guix_mirror_bot pushed a commit to branch go-team
in repository guix.
commit 6acf4afa54ffd219befbe7541aecc7849de72ea8
Author: Sharlatan Hellseher <[email protected]>
AuthorDate: Fri Jul 17 09:39:39 2026 +0100
gnu: go-1.26: Update to 1.26.5 [security-fixes].
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages.
See: <https://github.com/golang/go/milestone/439>,
<https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc>.
Contains fixes for:
CVE-2026-39822: os: Root escape via symlink plus trailing slash
CVE-2026-42505: crypto/tls: Encrypted Client Hello privacy leak
* gnu/packages/golang.scm (go-1.26): Update to 1.26.5.
[phases]{remove-testscript-mod_get_fips140_issue73649.txt}: New phase,
remove test script file requiring connection to Internet.
Signed-off-by: Sharlatan Hellseher <[email protected]>
---
gnu/packages/golang.scm | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index 469070e9f6..9940af038f 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -1139,7 +1139,7 @@ in the style of communicating sequential processes
(@dfn{CSP}).")
(package
(inherit go-1.24)
(name "go")
- (version "1.26.4")
+ (version "1.26.5")
(source
(origin
(method git-fetch)
@@ -1148,11 +1148,18 @@ in the style of communicating sequential processes
(@dfn{CSP}).")
(commit (string-append "go" version))))
(file-name (git-file-name name version))
(sha256
- (base32 "143qz6hikkh08gfm9md7r1na8mj404a27a4cidq3zkj6qc54jrm1"))))
+ (base32 "0kip7ak6ablgvpaf20mqy8an9g9y9nyslsf3hbk1z5gmy10789lg"))))
(arguments
(substitute-keyword-arguments arguments
((#:phases phases)
#~(modify-phases #$phases
+ (add-after 'unpack
'remove-testscript-mod_get_fips140_issue73649.txt
+ (lambda _
+ ;; vcs-test.golang.org rerouted to http://127.0.0.1:46381
+ ;; https://vcs-test.golang.org rerouted to
https://127.0.0.1:44403
+ ;; go test proxy running at GOPROXY=http://127.0.0.1:40005/mod
+ ;; 2026/07/17 10:05:01 http: TLS handshake error from
127.0.0.1:33040: EOF
+ (delete-file
"src/cmd/go/testdata/script/mod_get_fips140_issue73649.txt")))
;; There is no real discussion on the issue among humans, a lot
;; of gopherbot updates and it's closed without final resolution.
;; https://github.com/golang/go/issues/73977
