From aef3d8180634533fc67076b00fa746e89b930360 Mon Sep 17 00:00:00 2001 From: qmuntal Date: Thu, 8 Oct 2026 14:18:29 +0200 Subject: [PATCH] [release-branch.go1.27] Upgrade go-crypto-openssl Update to v0.5.1-0.20261008093524-2330498b45b3 from ms-go1.27-support and regenerate the Go 1.27 vendor patch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ebc945f-a54a-4a12-864e-f264d91d3dd0 --- cryptobackend/go.mod | 2 +- cryptobackend/go.sum | 4 +- .../0001-Vendor-external-dependencies.patch | 115 +++++++++++------- 3 files changed, 74 insertions(+), 47 deletions(-) diff --git a/cryptobackend/go.mod b/cryptobackend/go.mod index 5e96fa86f1..5cffd2c86e 100644 --- a/cryptobackend/go.mod +++ b/cryptobackend/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( github.com/microsoft/go-crypto-darwin v0.0.3-0.20261008095156-6223ee583f63 - github.com/microsoft/go-crypto-openssl v0.5.0 + github.com/microsoft/go-crypto-openssl v0.5.1-0.20261008093524-2330498b45b3 github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 golang.org/x/crypto v0.52.1-0.20260526024921-9beb694f9766 ) diff --git a/cryptobackend/go.sum b/cryptobackend/go.sum index 8a00e3f0c1..b3aece7e0e 100644 --- a/cryptobackend/go.sum +++ b/cryptobackend/go.sum @@ -1,7 +1,7 @@ github.com/microsoft/go-crypto-darwin v0.0.3-0.20261008095156-6223ee583f63 h1:Xg6iSNbkRTuSx12WSjAiIlMld3uHCCzcNJhnHvjkDNQ= github.com/microsoft/go-crypto-darwin v0.0.3-0.20261008095156-6223ee583f63/go.mod h1:Qk7P66UNeurLdefRFjOLOra7dGK2KDwI7zV19wUqNSc= -github.com/microsoft/go-crypto-openssl v0.5.0 h1:wTcBB5QN4YtsKcZdqWojL5pWIF/P+PVGNBZ/SQOFiuQ= -github.com/microsoft/go-crypto-openssl v0.5.0/go.mod h1:gJrjX+yWGi9pkbfPVDDh+ZbgjtQoRSXHjb/ZyjwKk34= +github.com/microsoft/go-crypto-openssl v0.5.1-0.20261008093524-2330498b45b3 h1:n+FZ2KcvY4ObSM97SbqXDZ/IdWO67ln/ru1utJ1zMAk= +github.com/microsoft/go-crypto-openssl v0.5.1-0.20261008093524-2330498b45b3/go.mod h1:rdSY8BhWs3fySEKPnwYbTbCAWxnXQAfrE8qBibXNU/M= github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825 h1:nmQ1K/L5GISW8UwbUwE376h3WXREEpREFdc3fNklcXc= github.com/microsoft/go-crypto-winnative v0.0.0-20260605073512-713d2add0825/go.mod h1:a1Z07CJIuWa8WT/pzFIGNTTKS96s8o1B1TPOziAHUxw= golang.org/x/crypto v0.52.1-0.20260526024921-9beb694f9766 h1:ABD+jVg0H4Hwu2sGcUtKeb3T8mlS+jS3uWrkTAPcXjs= diff --git a/patches/0001-Vendor-external-dependencies.patch b/patches/0001-Vendor-external-dependencies.patch index 9ad3473058..fd86b9d873 100644 --- a/patches/0001-Vendor-external-dependencies.patch +++ b/patches/0001-Vendor-external-dependencies.patch @@ -35,7 +35,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result src/cmd/vendor/modules.txt | 11 + src/crypto/deps_ignore.go | 40 + src/go.mod | 14 +- - src/go.sum | 8 + + src/go.sum | 6 + src/go/build/deps_test.go | 55 +- src/go/build/vendor_test.go | 5 + .../microsoft/go-crypto-darwin/LICENSE | 21 + @@ -169,7 +169,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../internal/ossl/errors_cgo.go | 33 + .../internal/ossl/errors_nocgo.go | 19 + .../go-crypto-openssl/internal/ossl/ossl.go | 62 + - .../go-crypto-openssl/internal/ossl/shims.h | 438 +++ + .../go-crypto-openssl/internal/ossl/shims.h | 441 +++ .../internal/ossl/syscall_nocgo.go | 87 + .../internal/ossl/syscall_nocgo_darwin.go | 8 + .../internal/ossl/syscall_nocgo_freebsd.go | 8 + @@ -181,13 +181,13 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../go-crypto-openssl/internal/ossl/zossl.c | 2110 ++++++++++++++ .../go-crypto-openssl/internal/ossl/zossl.go | 66 + .../go-crypto-openssl/internal/ossl/zossl.h | 368 +++ - .../internal/ossl/zossl_cgo.go | 1533 ++++++++++ + .../internal/ossl/zossl_cgo.go | 1543 ++++++++++ .../internal/ossl/zossl_nocgo.go | 2511 +++++++++++++++++ .../go-crypto-openssl/openssl/aes.go | 158 ++ .../go-crypto-openssl/openssl/big.go | 14 + .../openssl/chacha20poly1305.go | 152 + .../go-crypto-openssl/openssl/cipher.go | 690 +++++ - .../go-crypto-openssl/openssl/const.go | 116 + + .../go-crypto-openssl/openssl/const.go | 117 + .../go-crypto-openssl/openssl/cshake.go | 256 ++ .../go-crypto-openssl/openssl/des.go | 121 + .../go-crypto-openssl/openssl/dsa.go | 296 ++ @@ -199,19 +199,19 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../go-crypto-openssl/openssl/hash.go | 518 ++++ .../go-crypto-openssl/openssl/hkdf.go | 312 ++ .../go-crypto-openssl/openssl/hmac.go | 269 ++ - .../go-crypto-openssl/openssl/mldsa.go | 495 ++++ + .../go-crypto-openssl/openssl/mldsa.go | 498 ++++ .../go-crypto-openssl/openssl/mlkem.go | 369 +++ .../go-crypto-openssl/openssl/openssl.go | 182 ++ .../go-crypto-openssl/openssl/openssl_cgo.go | 17 + .../openssl/openssl_nocgo.go | 35 + - .../go-crypto-openssl/openssl/params.go | 191 ++ + .../go-crypto-openssl/openssl/params.go | 202 ++ .../go-crypto-openssl/openssl/pbkdf2.go | 82 + .../openssl/provideropenssl.go | 257 ++ .../openssl/providersymcrypt.go | 331 +++ .../go-crypto-openssl/openssl/rand.go | 37 + .../go-crypto-openssl/openssl/rc4.go | 76 + .../go-crypto-openssl/openssl/rsa.go | 706 +++++ - .../go-crypto-openssl/openssl/tls1prf.go | 149 + + .../go-crypto-openssl/openssl/tls1prf.go | 150 + .../go-crypto-openssl/openssl/zaes.go | 87 + .../go-crypto-openssl/osslsetup/fips.go | 115 + .../go-crypto-openssl/osslsetup/init.go | 170 ++ @@ -399,7 +399,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result .../go/cryptobackend/tls13/tls13_openssl.go | 18 + .../go/cryptobackend/tls13/tls13_windows.go | 14 + src/vendor/modules.txt | 54 + - 391 files changed, 38496 insertions(+), 11 deletions(-) + 391 files changed, 38523 insertions(+), 11 deletions(-) create mode 100644 src/cmd/internal/telemetry/counter/deps_ignore.go create mode 100644 src/cmd/vendor/github.com/microsoft/go-infra/telemetry/LICENSE create mode 100644 src/cmd/vendor/github.com/microsoft/go-infra/telemetry/README.md @@ -2692,7 +2692,7 @@ index 00000000000000..d4671e1584dfa8 +// This file is here just to declare cryptobackend dependencies. +// This allows tracking their versions in a single patch file. diff --git a/src/go.mod b/src/go.mod -index 111f99e60629e1..b8222f47b73571 100644 +index 111f99e60629e1..ffe84581410cf4 100644 --- a/src/go.mod +++ b/src/go.mod @@ -3,11 +3,17 @@ module std @@ -2702,7 +2702,7 @@ index 111f99e60629e1..b8222f47b73571 100644 - golang.org/x/crypto v0.52.1-0.20260526024921-9beb694f9766 - golang.org/x/net v0.55.1-0.20260731170536-c1d18010be90 + github.com/microsoft/go-crypto-darwin v0.0.3-0.20261008095156-6223ee583f63 // indirect -+ github.com/microsoft/go-crypto-openssl v0.5.1-0.20260904065618-5fd04832939d // indirect ++ github.com/microsoft/go-crypto-openssl v0.5.1-0.20261008093524-2330498b45b3 // indirect + github.com/microsoft/go-crypto-winnative v0.0.0-20260821121710-8030c1795188 // indirect + golang.org/x/sys v0.45.0 // indirect + golang.org/x/text v0.37.0 // indirect @@ -2718,16 +2718,14 @@ index 111f99e60629e1..b8222f47b73571 100644 + +replace github.com/microsoft/go/cryptobackend => ../../cryptobackend diff --git a/src/go.sum b/src/go.sum -index 20681d37cbe14c..07328fb3200408 100644 +index 20681d37cbe14c..be0dae92bbf1d4 100644 --- a/src/go.sum +++ b/src/go.sum -@@ -1,3 +1,11 @@ -+github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f h1:ksW7MznRoTYAoBaNIKyjqxR0Tp0aUqY1eALRaerngnk= -+github.com/microsoft/go-crypto-darwin v0.0.3-0.20260619075948-e554deeefa9f/go.mod h1:QahyqOoEDhEJ08aC1WtiWq691LyNgXq3qrjI4QmdPzM= +@@ -1,3 +1,9 @@ +github.com/microsoft/go-crypto-darwin v0.0.3-0.20261008095156-6223ee583f63 h1:Xg6iSNbkRTuSx12WSjAiIlMld3uHCCzcNJhnHvjkDNQ= +github.com/microsoft/go-crypto-darwin v0.0.3-0.20261008095156-6223ee583f63/go.mod h1:Qk7P66UNeurLdefRFjOLOra7dGK2KDwI7zV19wUqNSc= -+github.com/microsoft/go-crypto-openssl v0.5.1-0.20260904065618-5fd04832939d h1:hhPXjMzZjkHpVfitQiN82G7MmeeTUk1gVBqovtENZEw= -+github.com/microsoft/go-crypto-openssl v0.5.1-0.20260904065618-5fd04832939d/go.mod h1:gJrjX+yWGi9pkbfPVDDh+ZbgjtQoRSXHjb/ZyjwKk34= ++github.com/microsoft/go-crypto-openssl v0.5.1-0.20261008093524-2330498b45b3 h1:n+FZ2KcvY4ObSM97SbqXDZ/IdWO67ln/ru1utJ1zMAk= ++github.com/microsoft/go-crypto-openssl v0.5.1-0.20261008093524-2330498b45b3/go.mod h1:rdSY8BhWs3fySEKPnwYbTbCAWxnXQAfrE8qBibXNU/M= +github.com/microsoft/go-crypto-winnative v0.0.0-20260821121710-8030c1795188 h1:hfhYN9B/qbrJCIpxMepm0zuVSSos63NeTSWvfSl9TpQ= +github.com/microsoft/go-crypto-winnative v0.0.0-20260821121710-8030c1795188/go.mod h1:a1Z07CJIuWa8WT/pzFIGNTTKS96s8o1B1TPOziAHUxw= golang.org/x/crypto v0.52.1-0.20260526024921-9beb694f9766 h1:ABD+jVg0H4Hwu2sGcUtKeb3T8mlS+jS3uWrkTAPcXjs= @@ -18506,10 +18504,10 @@ index 00000000000000..9acac55865dc17 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/shims.h b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/shims.h new file mode 100644 -index 00000000000000..da75eb1a802a52 +index 00000000000000..41a24fbe4becca --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/shims.h -@@ -0,0 +1,438 @@ +@@ -0,0 +1,441 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -18656,6 +18654,9 @@ index 00000000000000..da75eb1a802a52 +// Only add functions that have been observed to benefit from these +// directives, not every function that is merely expected to meet +// the noescape/nocallback criteria. ++// Output slots can receive C-owned handles without their addresses escaping. ++// nocallback excludes callbacks into Go, not native provider/ENGINE dispatch: ++// this package does not register Go cryptographic or provider callbacks. + +// BIO API +const _BIO_METHOD_PTR BIO_s_mem(void) __attribute__((tag(""),tag("init_3"),noerror)); @@ -18737,11 +18738,11 @@ index 00000000000000..da75eb1a802a52 +int EVP_DigestFinalXOF(_EVP_MD_CTX_PTR ctx, unsigned char *md, size_t mdlen) __attribute__((tag("33"),noescape,nocallback,slice("md","mdlen"))); +int EVP_DigestSqueeze(_EVP_MD_CTX_PTR ctx, unsigned char *out, size_t outlen) __attribute__((tag("33"),optional,noescape,nocallback,slice("out","outlen"))); +int EVP_DigestSign(_EVP_MD_CTX_PTR ctx, unsigned char *sigret, size_t *siglen, const unsigned char *tbs, size_t tbslen) __attribute__((noescape,nocallback,slice("sigret","siglen"),slice("tbs","tbslen"))); -+int EVP_DigestSignInit(_EVP_MD_CTX_PTR ctx, _EVP_PKEY_CTX_PTR *pctx, const _EVP_MD_PTR type, _ENGINE_PTR e, _EVP_PKEY_PTR pkey); ++int EVP_DigestSignInit(_EVP_MD_CTX_PTR ctx, _EVP_PKEY_CTX_PTR *pctx, const _EVP_MD_PTR type, _ENGINE_PTR e, _EVP_PKEY_PTR pkey) __attribute__((noescape,nocallback)); +int EVP_DigestSignFinal(_EVP_MD_CTX_PTR ctx, unsigned char *sig, size_t *siglen) __attribute__((slice("sig","siglen"))); -+int EVP_DigestVerifyInit(_EVP_MD_CTX_PTR ctx, _EVP_PKEY_CTX_PTR *pctx, const _EVP_MD_PTR type, _ENGINE_PTR e, _EVP_PKEY_PTR pkey); ++int EVP_DigestVerifyInit(_EVP_MD_CTX_PTR ctx, _EVP_PKEY_CTX_PTR *pctx, const _EVP_MD_PTR type, _ENGINE_PTR e, _EVP_PKEY_PTR pkey) __attribute__((noescape,nocallback)); +int EVP_DigestVerifyFinal(_EVP_MD_CTX_PTR ctx, const unsigned char *sig, size_t siglen) __attribute__((slice("sig","siglen"))); -+int EVP_DigestVerify(_EVP_MD_CTX_PTR ctx, const unsigned char *sigret, size_t siglen, const unsigned char *tbs, size_t tbslen) __attribute__((slice("sigret","siglen"),slice("tbs","tbslen"))); ++int EVP_DigestVerify(_EVP_MD_CTX_PTR ctx, const unsigned char *sigret, size_t siglen, const unsigned char *tbs, size_t tbslen) __attribute__((noescape,nocallback,slice("sigret","siglen"),slice("tbs","tbslen"))); + +// HMAC API +int HMAC_Init_ex(_HMAC_CTX_PTR arg0, const void *arg1, int arg2, const _EVP_MD_PTR arg3, _ENGINE_PTR arg4) __attribute__((tag("legacy_1"),noescape,nocallback,slice("arg1","arg2"))); @@ -18804,7 +18805,7 @@ index 00000000000000..da75eb1a802a52 +int EVP_PKEY_set1_encoded_public_key(_EVP_PKEY_PTR pkey, const unsigned char *pub, size_t publen) __attribute__((tag("3"),slice("pub","publen"))); +size_t EVP_PKEY_get1_encoded_public_key(_EVP_PKEY_PTR pkey, unsigned char **ppub) __attribute__((tag("3"))); +int EVP_PKEY_get_bn_param(const _EVP_PKEY_PTR pkey, const char *key_name, _BIGNUM_PTR *bn) __attribute__((tag("3"),noescape,nocallback)); -+int EVP_PKEY_get_octet_string_param(const _EVP_PKEY_PTR pkey, const char *key_name, unsigned char *buf, size_t buf_len, size_t *out_len) __attribute__((tag("3"),slice("buf","buf_len"))); ++int EVP_PKEY_get_octet_string_param(const _EVP_PKEY_PTR pkey, const char *key_name, unsigned char *buf, size_t buf_len, size_t *out_len) __attribute__((tag("3"),noescape,nocallback,slice("buf","buf_len"))); +int EVP_PKEY_eq(const _EVP_PKEY_PTR a, const _EVP_PKEY_PTR b) __attribute__((tag("3"),noescape,nocallback)); +int EVP_PKEY_up_ref(_EVP_PKEY_PTR key); +int EVP_PKEY_set1_EC_KEY(_EVP_PKEY_PTR pkey, _EC_KEY_PTR key) __attribute__((tag("legacy_1"))); @@ -18812,7 +18813,7 @@ index 00000000000000..da75eb1a802a52 +int EVP_PKEY_get_raw_public_key(const _EVP_PKEY_PTR pkey, unsigned char *pub, size_t *publen) __attribute__((noescape,nocallback,slice("pub","publen"))); +int EVP_PKEY_get_raw_private_key(const _EVP_PKEY_PTR pkey, unsigned char *priv, size_t *privlen) __attribute__((noescape,nocallback,slice("priv","privlen"))); +int EVP_PKEY_fromdata_init(_EVP_PKEY_CTX_PTR ctx) __attribute__((tag("3"))); -+int EVP_PKEY_fromdata(_EVP_PKEY_CTX_PTR ctx, _EVP_PKEY_PTR *pkey, int selection, _OSSL_PARAM_PTR params) __attribute__((tag("3"))); ++int EVP_PKEY_fromdata(_EVP_PKEY_CTX_PTR ctx, _EVP_PKEY_PTR *pkey, int selection, _OSSL_PARAM_PTR params) __attribute__((tag("3"),noescape,nocallback)); +int EVP_PKEY_paramgen_init(_EVP_PKEY_CTX_PTR ctx); +int EVP_PKEY_paramgen(_EVP_PKEY_CTX_PTR ctx, _EVP_PKEY_PTR *ppkey); +int EVP_PKEY_keygen_init(_EVP_PKEY_CTX_PTR ctx); @@ -21838,10 +21839,10 @@ index 00000000000000..0de25673891992 +#endif // MKCGO_H diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_cgo.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_cgo.go new file mode 100644 -index 00000000000000..21fb4c071dee50 +index 00000000000000..50aa6374436139 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_cgo.go -@@ -0,0 +1,1533 @@ +@@ -0,0 +1,1543 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -21874,10 +21875,16 @@ index 00000000000000..21fb4c071dee50 +#cgo nocallback _mkcgo_EVP_DigestFinal_ex +#cgo noescape _mkcgo_EVP_DigestSign +#cgo nocallback _mkcgo_EVP_DigestSign ++#cgo noescape _mkcgo_EVP_DigestSignInit ++#cgo nocallback _mkcgo_EVP_DigestSignInit +#cgo noescape _mkcgo_EVP_DigestSqueeze +#cgo nocallback _mkcgo_EVP_DigestSqueeze +#cgo noescape _mkcgo_EVP_DigestUpdate +#cgo nocallback _mkcgo_EVP_DigestUpdate ++#cgo noescape _mkcgo_EVP_DigestVerify ++#cgo nocallback _mkcgo_EVP_DigestVerify ++#cgo noescape _mkcgo_EVP_DigestVerifyInit ++#cgo nocallback _mkcgo_EVP_DigestVerifyInit +#cgo noescape _mkcgo_EVP_EncryptFinal_ex +#cgo nocallback _mkcgo_EVP_EncryptFinal_ex +#cgo noescape _mkcgo_EVP_EncryptUpdate @@ -21912,8 +21919,12 @@ index 00000000000000..21fb4c071dee50 +#cgo nocallback _mkcgo_EVP_PKEY_derive +#cgo noescape _mkcgo_EVP_PKEY_eq +#cgo nocallback _mkcgo_EVP_PKEY_eq ++#cgo noescape _mkcgo_EVP_PKEY_fromdata ++#cgo nocallback _mkcgo_EVP_PKEY_fromdata +#cgo noescape _mkcgo_EVP_PKEY_get_bn_param +#cgo nocallback _mkcgo_EVP_PKEY_get_bn_param ++#cgo noescape _mkcgo_EVP_PKEY_get_octet_string_param ++#cgo nocallback _mkcgo_EVP_PKEY_get_octet_string_param +#cgo noescape _mkcgo_EVP_PKEY_get_raw_private_key +#cgo nocallback _mkcgo_EVP_PKEY_get_raw_private_key +#cgo noescape _mkcgo_EVP_PKEY_get_raw_public_key @@ -23377,7 +23388,7 @@ index 00000000000000..21fb4c071dee50 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_nocgo.go b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_nocgo.go new file mode 100644 -index 00000000000000..42041b8d332062 +index 00000000000000..2fc0c9be0a0a72 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/internal/ossl/zossl_nocgo.go @@ -0,0 +1,2511 @@ @@ -23935,7 +23946,7 @@ index 00000000000000..42041b8d332062 + +func EVP_DigestSignInit(ctx EVP_MD_CTX_PTR, pctx *EVP_PKEY_CTX_PTR, __type EVP_MD_PTR, e ENGINE_PTR, pkey EVP_PKEY_PTR) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_DigestSignInit, uintptr(ctx), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(pctx))), uintptr(__type), uintptr(e), uintptr(pkey), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_DigestSignInit, uintptr(ctx), uintptr(unsafe.Pointer(pctx)), uintptr(__type), uintptr(e), uintptr(pkey), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_DigestSignInit", _err) +} + @@ -23963,7 +23974,7 @@ index 00000000000000..42041b8d332062 + +func EVP_DigestVerify(ctx EVP_MD_CTX_PTR, sigret []byte, tbs []byte) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_DigestVerify, uintptr(ctx), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(unsafe.SliceData(sigret)))), uintptr(len(sigret)), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(unsafe.SliceData(tbs)))), uintptr(len(tbs)), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_DigestVerify, uintptr(ctx), uintptr(unsafe.Pointer(unsafe.SliceData(sigret))), uintptr(len(sigret)), uintptr(unsafe.Pointer(unsafe.SliceData(tbs))), uintptr(len(tbs)), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_DigestVerify", _err) +} + @@ -23979,7 +23990,7 @@ index 00000000000000..42041b8d332062 + +func EVP_DigestVerifyInit(ctx EVP_MD_CTX_PTR, pctx *EVP_PKEY_CTX_PTR, __type EVP_MD_PTR, e ENGINE_PTR, pkey EVP_PKEY_PTR) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_DigestVerifyInit, uintptr(ctx), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(pctx))), uintptr(__type), uintptr(e), uintptr(pkey), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_DigestVerifyInit, uintptr(ctx), uintptr(unsafe.Pointer(pctx)), uintptr(__type), uintptr(e), uintptr(pkey), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_DigestVerifyInit", _err) +} + @@ -24529,7 +24540,7 @@ index 00000000000000..42041b8d332062 + +func EVP_PKEY_fromdata(ctx EVP_PKEY_CTX_PTR, pkey *EVP_PKEY_PTR, selection int32, params OSSL_PARAM_PTR) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_PKEY_fromdata, uintptr(ctx), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(pkey))), uintptr(selection), uintptr(params), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_PKEY_fromdata, uintptr(ctx), uintptr(unsafe.Pointer(pkey)), uintptr(selection), uintptr(params), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_PKEY_fromdata", _err) +} + @@ -24593,7 +24604,7 @@ index 00000000000000..42041b8d332062 + +func EVP_PKEY_get_octet_string_param(pkey EVP_PKEY_PTR, key_name *byte, buf []byte, out_len *int) (int32, error) { + var _err uintptr -+ r0, _ := syscallN(3, _mkcgo_EVP_PKEY_get_octet_string_param, uintptr(pkey), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(key_name))), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(unsafe.SliceData(buf)))), uintptr(len(buf)), uintptr(mkcgoEscapePtrOssl(unsafe.Pointer(out_len))), uintptr(unsafe.Pointer(&_err))) ++ r0, _ := syscallN(3, _mkcgo_EVP_PKEY_get_octet_string_param, uintptr(pkey), uintptr(unsafe.Pointer(key_name)), uintptr(unsafe.Pointer(unsafe.SliceData(buf))), uintptr(len(buf)), uintptr(unsafe.Pointer(out_len)), uintptr(unsafe.Pointer(&_err))) + return int32(r0), newMkcgoErr("EVP_PKEY_get_octet_string_param", _err) +} + @@ -26932,10 +26943,10 @@ index 00000000000000..e69e0bcfe332df +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/const.go b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/const.go new file mode 100644 -index 00000000000000..eb5657a0d28208 +index 00000000000000..de1d5afee901fa --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/const.go -@@ -0,0 +1,116 @@ +@@ -0,0 +1,117 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -27008,6 +27019,7 @@ index 00000000000000..eb5657a0d28208 + _OSSL_KDF_PARAM_MODE cString = "mode\x00" + + // KDF FIPS parameters ++ _OSSL_KDF_PARAM_FIPS_EMS_CHECK cString = "ems_check\x00" + _OSSL_KDF_PARAM_FIPS_KEY_CHECK cString = "key-check\x00" + _OSSL_CIPHER_PARAM_FIPS_ENCRYPT_CHECK cString = "encrypt-check\x00" + @@ -30400,10 +30412,10 @@ index 00000000000000..16d59d713d77c5 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/mldsa.go b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/mldsa.go new file mode 100644 -index 00000000000000..d3e719f8716950 +index 00000000000000..9bbd2cdfbebd5a --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/mldsa.go -@@ -0,0 +1,495 @@ +@@ -0,0 +1,498 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -30412,6 +30424,7 @@ index 00000000000000..d3e719f8716950 +import ( + "errors" + "sync" ++ "unsafe" + + "github.com/microsoft/go-crypto-openssl/internal/ossl" +) @@ -30785,7 +30798,9 @@ index 00000000000000..d3e719f8716950 + bld := newParamBuilder() + defer bld.finalize() + if context != "" { -+ bld.addOctetString(_OSSL_SIGNATURE_PARAM_CONTEXT_STRING, []byte(context)) ++ // The builder only reads these bytes and pins them until build copies ++ // them into the native OSSL_PARAM array. ++ bld.addOctetString(_OSSL_SIGNATURE_PARAM_CONTEXT_STRING, unsafe.Slice(unsafe.StringData(context), len(context))) + } + if externalMu { + bld.addInt32(_OSSL_SIGNATURE_PARAM_MU, 1) @@ -31528,10 +31543,10 @@ index 00000000000000..5dc44cacea9c05 +} diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/params.go b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/params.go new file mode 100644 -index 00000000000000..8bd651d6493707 +index 00000000000000..a770258aaaef57 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/params.go -@@ -0,0 +1,191 @@ +@@ -0,0 +1,202 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -31573,12 +31588,22 @@ index 00000000000000..8bd651d6493707 +// newParamBuilder creates a new paramBuilder. +// [paramBuilder.finalize] must be called to free the builder. +func newParamBuilder() *paramBuilder { ++ // Keep this function small so it can inline and the builder can stay on the ++ // caller's stack. ++ return ¶mBuilder{bld: newNativeParamBuilder()} ++} ++ ++// newNativeParamBuilder keeps native allocation out of the constructor's ++// inline budget so newParamBuilder can inline in both binding modes. ++// ++//go:noinline ++func newNativeParamBuilder() ossl.OSSL_PARAM_BLD_PTR { + bld := ossl.OSSL_PARAM_BLD_new() + if bld == nil { + // If this happens it indicates an issue allocating memory. + panic("openssl: failed to create OSSL_PARAM_BLD") + } -+ return ¶mBuilder{bld: bld} ++ return bld +} + +// finalize frees the builder. @@ -31644,6 +31669,7 @@ index 00000000000000..8bd651d6493707 +} + +// addOctetString adds an octet string to the builder. ++// The builder only reads value; build copies it into the native parameter array. +// The value is pinned and will be unpinned when the builder is freed. +func (b *paramBuilder) addOctetString(name cString, value []byte) { + if !b.check() { @@ -33250,10 +33276,10 @@ index 00000000000000..c480993f983b99 +}) diff --git a/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/tls1prf.go b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/tls1prf.go new file mode 100644 -index 00000000000000..67e4cc7919fe08 +index 00000000000000..07f0f8f4e9fa57 --- /dev/null +++ b/src/vendor/github.com/microsoft/go-crypto-openssl/openssl/tls1prf.go -@@ -0,0 +1,149 @@ +@@ -0,0 +1,150 @@ +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. + @@ -33392,6 +33418,7 @@ index 00000000000000..67e4cc7919fe08 + bld.addOctetString(_OSSL_KDF_PARAM_SECRET, secret) + bld.addOctetString(_OSSL_KDF_PARAM_SEED, label) + bld.addOctetString(_OSSL_KDF_PARAM_SEED, seed) ++ bld.addInt32(_OSSL_KDF_PARAM_FIPS_EMS_CHECK, 0) + params, err := bld.build() + if err != nil { + return err @@ -43930,7 +43957,7 @@ index 00000000000000..b7ffeea07c6b8d + panic("cryptobackend: not available") +} diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt -index b34527fdb12010..0e980f22ffe702 100644 +index b34527fdb12010..e77ead7ca52928 100644 --- a/src/vendor/modules.txt +++ b/src/vendor/modules.txt @@ -1,3 +1,56 @@ @@ -43942,8 +43969,8 @@ index b34527fdb12010..0e980f22ffe702 100644 +github.com/microsoft/go-crypto-darwin/internal/security +github.com/microsoft/go-crypto-darwin/internal/xsyscall +github.com/microsoft/go-crypto-darwin/xcrypto -+# github.com/microsoft/go-crypto-openssl v0.5.1-0.20260904065618-5fd04832939d -+## explicit; go 1.25 ++# github.com/microsoft/go-crypto-openssl v0.5.1-0.20261008093524-2330498b45b3 ++## explicit; go 1.26 +github.com/microsoft/go-crypto-openssl/bbig +github.com/microsoft/go-crypto-openssl/internal/fakecgo +github.com/microsoft/go-crypto-openssl/internal/ossl