From 655858c7feccbc852692df00121c0efaadde0dd9 Mon Sep 17 00:00:00 2001 From: qmuntal Date: Tue, 6 Oct 2026 11:27:12 +0200 Subject: [PATCH] Upgrade OpenSSL backend Update go-crypto-openssl to the revision containing the merged ML-DSA allocation improvements. Synchronize the standalone cryptobackend requirement and regenerate the vendored dependency patch. --- cryptobackend/go.mod | 2 +- cryptobackend/go.sum | 4 +- .../0001-Vendor-external-dependencies.patch | 164 +++++++++++------- 3 files changed, 109 insertions(+), 61 deletions(-) diff --git a/cryptobackend/go.mod b/cryptobackend/go.mod index 74e5f297fe8..1bb4d73d55c 100644 --- a/cryptobackend/go.mod +++ b/cryptobackend/go.mod @@ -4,7 +4,7 @@ go 1.26.0 require ( github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f - github.com/microsoft/go-crypto-openssl v0.5.0 + github.com/microsoft/go-crypto-openssl v0.5.1-0.20261005142555-824eae519d26 github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 golang.org/x/crypto v0.57.1-0.20260921070245-7a4a4d6beae2 ) diff --git a/cryptobackend/go.sum b/cryptobackend/go.sum index b78c51f7c9b..8ea1669f694 100644 --- a/cryptobackend/go.sum +++ b/cryptobackend/go.sum @@ -1,7 +1,7 @@ github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f h1:ksW7MznRoTYAoBaNIKyjqxR0Tp0aUqY1eALRaerngnk= github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f/go.mod h1:QahyqOoEDhEJ08aC1WtiWq691LyNgXq3qrjI4QmdPzM= -github.com/microsoft/go-crypto-openssl v0.5.0 h1:wTcBB5QN4YtsKcZdqWojL5pWIF/P+PVGNBZ/SQOFiuQ= -github.com/microsoft/go-crypto-openssl v0.5.0/go.mod h1:gJrjX+yWGi9pkbfPVDDh+ZbgjtQoRSXHjb/ZyjwKk34= +github.com/microsoft/go-crypto-openssl v0.5.1-0.20261005142555-824eae519d26 h1:wUWXwLBG7riSMTLk7FVS5JDBSNahFpiF0K5AHM0D0ck= +github.com/microsoft/go-crypto-openssl v0.5.1-0.20261005142555-824eae519d26/go.mod h1:rdSY8BhWs3fySEKPnwYbTbCAWxnXQAfrE8qBibXNU/M= github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 h1:nmQ1K/L5GISW8UwbUwE376h3WXREEpREFdc3fNklcXc= github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825/go.mod h1:a1Z07CJIuWa8WT/pzFIGNTTKS96s8o1B1TPOziAHUxw= golang.org/x/crypto v0.57.1-0.20260921070245-7a4a4d6beae2 h1:S2kz2UVkb4BhxS9tvxdkfNT6T8NqtaUQE+qv1ObhJ8w= diff --git a/patches/0001-Vendor-external-dependencies.patch b/patches/0001-Vendor-external-dependencies.patch index d085b54778b..19f6c8c7e98 100644 --- a/patches/0001-Vendor-external-dependencies.patch +++ b/patches/0001-Vendor-external-dependencies.patch @@ -146,11 +146,11 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../internal/fakecgo/go_setenv.go | 20 + .../internal/fakecgo/go_util.go | 40 + .../internal/fakecgo/iscgo.go | 21 + - .../internal/fakecgo/libcgo.go | 41 + - .../internal/fakecgo/libcgo_darwin.go | 28 + + .../internal/fakecgo/libcgo.go | 45 + + .../internal/fakecgo/libcgo_darwin.go | 32 + .../internal/fakecgo/libcgo_freebsd.go | 22 + .../internal/fakecgo/libcgo_linux.go | 22 + - .../internal/fakecgo/linux.go | 186 ++ + .../internal/fakecgo/linux.go | 191 ++ .../internal/fakecgo/setenv.go | 21 + .../internal/fakecgo/threadentry_amd64.go | 17 + .../internal/fakecgo/threadentry_noasm.go | 26 + @@ -192,7 +192,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../internal/ossl/errors_cgo.go | 33 + .../internal/ossl/errors_nocgo.go | 19 + .../go-crypto-openssl/internal/ossl/ossl.go | 62 + - .../go-crypto-openssl/internal/ossl/shims.h | 438 +++ + .../go-crypto-openssl/internal/ossl/shims.h | 441 +++ .../internal/ossl/syscall_nocgo.go | 87 + .../internal/ossl/syscall_nocgo_darwin.go | 8 + .../internal/ossl/syscall_nocgo_freebsd.go | 8 + @@ -204,13 +204,13 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../go-crypto-openssl/internal/ossl/zossl.c | 2110 ++++++++++++++ .../go-crypto-openssl/internal/ossl/zossl.go | 66 + .../go-crypto-openssl/internal/ossl/zossl.h | 368 +++ - .../internal/ossl/zossl_cgo.go | 1533 ++++++++++ + .../internal/ossl/zossl_cgo.go | 1543 ++++++++++ .../internal/ossl/zossl_nocgo.go | 2511 +++++++++++++++++ .../go-crypto-openssl/openssl/aes.go | 158 ++ .../go-crypto-openssl/openssl/big.go | 14 + .../openssl/chacha20poly1305.go | 152 + .../go-crypto-openssl/openssl/cipher.go | 690 +++++ - .../go-crypto-openssl/openssl/const.go | 116 + + .../go-crypto-openssl/openssl/const.go | 117 + .../go-crypto-openssl/openssl/cshake.go | 256 ++ .../go-crypto-openssl/openssl/des.go | 121 + .../go-crypto-openssl/openssl/dsa.go | 296 ++ @@ -222,23 +222,23 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../go-crypto-openssl/openssl/hash.go | 518 ++++ .../go-crypto-openssl/openssl/hkdf.go | 312 ++ .../go-crypto-openssl/openssl/hmac.go | 269 ++ - .../go-crypto-openssl/openssl/mldsa.go | 495 ++++ + .../go-crypto-openssl/openssl/mldsa.go | 498 ++++ .../go-crypto-openssl/openssl/mlkem.go | 369 +++ .../go-crypto-openssl/openssl/openssl.go | 182 ++ .../go-crypto-openssl/openssl/openssl_cgo.go | 17 + .../openssl/openssl_nocgo.go | 35 + - .../go-crypto-openssl/openssl/params.go | 191 ++ + .../go-crypto-openssl/openssl/params.go | 202 ++ .../go-crypto-openssl/openssl/pbkdf2.go | 82 + .../openssl/provideropenssl.go | 257 ++ .../openssl/providersymcrypt.go | 331 +++ .../go-crypto-openssl/openssl/rand.go | 37 + .../go-crypto-openssl/openssl/rc4.go | 76 + .../go-crypto-openssl/openssl/rsa.go | 706 +++++ - .../go-crypto-openssl/openssl/tls1prf.go | 149 + + .../go-crypto-openssl/openssl/tls1prf.go | 150 + .../go-crypto-openssl/openssl/zaes.go | 87 + .../go-crypto-openssl/osslsetup/fips.go | 115 + .../go-crypto-openssl/osslsetup/init.go | 170 ++ - .../osslsetup/init_cgo_unix.go | 34 + + .../osslsetup/init_cgo_unix.go | 40 + .../osslsetup/init_nocgo_unix.go | 35 + .../osslsetup/init_windows.go | 37 + .../go-crypto-openssl/osslsetup/osslsetup.go | 123 + @@ -466,7 +466,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../go/cryptobackend/tls13/tls13_openssl.go | 18 + .../go/cryptobackend/tls13/tls13_windows.go | 14 + src/vendor/modules.txt | 54 + - 458 files changed, 42786 insertions(+), 7 deletions(-) + 458 files changed, 42834 insertions(+), 7 deletions(-) create mode 100644 src/cmd/internal/telemetry/counter/deps_ignore.go create mode 100644 src/cmd/vendor/github.com/microsoft/go-infra/telemetry/LICENSE create mode 100644 src/cmd/vendor/github.com/microsoft/go-infra/telemetry/README.md @@ -2825,7 +2825,7 @@ index 00000000000000..976264657a3ea8 +// This file is here just to declare cryptobackend dependencies. +// This allows tracking their versions in a single patch file. diff --git a/src/go.mod b/src/go.mod -index 12b6b39c9e4cf8..e7da02ed590169 100644 +index 12b6b39c9e4cf8..ec6cbd6375f55d 100644 --- a/src/go.mod +++ b/src/go.mod @@ -3,12 +3,18 @@ module std @@ -2840,7 +2840,7 @@ index 12b6b39c9e4cf8..e7da02ed590169 100644 require ( + github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f // indirect -+ github.com/microsoft/go-crypto-openssl v0.5.1-0.20260904065618-5fd04832939d // indirect ++ github.com/microsoft/go-crypto-openssl v0.5.1-0.20261005142555-824eae519d26 // indirect + github.com/microsoft/go-crypto-winnative v0.0.0-20260821094543-418c3f76f8f8 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect @@ -2848,14 +2848,14 @@ index 12b6b39c9e4cf8..e7da02ed590169 100644 + +replace github.com/microsoft/go/cryptobackend => ../../cryptobackend diff --git a/src/go.sum b/src/go.sum -index 4d2c4120ca2482..92814f15456a8e 100644 +index 4d2c4120ca2482..b42d1c1e972797 100644 --- a/src/go.sum +++ b/src/go.sum @@ -1,3 +1,9 @@ +github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f h1:ksW7MznRoTYAoBaNIKyjqxR0Tp0aUqY1eALRaerngnk= +github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f/go.mod h1:QahyqOoEDhEJ08aC1WtiWq691LyNgXq3qrjI4QmdPzM= -+github.com/microsoft/go-crypto-openssl v0.5.1-0.20260904065618-5fd04832939d h1:hhPXjMzZjkHpVfitQiN82G7MmeeTUk1gVBqovtENZEw= -+github.com/microsoft/go-crypto-openssl v0.5.1-0.20260904065618-5fd04832939d/go.mod h1:gJrjX+yWGi9pkbfPVDDh+ZbgjtQoRSXHjb/ZyjwKk34= ++github.com/microsoft/go-crypto-openssl v0.5.1-0.20261005142555-824eae519d26 h1:wUWXwLBG7riSMTLk7FVS5JDBSNahFpiF0K5AHM0D0ck= ++github.com/microsoft/go-crypto-openssl v0.5.1-0.20261005142555-824eae519d26/go.mod h1:rdSY8BhWs3fySEKPnwYbTbCAWxnXQAfrE8qBibXNU/M= +github.com/microsoft/go-crypto-winnative v0.0.0-20260821094543-418c3f76f8f8 h1:lrmG+TKKulC+OpxnJNxPZB/J3/owDWbWrmjGXrjWLHs= +github.com/microsoft/go-crypto-winnative v0.0.0-20260821094543-418c3f76f8f8/go.mod h1:ic6qQ5ko8bzigvuQbGMknZ4WzS4/KDQ9cypGMdqn38s= golang.org/x/crypto v0.57.1-0.20260921070245-7a4a4d6beae2 h1:S2kz2UVkb4BhxS9tvxdkfNT6T8NqtaUQE+qv1ObhJ8w= @@ -15716,12 +15716,12 @@ index 00000000000000..17c6f83475ce5e +func call5(fn, a1, a2, a3, a4, a5 uintptr) uintptr diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/fakecgo.lock b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/fakecgo.lock new file mode 100644 -index 00000000000000..994a32ad9332b8 +index 00000000000000..5e75992a4ab162 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/fakecgo.lock @@ -0,0 +1,3 @@ +{ -+ "commit_hash": "f9d41fc60f1f296d730749174bd3bec93c1ea13c" ++ "commit_hash": "9f4a5c8123af254d83c123343ef2554af657e4c5" +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/freebsd.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/freebsd.go new file mode 100644 @@ -15951,7 +15951,7 @@ index 00000000000000..92f946ddbbf415 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_libinit.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_libinit.go new file mode 100644 -index 00000000000000..38ba01bb4f273d +index 00000000000000..b154fda7305537 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/go_libinit.go @@ -0,0 +1,74 @@ @@ -16011,7 +16011,7 @@ index 00000000000000..38ba01bb4f273d + tries := ts.Nsec + var err int + -+ for tries = 0; tries < 20; tries++ { ++ for tries = range 20 { + // inlined this call because it ran out of stack when inlining was disabled + err = int(call5(pthread_createABI0, uintptr(unsafe.Pointer(thread)), uintptr(unsafe.Pointer(attr)), uintptr(pfn), uintptr(unsafe.Pointer(arg)), 0)) + if err == 0 { @@ -16215,10 +16215,10 @@ index 00000000000000..eb8ec0e7f94b99 +var _iscgo bool = true diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/libcgo.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/libcgo.go new file mode 100644 -index 00000000000000..418a3951bfc621 +index 00000000000000..5010a4e9f8b1c0 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/libcgo.go -@@ -0,0 +1,41 @@ +@@ -0,0 +1,45 @@ +// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT. + +// SPDX-License-Identifier: Apache-2.0 @@ -16228,6 +16228,8 @@ index 00000000000000..418a3951bfc621 + +package fakecgo + ++import "structs" ++ +type ( + size_t uintptr + // Sources: @@ -16251,21 +16253,23 @@ index 00000000000000..418a3951bfc621 +) + +type G struct { ++ _ structs.HostLayout + stacklo uintptr + stackhi uintptr +} + +type ThreadStart struct { ++ _ structs.HostLayout + g *G + tls *uintptr + fn uintptr +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/libcgo_darwin.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/libcgo_darwin.go new file mode 100644 -index 00000000000000..2f7a973b34a3a3 +index 00000000000000..fb739cc23fc020 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/libcgo_darwin.go -@@ -0,0 +1,28 @@ +@@ -0,0 +1,32 @@ +// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT. + +// SPDX-License-Identifier: Apache-2.0 @@ -16275,12 +16279,16 @@ index 00000000000000..2f7a973b34a3a3 + +package fakecgo + ++import "structs" ++ +type ( + pthread_mutex_t struct { ++ _ structs.HostLayout + sig int64 + opaque [56]byte + } + pthread_cond_t struct { ++ _ structs.HostLayout + sig int64 + opaque [40]byte + } @@ -16352,10 +16360,10 @@ index 00000000000000..ace87e2201bfba +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/linux.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/linux.go new file mode 100644 -index 00000000000000..0fbf6bcac87f2b +index 00000000000000..18ff9081c9ee5b --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/fakecgo/linux.go -@@ -0,0 +1,186 @@ +@@ -0,0 +1,191 @@ +// Code generated by update_tool.go from ebitengine/purego; DO NOT EDIT. + +// Copyright 2016 The Go Authors. All rights reserved. @@ -16366,10 +16374,15 @@ index 00000000000000..0fbf6bcac87f2b + +package fakecgo + -+import "unsafe" ++import ( ++ "structs" ++ "unsafe" ++) + -+// argset matches runtime/cgocall.go:argset. ++// argset matches runtime/cgocall.go:argset, which in turn matches ++// runtime/cgo/linux_syscall.c:argset_t. +type argset struct { ++ _ structs.HostLayout + args *uintptr + retval uintptr +} @@ -19987,10 +20000,10 @@ index 00000000000000..9acac55865dc17 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/shims.h b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/shims.h new file mode 100644 -index 00000000000000..da75eb1a802a52 +index 00000000000000..41a24fbe4becca --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/shims.h -@@ -0,0 +1,438 @@ +@@ -0,0 +1,441 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -20137,6 +20150,9 @@ index 00000000000000..da75eb1a802a52 +// Only add functions that have been observed to benefit from these +// directives, not every function that is merely expected to meet +// the noescape/nocallback criteria. ++// Output slots can receive C-owned handles without their addresses escaping. ++// nocallback excludes callbacks into Go, not native provider/ENGINE dispatch: ++// this package does not register Go cryptographic or provider callbacks. + +// BIO API +const _BIO_METHOD_PTR BIO_s_mem(void) __attribute__((tag(""),tag("init_3"),noerror)); @@ -20218,11 +20234,11 @@ index 00000000000000..da75eb1a802a52 +int EVP_DigestFinalXOF(_EVP_MD_CTX_PTR ctx, unsigned char *md, size_t mdlen) __attribute__((tag("33"),noescape,nocallback,slice("md","mdlen"))); +int EVP_DigestSqueeze(_EVP_MD_CTX_PTR ctx, unsigned char *out, size_t outlen) __attribute__((tag("33"),optional,noescape,nocallback,slice("out","outlen"))); +int EVP_DigestSign(_EVP_MD_CTX_PTR ctx, unsigned char *sigret, size_t *siglen, const unsigned char *tbs, size_t tbslen) __attribute__((noescape,nocallback,slice("sigret","siglen"),slice("tbs","tbslen"))); -+int EVP_DigestSignInit(_EVP_MD_CTX_PTR ctx, _EVP_PKEY_CTX_PTR *pctx, const _EVP_MD_PTR type, _ENGINE_PTR e, _EVP_PKEY_PTR pkey); ++int EVP_DigestSignInit(_EVP_MD_CTX_PTR ctx, _EVP_PKEY_CTX_PTR *pctx, const _EVP_MD_PTR type, _ENGINE_PTR e, _EVP_PKEY_PTR pkey) __attribute__((noescape,nocallback)); +int EVP_DigestSignFinal(_EVP_MD_CTX_PTR ctx, unsigned char *sig, size_t *siglen) __attribute__((slice("sig","siglen"))); -+int EVP_DigestVerifyInit(_EVP_MD_CTX_PTR ctx, _EVP_PKEY_CTX_PTR *pctx, const _EVP_MD_PTR type, _ENGINE_PTR e, _EVP_PKEY_PTR pkey); ++int EVP_DigestVerifyInit(_EVP_MD_CTX_PTR ctx, _EVP_PKEY_CTX_PTR *pctx, const _EVP_MD_PTR type, _ENGINE_PTR e, _EVP_PKEY_PTR pkey) __attribute__((noescape,nocallback)); +int EVP_DigestVerifyFinal(_EVP_MD_CTX_PTR ctx, const unsigned char *sig, size_t siglen) __attribute__((slice("sig","siglen"))); -+int EVP_DigestVerify(_EVP_MD_CTX_PTR ctx, const unsigned char *sigret, size_t siglen, const unsigned char *tbs, size_t tbslen) __attribute__((slice("sigret","siglen"),slice("tbs","tbslen"))); ++int EVP_DigestVerify(_EVP_MD_CTX_PTR ctx, const unsigned char *sigret, size_t siglen, const unsigned char *tbs, size_t tbslen) __attribute__((noescape,nocallback,slice("sigret","siglen"),slice("tbs","tbslen"))); + +// HMAC API +int HMAC_Init_ex(_HMAC_CTX_PTR arg0, const void *arg1, int arg2, const _EVP_MD_PTR arg3, _ENGINE_PTR arg4) __attribute__((tag("legacy_1"),noescape,nocallback,slice("arg1","arg2"))); @@ -20285,7 +20301,7 @@ index 00000000000000..da75eb1a802a52 +int EVP_PKEY_set1_encoded_public_key(_EVP_PKEY_PTR pkey, const unsigned char *pub, size_t publen) __attribute__((tag("3"),slice("pub","publen"))); +size_t EVP_PKEY_get1_encoded_public_key(_EVP_PKEY_PTR pkey, unsigned char **ppub) __attribute__((tag("3"))); +int EVP_PKEY_get_bn_param(const _EVP_PKEY_PTR pkey, const char *key_name, _BIGNUM_PTR *bn) __attribute__((tag("3"),noescape,nocallback)); -+int EVP_PKEY_get_octet_string_param(const _EVP_PKEY_PTR pkey, const char *key_name, unsigned char *buf, size_t buf_len, size_t *out_len) __attribute__((tag("3"),slice("buf","buf_len"))); ++int EVP_PKEY_get_octet_string_param(const _EVP_PKEY_PTR pkey, const char *key_name, unsigned char *buf, size_t buf_len, size_t *out_len) __attribute__((tag("3"),noescape,nocallback,slice("buf","buf_len"))); +int EVP_PKEY_eq(const _EVP_PKEY_PTR a, const _EVP_PKEY_PTR b) __attribute__((tag("3"),noescape,nocallback)); +int EVP_PKEY_up_ref(_EVP_PKEY_PTR key); +int EVP_PKEY_set1_EC_KEY(_EVP_PKEY_PTR pkey, _EC_KEY_PTR key) __attribute__((tag("legacy_1"))); @@ -20293,7 +20309,7 @@ index 00000000000000..da75eb1a802a52 +int EVP_PKEY_get_raw_public_key(const _EVP_PKEY_PTR pkey, unsigned char *pub, size_t *publen) __attribute__((noescape,nocallback,slice("pub","publen"))); +int EVP_PKEY_get_raw_private_key(const _EVP_PKEY_PTR pkey, unsigned char *priv, size_t *privlen) __attribute__((noescape,nocallback,slice("priv","privlen"))); +int EVP_PKEY_fromdata_init(_EVP_PKEY_CTX_PTR ctx) __attribute__((tag("3"))); -+int EVP_PKEY_fromdata(_EVP_PKEY_CTX_PTR ctx, _EVP_PKEY_PTR *pkey, int selection, _OSSL_PARAM_PTR params) __attribute__((tag("3"))); ++int EVP_PKEY_fromdata(_EVP_PKEY_CTX_PTR ctx, _EVP_PKEY_PTR *pkey, int selection, _OSSL_PARAM_PTR params) __attribute__((tag("3"),noescape,nocallback)); +int EVP_PKEY_paramgen_init(_EVP_PKEY_CTX_PTR ctx); +int EVP_PKEY_paramgen(_EVP_PKEY_CTX_PTR ctx, _EVP_PKEY_PTR *ppkey); +int EVP_PKEY_keygen_init(_EVP_PKEY_CTX_PTR ctx); @@ -23319,10 +23335,10 @@ index 00000000000000..0de25673891992 +#endif // MKCGO_H diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_cgo.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_cgo.go new file mode 100644 -index 00000000000000..21fb4c071dee50 +index 00000000000000..50aa6374436139 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_cgo.go -@@ -0,0 +1,1533 @@ +@@ -0,0 +1,1543 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -23355,10 +23371,16 @@ index 00000000000000..21fb4c071dee50 +#cgo nocallback _mkcgo_EVP_DigestFinal_ex +#cgo noescape _mkcgo_EVP_DigestSign +#cgo nocallback _mkcgo_EVP_DigestSign ++#cgo noescape _mkcgo_EVP_DigestSignInit ++#cgo nocallback _mkcgo_EVP_DigestSignInit +#cgo noescape _mkcgo_EVP_DigestSqueeze +#cgo nocallback _mkcgo_EVP_DigestSqueeze +#cgo noescape _mkcgo_EVP_DigestUpdate +#cgo nocallback _mkcgo_EVP_DigestUpdate ++#cgo noescape _mkcgo_EVP_DigestVerify ++#cgo nocallback _mkcgo_EVP_DigestVerify ++#cgo noescape _mkcgo_EVP_DigestVerifyInit ++#cgo nocallback _mkcgo_EVP_DigestVerifyInit +#cgo noescape _mkcgo_EVP_EncryptFinal_ex +#cgo nocallback _mkcgo_EVP_EncryptFinal_ex +#cgo noescape _mkcgo_EVP_EncryptUpdate @@ -23393,8 +23415,12 @@ index 00000000000000..21fb4c071dee50 +#cgo nocallback _mkcgo_EVP_PKEY_derive +#cgo noescape _mkcgo_EVP_PKEY_eq +#cgo nocallback _mkcgo_EVP_PKEY_eq ++#cgo noescape _mkcgo_EVP_PKEY_fromdata ++#cgo nocallback _mkcgo_EVP_PKEY_fromdata +#cgo noescape _mkcgo_EVP_PKEY_get_bn_param +#cgo nocallback _mkcgo_EVP_PKEY_get_bn_param ++#cgo noescape _mkcgo_EVP_PKEY_get_octet_string_param ++#cgo nocallback _mkcgo_EVP_PKEY_get_octet_string_param +#cgo noescape _mkcgo_EVP_PKEY_get_raw_private_key +#cgo nocallback _mkcgo_EVP_PKEY_get_raw_private_key +#cgo noescape _mkcgo_EVP_PKEY_get_raw_public_key @@ -24858,7 +24884,7 @@ index 00000000000000..21fb4c071dee50 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_nocgo.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_nocgo.go new file mode 100644 -index 00000000000000..42041b8d332062 +index 00000000000000..2fc0c9be0a0a72 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_nocgo.go @@ -0,0 +1,2511 @@ @@ -25416,7 +25442,7 @@ index 00000000000000..42041b8d332062 + +func EVP_DigestSignInit(ctx EVP_MD_CTX_PTR, pctx *EVP_PKEY_CTX_PTR, __type EVP_MD_PTR, e ENGINE_PTR, pkey EVP_PKEY_PTR) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_DigestSignInit, uintptr(ctx), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(pctx))), uintptr(__type), uintptr(e), uintptr(pkey), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_DigestSignInit, uintptr(ctx), uintptr(unsafe.Pointer(pctx)), uintptr(__type), uintptr(e), uintptr(pkey), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_DigestSignInit", _err) +} + @@ -25444,7 +25470,7 @@ index 00000000000000..42041b8d332062 + +func EVP_DigestVerify(ctx EVP_MD_CTX_PTR, sigret []byte, tbs []byte) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_DigestVerify, uintptr(ctx), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(unsafe.SliceData(sigret)))), uintptr(len(sigret)), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(unsafe.SliceData(tbs)))), uintptr(len(tbs)), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_DigestVerify, uintptr(ctx), uintptr(unsafe.Pointer(unsafe.SliceData(sigret))), uintptr(len(sigret)), uintptr(unsafe.Pointer(unsafe.SliceData(tbs))), uintptr(len(tbs)), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_DigestVerify", _err) +} + @@ -25460,7 +25486,7 @@ index 00000000000000..42041b8d332062 + +func EVP_DigestVerifyInit(ctx EVP_MD_CTX_PTR, pctx *EVP_PKEY_CTX_PTR, __type EVP_MD_PTR, e ENGINE_PTR, pkey EVP_PKEY_PTR) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_DigestVerifyInit, uintptr(ctx), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(pctx))), uintptr(__type), uintptr(e), uintptr(pkey), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_DigestVerifyInit, uintptr(ctx), uintptr(unsafe.Pointer(pctx)), uintptr(__type), uintptr(e), uintptr(pkey), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_DigestVerifyInit", _err) +} + @@ -26010,7 +26036,7 @@ index 00000000000000..42041b8d332062 + +func EVP_PKEY_fromdata(ctx EVP_PKEY_CTX_PTR, pkey *EVP_PKEY_PTR, selection int32, params OSSL_PARAM_PTR) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_PKEY_fromdata, uintptr(ctx), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(pkey))), uintptr(selection), uintptr(params), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_PKEY_fromdata, uintptr(ctx), uintptr(unsafe.Pointer(pkey)), uintptr(selection), uintptr(params), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_PKEY_fromdata", _err) +} + @@ -26074,7 +26100,7 @@ index 00000000000000..42041b8d332062 + +func EVP_PKEY_get_octet_string_param(pkey EVP_PKEY_PTR, key_name *byte, buf []byte, out_len *int) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_PKEY_get_octet_string_param, uintptr(pkey), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(key_name))), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(unsafe.SliceData(buf)))), uintptr(len(buf)), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(out_len))), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_PKEY_get_octet_string_param, uintptr(pkey), uintptr(unsafe.Pointer(key_name)), uintptr(unsafe.Pointer(unsafe.SliceData(buf))), uintptr(len(buf)), uintptr(unsafe.Pointer(out_len)), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_PKEY_get_octet_string_param", _err) +} + @@ -28413,10 +28439,10 @@ index 00000000000000..e69e0bcfe332df +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/const.go b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/const.go new file mode 100644 -index 00000000000000..eb5657a0d28208 +index 00000000000000..de1d5afee901fa --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/const.go -@@ -0,0 +1,116 @@ +@@ -0,0 +1,117 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -28489,6 +28515,7 @@ index 00000000000000..eb5657a0d28208 + _OSSL_KDF_PARAM_MODE cString = "mode\x00" + + // KDF FIPS parameters ++ _OSSL_KDF_PARAM_FIPS_EMS_CHECK cString = "ems_check\x00" + _OSSL_KDF_PARAM_FIPS_KEY_CHECK cString = "key-check\x00" + _OSSL_CIPHER_PARAM_FIPS_ENCRYPT_CHECK cString = "encrypt-check\x00" + @@ -31881,10 +31908,10 @@ index 00000000000000..16d59d713d77c5 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/mldsa.go b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/mldsa.go new file mode 100644 -index 00000000000000..d3e719f8716950 +index 00000000000000..9bbd2cdfbebd5a --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/mldsa.go -@@ -0,0 +1,495 @@ +@@ -0,0 +1,498 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -31893,6 +31920,7 @@ index 00000000000000..d3e719f8716950 +import ( + "errors" + "sync" ++ "unsafe" + + "github.com/microsoft/go-crypto-openssl/internal/ossl" +) @@ -32266,7 +32294,9 @@ index 00000000000000..d3e719f8716950 + bld := newParamBuilder() + defer bld.finalize() + if context != "" { -+ bld.addOctetString(_OSSL_SIGNATURE_PARAM_CONTEXT_STRING, []byte(context)) ++ // The builder only reads these bytes and pins them until build copies ++ // them into the native OSSL_PARAM array. ++ bld.addOctetString(_OSSL_SIGNATURE_PARAM_CONTEXT_STRING, unsafe.Slice(unsafe.StringData(context), len(context))) + } + if externalMu { + bld.addInt32(_OSSL_SIGNATURE_PARAM_MU, 1) @@ -33009,10 +33039,10 @@ index 00000000000000..5dc44cacea9c05 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/params.go b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/params.go new file mode 100644 -index 00000000000000..8bd651d6493707 +index 00000000000000..a770258aaaef57 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/params.go -@@ -0,0 +1,191 @@ +@@ -0,0 +1,202 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -33054,12 +33084,22 @@ index 00000000000000..8bd651d6493707 +// newParamBuilder creates a new paramBuilder. +// [paramBuilder.finalize] must be called to free the builder. +func newParamBuilder() *paramBuilder { ++ // Keep this function small so it can inline and the builder can stay on the ++ // caller's stack. ++ return ¶mBuilder{bld: newNativeParamBuilder()} ++} ++ ++// newNativeParamBuilder keeps native allocation out of the constructor's ++// inline budget so newParamBuilder can inline in both binding modes. ++// ++//go:noinline ++func newNativeParamBuilder() ossl.OSSL_PARAM_BLD_PTR { + bld := ossl.OSSL_PARAM_BLD_new() + if bld == nil { + // If this happens it indicates an issue allocating memory. + panic("openssl: failed to create OSSL_PARAM_BLD") + } -+ return ¶mBuilder{bld: bld} ++ return bld +} + +// finalize frees the builder. @@ -33125,6 +33165,7 @@ index 00000000000000..8bd651d6493707 +} + +// addOctetString adds an octet string to the builder. ++// The builder only reads value; build copies it into the native parameter array. +// The value is pinned and will be unpinned when the builder is freed. +func (b *paramBuilder) addOctetString(name cString, value []byte) { + if !b.check() { @@ -34731,10 +34772,10 @@ index 00000000000000..c480993f983b99 +}) diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/tls1prf.go b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/tls1prf.go new file mode 100644 -index 00000000000000..67e4cc7919fe08 +index 00000000000000..07f0f8f4e9fa57 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/tls1prf.go -@@ -0,0 +1,149 @@ +@@ -0,0 +1,150 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -34873,6 +34914,7 @@ index 00000000000000..67e4cc7919fe08 + bld.addOctetString(_OSSL_KDF_PARAM_SECRET, secret) + bld.addOctetString(_OSSL_KDF_PARAM_SEED, label) + bld.addOctetString(_OSSL_KDF_PARAM_SEED, seed) ++ bld.addInt32(_OSSL_KDF_PARAM_FIPS_EMS_CHECK, 0) + params, err := bld.build() + if err != nil { + return err @@ -35276,10 +35318,10 @@ index 00000000000000..720a446838ea7d +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/osslsetup/init_cgo_unix.go b/src/vendor/github.com/microsoft/go-crypto-openssl/osslsetup/init_cgo_unix.go new file mode 100644 -index 00000000000000..45903c12e802df +index 00000000000000..ea034e1dae10d9 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/osslsetup/init_cgo_unix.go -@@ -0,0 +1,34 @@ +@@ -0,0 +1,40 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -35293,12 +35335,16 @@ index 00000000000000..45903c12e802df +import "C" +import ( + "errors" ++ "runtime" + "unsafe" +) + +func dlopen(file string) (handle unsafe.Pointer, err error) { + cv := C.CString(file) + defer C.free(unsafe.Pointer(cv)) ++ // dlerror is local to the thread that called dlopen. ++ runtime.LockOSThread() ++ defer runtime.UnlockOSThread() + handle = C.dlopen(cv, C.RTLD_LAZY|C.RTLD_LOCAL) + if handle == nil { + errstr := C.GoString(C.dlerror()) @@ -35308,6 +35354,8 @@ index 00000000000000..45903c12e802df +} + +func dlclose(handle unsafe.Pointer) error { ++ runtime.LockOSThread() ++ defer runtime.UnlockOSThread() + if C.dlclose(handle) != 0 { + errstr := C.GoString(C.dlerror()) + return errors.New("openssl: can't close libcrypto: " + errstr) @@ -48758,7 +48806,7 @@ index 00000000000000..b7ffeea07c6b8d + panic("cryptobackend: not available") +} diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt -index 26fd3c0df44eb0..5f6411c33685f4 100644 +index 26fd3c0df44eb0..35073a8de2e680 100644 --- a/src/vendor/modules.txt +++ b/src/vendor/modules.txt @@ -1,3 +1,56 @@ @@ -48771,8 +48819,8 @@ index 26fd3c0df44eb0..5f6411c33685f4 100644 +github.com/microsoft/go-crypto-darwin/internal/security +github.com/microsoft/go-crypto-darwin/internal/xsyscall +github.com/microsoft/go-crypto-darwin/xcrypto -+# github.com/microsoft/go-crypto-openssl v0.5.1-0.20260904065618-5fd04832939d -+## explicit; go 1.25 ++# github.com/microsoft/go-crypto-openssl v0.5.1-0.20261005142555-824eae519d26 ++## explicit; go 1.26 +github.com/microsoft/go-crypto-openssl/bbig +github.com/microsoft/go-crypto-openssl/internal/fakecgo +github.com/microsoft/go-crypto-openssl/internal/ossl