgsrc/lang/go117/distinfo:1.17
--- pkgsrc/lang/go117/distinfo:1.16     Wed May 11 18:39:42 2022
+++ pkgsrc/lang/go117/distinfo  Thu Jun  2 18:19:26 2022
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.16 2022/05/11 18:39:42 bsiegert Exp $
+$NetBSD: distinfo,v 1.17 2022/06/02 18:19:26 bsiegert Exp $
 
-BLAKE2s (go1.17.10.src.tar.gz) = f4058c3d468d8dbd82a0e4e8ab408e73b385f113c2f0b047557383dbe0b5969f
-SHA512 (go1.17.10.src.tar.gz) = 92aa95927ce244cab339dd7f2fb7e416605515d496e96618e6e45ecfa7b022ae3a178bf88338a7a9e9e1afea4c9ab5f9c35f5716409cddbab3542daefb6ba425
-Size (go1.17.10.src.tar.gz) = 22196380 bytes
+BLAKE2s (go1.17.11.src.tar.gz) = 56f12ee3395f5ccec66790391e18f7c4e6462531f75c5ae007637472086fe374
+SHA512 (go1.17.11.src.tar.gz) = cd08062e3357e8e73ad05572ac575b9d8b15599bdb3ea0ca743b04936fa5cca438886e6a06d6453334b8bb5fbe1ab3512657d11651f9199d2254736a6554e71d
+Size (go1.17.11.src.tar.gz) = 22197784 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 0a06403609cb7bce2e6f65444fd322f486761afe
 SHA1 (patch-src_cmd_dist_util.go) = 2d9c2f59e27672d56f5f1a0e3f9d5101a05546a7
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 27636e0d8c121ccec6c46a3a82cd0e0469473a6e