test: move system crypto tests outside patches

eng/_util/cmd/build/build.go

@@ -222,6 +222,13 @@ func build(o *options) (err error) {
 	}
 
 	if o.Test {
+		if err := runCommandLine(
+			filepath.Join(goRootDir, "bin", "go"+executableExtension),
+			"-C", filepath.Join(rootDir, "toolchaintest"), "test", "-count=1",
+		); err != nil {
+			return err
+		}
+
 		// Normally, use the dev script to build.
 		testCommandLine := append(
 			shellPrefix,

eng/_util/cmd/run-builder/run-builder.go

@@ -179,6 +179,8 @@ func main() {
 			buildutil.SetEnv("GO_BUILDER_NAME", goos+"-"+goarch)
 		}
 
+		runOrPanic("go/bin/go", "-C", "toolchaintest", "test", "-count=1")
+
 		cmdline := []string{
 			// Use the dist test command directly, because 'src/run.bash' isn't compatible with
 			// longtest. 'src/run.bash' sets 'GOPATH=/nonexist-gopath', which breaks modconv tests

toolchaintest/README.md

@@ -0,0 +1,21 @@
+# Toolchain Tests
+
+Tests for Microsoft-specific Go toolchain behavior, kept outside the upstream Go patch set. The repository's build and CI test runners run this module alongside the upstream tests.
+
+After [building the toolchain](../eng/doc/DeveloperGuide.md#build-the-go-toolchain), run from this directory:
+
+```sh
+../go/bin/go test -count=1
+```
+
+On Windows, use `..\go\bin\go.exe`.
+
+The CLI tests default to the Go executable in the running test binary's GOROOT. To use a different toolchain, including when running the tests with a bootstrap Go installation:
+
+```sh
+go test -count=1 -go=/path/to/microsoft-go/bin/go
+```
+
+The public `go/build` API tests use the toolchain that compiles the test binary. Run the module with the built Microsoft Go executable to test both APIs and CLI behavior with that toolchain.
+
+The module has no external dependencies. It covers system-crypto build tags, cross-compilation, build information, and FIPS-mode command behavior.

toolchaintest/buildbackend_test.go

@@ -0,0 +1,51 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package toolchaintest
+
+import (
+	"go/build"
+	"reflect"
+	"testing"
+)
+
+// Check that the systemcrypto tag works and collects AllTags correctly.
+// This is based on the TestAllTags test.
+func TestCryptoBackendAllTags(t *testing.T) {
+	ctxt := build.Default
+	// Remove tool tags so these tests behave the same regardless of the
+	// goexperiments that happen to be set during the run.
+	ctxt.ToolTags = []string{}
+	ctxt.GOARCH = "amd64"
+	ctxt.GOOS = "linux"
+	ctxt.BuildTags = []string{"goexperiment.systemcrypto"}
+
+	p, err := ctxt.ImportDir("testdata/backendtags_system", 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"goexperiment.systemcrypto"}
+	if !reflect.DeepEqual(p.AllTags, want) {
+		t.Errorf("AllTags = %v, want %v", p.AllTags, want)
+	}
+	wantFiles := []string{"main.go", "systemcrypto.go"}
+	if !reflect.DeepEqual(p.GoFiles, wantFiles) {
+		t.Errorf("GoFiles = %v, want %v", p.GoFiles, wantFiles)
+	}
+
+	// Test without systemcrypto - only main.go should be included
+	ctxt.BuildTags = []string{}
+	p, err = ctxt.ImportDir("testdata/backendtags_system", 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want = []string{"goexperiment.systemcrypto"}
+	if !reflect.DeepEqual(p.AllTags, want) {
+		t.Errorf("AllTags = %v, want %v", p.AllTags, want)
+	}
+	wantFiles = []string{"main.go"}
+	if !reflect.DeepEqual(p.GoFiles, wantFiles) {
+		t.Errorf("GoFiles = %v, want %v", p.GoFiles, wantFiles)
+	}
+}

toolchaintest/go.mod

@@ -0,0 +1,3 @@
+module github.com/microsoft/go/toolchaintest
+
+go 1.26.0