Tags: alovn/go

feat(darwin): allow building go1.25.11 on macOS 10.13-11.x

Lower the Mach-O minos/sdk in cmd/link from 12.0.0 to 10.13.0 so the toolchain binary can be loaded on macOS Catalina (10.15) and earlier High Sierra/Sierra, and resolve SecTrustCopyCertificateChain (a 12+ Security.framework API) at runtime via dlopen/dlsym so the binary does not need the symbol at load time. When the symbol is unavailable, crypto/x509 systemVerify falls back to returning a single-element chain containing the leaf certificate.

Files changed:
- src/cmd/link/internal/ld/macho.go
    minos 12.0.0 -> 10.13.0
- src/crypto/x509/internal/macos/security.go
    remove cgo_import_dynamic for SecTrustCopyCertificateChain;
    resolve via dlopenGo/dlsymGo with sync.Once cache
- src/crypto/x509/internal/macos/security.s
    drop x509_SecTrustCopyCertificateChain_trampoline
- src/crypto/x509/internal/macos/dlopen.go   (new)
    dlopenGo / dlsymGo wrappers for libSystem.B.dylib
- src/crypto/x509/internal/macos/dlopen.s   (new)
    trampolines for x509_dlopen / x509_dlsym
- src/crypto/x509/root_darwin.go
    on SecTrustCopyCertificateChain error, build leaf-only chain

Trade-offs:
- Verify().chains[0] in darwin systemVerify is now length 1 (leaf only); intermediate CAs are not returned even though TLS handshakes and the trust decision still use Security.framework. Code that iterates the returned chain will see fewer certificates than on macOS 12+. Use tls.ConnectionState{}.PeerCertificates if the full server-sent chain is required.
- x509.CheckChainForKeyUsage only sees the leaf, so chains that rely on a strict EKU in an intermediate CA will be accepted more liberally than on 12+.

Local-dev only.
See doc/macosx_compat.zh.md, doc/macosx_compat.en.md for full details and verification steps.

feat(darwin): allow building go1.26.4 on macOS 10.13-11.x

Lower the Mach-O minos/sdk in cmd/link from 12.0.0 to 10.13.0 so the toolchain binary can be loaded on macOS Catalina (10.15) and earlier High Sierra/Sierra, and resolve SecTrustCopyCertificateChain (a 12+ Security.framework API) at runtime via dlopen/dlsym so the binary does not need the symbol at load time. When the symbol is unavailable, crypto/x509 systemVerify falls back to returning a single-element chain containing the leaf certificate.

Files changed:
- src/cmd/link/internal/ld/macho.go
    minos 12.0.0 -> 10.13.0
- src/crypto/x509/internal/macos/security.go
    remove cgo_import_dynamic for SecTrustCopyCertificateChain;
    resolve via dlopenGo/dlsymGo with sync.Once cache
- src/crypto/x509/internal/macos/security.s
    drop x509_SecTrustCopyCertificateChain_trampoline
- src/crypto/x509/internal/macos/dlopen.go   (new)
    dlopenGo / dlsymGo wrappers for libSystem.B.dylib
- src/crypto/x509/internal/macos/dlopen.s   (new)
    trampolines for x509_dlopen / x509_dlsym
- src/crypto/x509/root_darwin.go
    on SecTrustCopyCertificateChain error, build leaf-only chain

Trade-offs:
- Verify().chains[0] in darwin systemVerify is now length 1 (leaf only); intermediate CAs are not returned even though TLS handshakes and the trust decision still use Security.framework. Code that iterates the returned chain will see fewer certificates than on macOS 12+. Use tls.ConnectionState{}.PeerCertificates if the full server-sent chain is required.
- x509.CheckChainForKeyUsage only sees the leaf, so chains that rely on a strict EKU in an intermediate CA will be accepted more liberally than on 12+.

Local-dev only.
See doc/macosx_compat.zh.md, doc/macosx_compat.en.md for full details and verification steps.

[release-branch.go1.26] go1.26.4

Change-Id: I1c45ebded2d678b73081c6716a0fdd15a0b1824e
Reviewed-on: https://go-review.googlesource.com/c/go/+/786201
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Mark Freeman <markfreeman@google.com>
Reviewed-by: David Chase <drchase@google.com>

[release-branch.go1.25] go1.25.11

Change-Id: I294bec3e2b7893fc24bcaf8755de77e1afb31fd1
Reviewed-on: https://go-review.googlesource.com/c/go/+/786221
Reviewed-by: David Chase <drchase@google.com>
TryBot-Bypass: Gopher Robot <gobot@golang.org>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Mark Freeman <markfreeman@google.com>