cmd/go: support reproducible builds regardless of build path? #16860

infinity0 · 2016-08-24T10:04:47Z

It would be good if go was able to generate bit-for-bit identical binaries, even if the build environment changes in unimportant ways. (For example, so users can reproduce binaries without requiring root.)

Up until recently, we have been able to reproduce go binaries whilst modifying many parts of the build environment, except that we kept the build-path constant. However recently, we started to also vary the build-path. (Why "recently", is irrelevant to this report, but I can go into it if you ask.)

Anyway, now we can see that .gopclntab embeds the build path into the resulting binary. This patch will get rid of this environment-specific information, but I know it's not perfect:

--- src/cmd/link/internal/ld/pcln.go
+++ src/cmd/link/internal/ld/pcln.go
@@ -41,6 +41,8 @@

 // iteration over encoded pcdata tables.

+var cwd, _ = os.Getwd()
+
 func getvarint(pp *[]byte) uint32 {
    v := uint32(0)
    p := *pp
@@ -152,7 +154,8 @@
            f.Value = int64(ctxt.Nhistfile)
            f.Type = obj.SFILEPATH
            f.Next = ctxt.Filesyms
-           f.Name = expandGoroot(f.Name)
+           //f.Name = expandGoroot(f.Name)
+           f.Name, _ = filepath.Rel(cwd, f.Name)
            ctxt.Filesyms = f
        }
    }

In particular, I'm not sure how this will interfere with readers of this information. I know that src/debug/pclntab.go carries an API for this, but I'm not sure what sorts of contracts you have published for that, that people expect.

Also, the part where I comment out expandGoroot is not strictly necessary for reproducibility, but would allow, e.g. a user to try to reproduce a binary from his own go toolchain - which is some extra assurance that the copies behave the same way.

The call to Getwd during static initialisation is also a bit dirty; I could delay this for later but that may or may not require locks, or pass it in from an parent/ancestor caller but that would require adding extra arguments to some functions.

However if you give me some guidelines on how to make this patch acceptable, I'll be happy to do this work and submit a PR.

The text was updated successfully, but these errors were encountered:

ianlancetaylor · 2016-08-24T14:23:41Z

When you say that you are varying the build path, what do you mean precisely?

This seems like a restatement of #9206.

bradfitz · 2016-08-24T17:01:10Z

Yeah, let's merge conversation in #9206.

@infinity0, instructions for sending a change are at https://golang.org/doc/contribute.html#Code_review which looks like a wall of text, but it's not many actual steps. Be sure to check errors, not have commented-out code, and include tests if possible.

bradfitz · 2016-08-24T18:55:59Z

Reopening, since this is slightly different from #9206.

ianlancetaylor · 2016-08-24T19:48:37Z

Thanks for the explanation (over on #9206). It's not clear to me that this should be a goal. I agree that reproducible builds are essential. However, it's not clear to me that reproducible builds when the sources are in different directories are essential.

For example, exactly the same thing happens when using GCC with the -g option. The source directory is included in the debug info, in the DW_AT_comp_dir attribute.

Not including the source directory will make debugging more difficult.

infinity0 · 2016-08-24T20:06:46Z

For GCC, we are setting -fdebug-prefix-map=$SRC_ROOT=. dynamically for most builds, which removes it from DW_AT_comp_dir. Recently we landed a patch in GCC to make it not embed debug-prefix-map into DW_AT_producer, so this now works to achieve buildpath-independent reproducibility.

Yes, we're being quite strict with ourselves in trying to make things independent of the build path, but we think it's a good goal that would allow more people in practice to perform build verification.

Ideally, we'd want as many people to rebuild the same hash as possible, so that the rest of the world (who we assume don't want to do these rebuilds) can see that 20 people built the same hash, rather than 5 people built 4 different hashes. It is indeed unclear at the moment what the "best tradeoff" is - we're just scratching the surface of this topic ourselves - but this particular issue seemed fairly easy to me to fix.

(edit: more accurate to say SRC_ROOT instead of PWD; we set it once at the start of the build when they happen to be equal)

infinity0 · 2016-08-24T20:11:26Z

Yes, "making debugging more difficult" was also my concern. FWIW, our experiments with GCC did not make things harder to debug (this was by chance, we had to try it out to see it). I can appreciate that Go is different, but if you can explain the details I could also try to think of solutions.

jmikedupont2 · 2016-10-23T13:49:04Z

I think this is important. Debugging is also very important. From what I understand this is the issue of two users with different goroots set. Renaming of a module/forking it to a new repo name would not be supported. So, is the question how to share debug information? How to relate debug information created in one root to another root? If you are in the same root as the debug info was created it would be nice if we could strip out all the stuff outside the root.

whyrusleeping · 2017-03-31T23:33:41Z

Couldnt the paths stored in the binary be somehow prefixed with $GOPATH so that when i'm debugging a binary it uses code in my gopath correctly?

rhysh · 2017-04-01T01:25:25Z

The compiler has a -trimpath flag, which might be close to what you need. When it's set to e.g. $GOPATH/src, the paths included in the binary's debug info will be relative paths with that prefix (and a /) removed. This is handy for use with go tool pprof, which will search for the relevant code in your GOPATH. Other tools might have similar behaviors when the debug info contains relative paths.

Since the -trimpath flag is on the compiler (and assembler), it works by modifying the contents of the .a files (stored in $GOPATH/pkg).

The $GOROOT_FINAL environment variable (currently) controls the path prefix used for debug info of packages within $GOROOT. With these two features combined, a command like env GOROOT_FINAL=/usr/local/go go install -a -gcflags="-trimpath=$GOPATH/src" . (untested) should normalize or remove all file paths in the debug info, assuming that $GOPATH refers to a single directory.

There are at least two other ways that directory names end up in binaries, even with cgo disabled. First, DW_AT_comp_dir, which when I last tested on OSX was set to the current working directory used for the linker command. This may be normalizable by starting with cd / and using fully-qualified paths for the build. Second, the runtime.GOROOT function is backed by a file that's generated by ./src/make.bash. That file contains the value of $GOROOT when make.bash was executed (when the Go toolchain was built). If bit-for-bit reproducible builds are more important to you than the complexity of managing custom $GOROOT settings, that might help too.

These settings combined can get very close to bit-for-bit reproducible builds. The Go toolchain's build id also needs to be constrained, maybe via -ldflags=-buildid=xxx, but I haven't figured out how to make its value be consistent across machines automatically.

To be clear, I don't recommend using these knobs ... unless their value is worth their complexity cost for your application, and you're prepared to own the pieces when it stops working or changes behavior on some future release.

stapelberg · 2017-07-29T09:40:50Z

Thanks for the detailed reply, @rhysh.

We started specifying the -trimpath flag with version 1.22 of our build helper dh-golang (see https://anonscm.debian.org/cgit/pkg-go/packages/dh-golang.git/log/?h=debian/1.22), which just entered Debian unstable. In my tests, the flag worked as expected, but let’s see how it goes… :)

I also prepared a patch which makes cmd/link honor the BUILD_PATH_PREFIX_MAP environment variable (see https://reproducible-builds.org/specs/build-path-prefix-map/ for the spec), eliminating build paths from the DW_AT_comp_dir field and DWARF file tables. I uploaded it to our reproducible builds infrastructure and successfully verified it works on a number of packages.

I’ll send it for review once the merge window opens after the Go 1.9 release. This will at least give us some code to further inform the discussion.

gopherbot · 2017-10-26T09:13:26Z

Change https://golang.org/cl/73291 mentions this issue: cmd/link: apply BUILD_PATH_PREFIX_MAP

rsc · 2017-11-06T16:03:35Z

I think we should look at this for Go 1.11. Updated milestone.

stapelberg · 2017-11-09T17:30:47Z

@rsc Thanks for clarifying over on #22491 and here.

Just to be clear, when you say “we should look at this”, are you saying the Go team will have a look, or would you rely on external contributions?

rsc · 2017-11-09T21:26:25Z

I mean I think the Go team should try to make this happen. If external contributors do the work, that's fine. But if not then the Go team should dedicate time to it. If you're interested, that's great. Please discuss the design here before sending a CL. Thanks.

stapelberg · 2017-11-09T21:45:44Z

I think it’d be better if the Go team spent some time on this, I’m already quite over-subscribed. Just wanted to make sure this doesn’t fall through the cracks. Thanks!

bauerm97 · 2019-03-06T17:54:02Z

@rsc @bcmills Are there any updates here regarding this work? If nobody on the Go team itself has time to get this done, I could take a stab at implementing it as long as I can get some guidance to make sure I'm doing things correctly. Even if there are sub-tasks here that need completion to enable this (such as supporting multiple -trimpath arguments), I'm happy to take a look if you want help.

bcmills · 2019-03-06T22:19:51Z

Last I checked, @rsc was still planning to get to it during the 1.13 cycle.

zx2c4 · 2019-03-07T19:28:13Z

This almost works but then doesn't because of go-build12345/b123/... in the resultant binary.

Make builds reproducible by honoring BUILD_PATH_PREFIX_MAP Upstream has rejected the patch in this form and promised to implement an alternative they are happy with instead. That hasn't happened yet though. Bug: golang/go#22491, golang/go#16860 Forwarded: https://golang.org/cl/73291 (rejected upstream though)

gopherbot · 2019-04-23T04:11:09Z

Change https://golang.org/cl/173345 mentions this issue: cmd/go: add -trimpath build flag

gopherbot · 2019-04-23T04:11:10Z

Change https://golang.org/cl/173344 mentions this issue: cmd/internal/objabi: expand -trimpath syntax

This CL affects the low-level -trimpath flag provided by both cmd/asm and cmd/compile. Previously, the flag took the name of a single directory that would be trimmed from recorded paths in the resulting object file. This CL makes the flag take a semicolon-separated list of paths. Further, each path can now end in an optional "=>replacement" to specify what to replace that leading path prefix with, instead of only dropping it. A followup CL will add a mode to cmd/go that uses this richer -trimpath to build binaries that do not contain any local path names. For #16860. Change-Id: I246811750f37607c7f7a8fbecd56c5475ebe1ea5 Reviewed-on: https://go-review.googlesource.com/c/go/+/173344 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Jay Conrod <jayconrod@google.com>

Make builds reproducible by honoring BUILD_PATH_PREFIX_MAP Upstream has rejected the patch in this form and promised to implement an alternative they are happy with instead. That hasn't happened yet though. Bug: golang/go#22491, golang/go#16860 Forwarded: https://golang.org/cl/73291 (rejected upstream though)

thepudds · 2019-05-08T18:10:12Z

For anyone who wants to try this out, you might need to first do go clean -cache due to #31896.

xinbenlv · 2019-07-04T04:35:05Z

An external issue is relying on this issue:

keybase/client#18260

Make builds reproducible by honoring BUILD_PATH_PREFIX_MAP Upstream has rejected the patch in this form and promised to implement an alternative they are happy with instead. That hasn't happened yet though. Bug: golang/go#22491, golang/go#16860 Forwarded: https://golang.org/cl/73291 (rejected upstream though)

This patch is finally no longer needed with Go 1.13. Upstream has implemented a new flag "-trimpath" for the command "go build" which either strips the path or replaces it in the resulting binaries. References: golang/go#16860 https://go-review.googlesource.com/c/go/+/173345/ https://go-review.googlesource.com/c/go/+/173344/

golang-1.14 (1.14~beta1-1) unstable; urgency=medium * New upstream major version. golang-1.13 (1.13.5-1) unstable; urgency=medium * New upstream version 1.13.5 golang-1.13 (1.13.4-1) unstable; urgency=medium * New upstream version 1.13.4 - Refresh patches golang-1.13 (1.13.3-1) unstable; urgency=medium * New upstream version 1.13.3 - Refresh patch - crypto/dsa: invalid public key causes panic in dsa.Verify. Fixes CVE-2019-17596. Closes: #942628 * Update Standards-Version to 4.4.1, no changes needed golang-1.13 (1.13.1-1) unstable; urgency=medium * New upstream version 1.13.1 - net/textproto: don't normalize headers with spaces before the colon. Fixes CVE-2019-16276. See golang/go#34541 and Debian bug #941173 golang-1.13 (1.13-1) unstable; urgency=medium * New upstream version 1.13 - Refresh patch * Set pristine-tar for gbp to False golang-1.13 (1.13~rc2-1) unstable; urgency=medium * New upstream version 1.13~rc2 - Remove patch for CVE-2019-9512 and CVE-2019-9514, has been applied upstream golang-1.13 (1.13~rc1-2) unstable; urgency=medium * Exclude testdata from dh_makeshlibs. Otherwise, the build fails at least on armel and armhf. * Apply changes from cme fix dpkg * Set Rules-Requires-Root: no golang-1.13 (1.13~rc1-1) unstable; urgency=medium * New upstream version 1.13~rc1 - Remove patch for CVE-2019-14809, has been applied upstream * Use dh_missing instead of deprecated dh_install --fail-missing * Do not run dh_dwz, there is no debugging information * Use debhelper-compat (= 12) golang-1.13 (1.13~beta1-3) unstable; urgency=high * Fix Denial of Service vulnerabilities in the HTTP/2 implementation. golang/go#33631 CVE-2019-9512, CVE-2019-9514. Closes: #934955 * Fix multiple Parsing Issues in URL.Parse golang/go#29098 CVE-2019-14809. Closes: #934954 golang-1.13 (1.13~beta1-2) unstable; urgency=medium * Set GOCACHE to fix a FTBFS. (See bug #933958) golang-1.13 (1.13~beta1-1) unstable; urgency=medium * New upstream major version. - Remove Reproducible-BUILD_PATH_PREFIX_MAP.patch. This patch is finally no longer needed with Go 1.13. Upstream has implemented a new flag "-trimpath" for the command "go build" which either strips the path or replaces it in the resulting binaries. References: golang/go#16860 https://go-review.googlesource.com/c/go/+/173345/ https://go-review.googlesource.com/c/go/+/173344/ - Remove arm64-arm64asm-recognise-new-ssbb-pssbb-mnemonics-fr.patch. This patch has been cherry-picked from upstream and is now included. - Refresh remaining patches - Fix lintian warning: make scripts executable * Switch to debhelper-compat, but stay at v11 for now golang-1.12 (1.12.7-1) unstable; urgency=medium * New upstream version 1.12.7 - Refresh patches * Update Standards-Version to 4.4.0, no changes needed golang-1.12 (1.12.5-1) unstable; urgency=medium * New upstream version 1.12.5 golang-1.12 (1.12.4-1) unstable; urgency=medium [ Anthony Fok ] * Add /usr/lib/go-X.Y/{api,misc} symlinks. For example, programs such as https://github.com/vugu/vugu and documentation such as https://github.com/golang/go/wiki/WebAssembly expect to find wasm_exec.js at "$(go env GOROOT)/misc/wasm/wasm_exec.js". [ Dr. Tobias Quathamer ] * New upstream version 1.12.4 * Add five lintian overrides for false positives golang-1.12 (1.12.1-1) unstable; urgency=medium * New upstream version 1.12.1 * Use upstream signing key for tarball verification golang-1.12 (1.12-1) unstable; urgency=medium * New upstream version 1.12 - Remove patch 0005-Fix-CVE-2019-6486, applied upstream golang-1.12 (1.12~beta2-2) unstable; urgency=medium * Refresh patch Reproducible BUILD_PATH_PREFIX_MAP. Thanks to Michael Stapelberg! * Add patch to fix CVE-2019-6486. (Closes: #920548) golang-1.12 (1.12~beta2-1) unstable; urgency=medium * New upstream version 1.12~beta2 - Remove two patches, applied upstream. Refresh remaining patch. golang-1.12 (1.12~beta1-4) unstable; urgency=medium * Switch watch file to version 4 * Update d/copyright golang-1.12 (1.12~beta1-3) unstable; urgency=medium [ Anthony Fok ] * Add patch "unix: fix Fstatat by using fillStat_t on linux/mips64x" This fixes the "Fstatat: returned stat does not match Stat/Lstat" errors detected by TestFstatat. See https://go-review.googlesource.com/c/sys/+/155747 [ Dr. Tobias Quathamer ] * Add another lintian override golang-1.12 (1.12~beta1-2) unstable; urgency=medium [ Anthony Fok ] * Add patch "cmd/compile: fix MIPS SGTconst-with-shift rules" by Cherry Zhang. This fixes the root problem behind the "slice bounds out of range" build error seen in 1.11.4 on mips and mipsel architectures. See https://go-review.googlesource.com/c/go/+/155798 * Bump Standards-Version to 4.3.0 (no change) [ Dr. Tobias Quathamer ] * Do not compress favicon.ico. Thanks to Dato Simó <dato@debian.org> (Closes: #917132) golang-1.12 (1.12~beta1-1) unstable; urgency=medium * New upstream major version. - Refresh patches - Add new patch to disable test for UserHomeDir * Switch team address to tracker.d.o * Add another lintian override for a false positive golang-1.11 (1.11.4-1) unstable; urgency=medium * New upstream version 1.11.4 * Make lintian override agnostic of golang version golang-1.11 (1.11.3-1) unstable; urgency=medium * New upstream version 1.11.3 - Refresh patches * Update gbp.conf to new style syntax * Suggest brz as alternative to bzr; it provides the same command-line API. * Add myself to Uploaders golang-1.11 (1.11.2-2) unstable; urgency=medium * d/patches/arm64-arm64asm-recognise-new-ssbb-pssbb-mnemonics-fr.patch: backport workaround for objdump's support of newer mnemonics on arm64. golang-1.11 (1.11.2-1) unstable; urgency=medium * Team upload. [ Michael Hudson-Doyle ] * New upstream major version. * Update debhelper compat level to 11. * Remove GOCACHE files after running tests. * Stop dh_strip_nondeterminism from looking at testdata directories. [ Dr. Tobias Quathamer ] * Build-Depend on debhelper v11 * Override two false positive Lintian errors (missing depends on sensible-utils) * Add Lintian overrides for testdata * Include /usr/share/dpkg/architecture.mk for DEB_HOST_ARCH * Refresh patch for new upstream version * Fix Lintian warnings about wrong interpreter path * Make two scripts executable which have been missed by upstream * Remove three unneeded lintian overrides * Use HTTPS URL for d/watch * Update to Standards-Version 4.2.1 - Use HTTPS for d/copyright * Update d/copyright golang-1.10 (1.10.3-1) unstable; urgency=medium * New upstream version 1.10.3 * Restore changelog entry for 1.10.1-3, and fix that for 1.10.2-1, oops. golang-1.10 (1.10.2-1) unstable; urgency=medium * New upstream version 1.10.2. - d/patches/0003-Backport_nopie_fix.patch: removed, now included upstream. - d/patches/0004-Backport_mips_octeon3_fp_fix.patch: removed, also included upstream. golang-1.10 (1.10.1-3) unstable; urgency=high * Team upload. [ Michael Hudson-Doyle ] * Install the 'misc' and 'api' directories as part of the golang-1.10-src package as some tools (vgo, go tool trace) expect them to be there. (Closes: 894992¸ LP: #1743598) [ Martín Ferrari ] * Backport fix for FP bug in mips/Octeon III. Closes: #892088. Raising severity. golang-1.10 (1.10.1-2) unstable; urgency=medium * Team upload. * Backport patch that fixes FTBFS in arm64. * debian/copyright: Update attribution. * debian/source: Update lintian-overrides. golang-1.10 (1.10.1-1) unstable; urgency=medium * New upstream version 1.10.1. * d/patches/0002-reproducible-BUILD_PATH_PREFIX_MAP.patch: update patch tags to reference upstream discussion of this topic. * d/control, d/control.in: Update Vcs-* to point to salsa. golang-1.10 (1.10-1) unstable; urgency=medium * New upstream version 1.10 golang-1.10 (1.10~rc2-1) unstable; urgency=medium * New upstream version, fixing CVE-2018-6574. * d/patches/0001-os-signal-skip-TestTerminalSignal-if-posix_openpt-fa.patch, d/patches/0003-cmd-vendor-github.com-google-pprof-cherry-pick-fix-t.patch, d/patches/0004-cmd-link-internal-loadelf-fix-logic-for-computing-EL.patch: removed, now included upstream. golang-1.10 (1.10~rc1-2) unstable; urgency=medium * d/patches/0004-cmd-link-internal-loadelf-fix-logic-for-computing-EL.patch: Backport from upstream to fix build issues on armhf (causes ftbfs on Ubuntu but not Debian for some reason, but could produce broken binaries on Debian too). golang-1.10 (1.10~rc1-1) unstable; urgency=medium * New upstream version 1.10~rc1. * d/patches/0004-cmd-dist-use-buildmode-pie-for-pie-testing.patch, d/patches/0006-misc-cgo-testcarchive-use-no-pie-where-needed.patch, d/patches/0003-Do-not-use-SP-as-index-reg.patch: removed, included upstream. * d/patches/0002-reproducible-BUILD_PATH_PREFIX_MAP.patch: refreshed. * d/patches/0001-os-signal-skip-TestTerminalSignal-if-posix_openpt-fa.patch: Add to fix test failure in chroot. * d/patches/0003-cmd-vendor-github.com-google-pprof-cherry-pick-fix-t.patch: Add to fix test failure when $HOME is not writable. * d/rules: Set GOCACHE to "off" during build to avoid shipping cache files. golang-1.9 (1.9.2-4) unstable; urgency=medium * Enable building on mips, mipsel and mips64. (Closes: 879764) golang-1.9 (1.9.2-3) unstable; urgency=medium * Remove workaround for now fixed debhelper bug #879762 * Backport three patches from upstream to fix ftbfs on ppc64el with new kernel. golang-1.9 (1.9.2-2) unstable; urgency=medium [ Martín Ferrari ] * Add debian/patches/0003-Do-not-use-SP-as-index-reg.patch (Closes: #877541) golang-1.9 (1.9.2-1) unstable; urgency=medium * New upstream version 1.9.2 * Work around debhelper bug #879762 golang-1.9 (1.9.1-2) unstable; urgency=medium * Update debian/copyright (Closes: #873740) golang-1.9 (1.9.1-1) unstable; urgency=medium * New upstream release. * Use my @debian.org address in Uploaders. golang-1.9 (1.9-1) unstable; urgency=medium [ Michael Hudson-Doyle ] * New upstream release. * Suppress some new lintian errors in golang-1.9-src. [ Michael Stapelberg ] * Add debian/patches/0002-reproducible-BUILD_PATH_PREFIX_MAP.patch golang-1.8 (1.8.3-1) unstable; urgency=medium * New upstream release. (Closes: 863292, 863307) golang-1.8 (1.8.1-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~rc3-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~rc2-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~rc1-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~beta2-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~beta1-1) unstable; urgency=medium * New upstream release. * Remove d/patches/cl-29995--tzdata-2016g.patch, included upstream. golang-1.7 (1.7.4-1) unstable; urgency=medium * Update to 1.7.4 upstream release (Closes: #846545) - https://groups.google.com/d/topic/golang-announce/2lP5z9i9ySY/discussion - https://golang.org/issue/17965 (potential DoS vector in net/http) - golang/go@go1.7.3...go1.7.4 golang-1.7 (1.7.3-1) unstable; urgency=medium * New upstream release. * Delete d/patches/cl-28850.patch, applied upstream. golang-1.7 (1.7.1-3) unstable; urgency=medium * Backport CL 29995 for tzdata 2016g changes (Closes: #839317) golang-1.7 (1.7.1-2) unstable; urgency=medium * Add upstream patch for s390x FTBFS golang-1.7 (1.7.1-1) unstable; urgency=medium * New upstream release. * Re-enable tests on s390x now that gcc-6 has been fixed in unstable. golang-1.7 (1.7-3) unstable; urgency=medium * Add "s390x" to Architectures golang-1.7 (1.7-2) unstable; urgency=medium * Disable tests on armel. golang-1.7 (1.7-1) unstable; urgency=medium * New upstream release. golang-1.7 (1.7~rc4-1) unstable; urgency=medium * New upstream release. golang-1.7 (1.7~rc3-1) unstable; urgency=medium [ Tianon Gravi ] * Remove outdated README files (README.source and README.Debian) [ Michael Hudson-Doyle ] * New upstream release. * Suppress inaccurate source-is-missing lintian warnings. * Update Standards-Version to 3.9.8 (no changes required). golang-1.7 (1.7~rc2-1) unstable; urgency=medium * Update to 1.7rc2 upstream release. golang-1.7 (1.7~rc1-1) unstable; urgency=medium [ Paul Tagliamonte ] * Use a secure transport for the Vcs-Git and Vcs-Browser URL [ Tianon Gravi ] * Update to 1.7rc1 upstream release (new packages, not used by default; see also src:golang-defaults) * Update Vcs-Git to reference a particular branch golang-1.6 (1.6.2-2) unstable; urgency=medium * Update "golang-any" in "Build-Depends" to fallback to "golang-go | gccgo" (will help with backporting) golang-1.6 (1.6.2-1) unstable; urgency=medium * Update to 1.6.2 upstream release (Closes: #825696) * Build-Depend on golang-any instead of golang-go (Closes: #824421) golang-1.6 (1.6.1-1) unstable; urgency=medium * Build golang version-specific packages (Closes: #818415) * Things that (conceptually at least) move to new golang version independent golang-defaults source package: - Man pages. - Suggesting golang-golang-x-tools. - Breaks/Replace-ing of old golang-go-$GOOS-$GOARCH packages. * Stop using alternatives to manage /usr/bin/go. * sed trickery in debian/rules to support easy changes to new golang versions. golang (2:1.6.1-2) unstable; urgency=medium * Don't strip testdata files, causes build failures on some platforms. golang (2:1.6.1-1) unstable; urgency=medium [ Michael Hudson-Doyle ] * Breaks/Replaces: older golang-golang-x-tools, not Conflicts, to ensure smooth upgrades. * Strip the binaries as it has worked for the last five years or so and upstream sees no reason to disable it. [ Tianon Gravi ] * Update to 1.6.1 upstream release (Closes: #820369) - Fix CVE-2016-3959: infinite loop in several big integer routines golang (2:1.6-1) unstable; urgency=medium * Update to 1.6 upstream release (thanks Hilko!) - change "ar" arguments to quiet spurious warnings while using gccgo (Closes: #807138) - skip multicast listen test (Closes: #814849) - skip userns tests when chrooted (Closes: #807303) - use correct ELF header for armhf binaries (Closes: #734357) - Update debian/rules clean for new location of generated file. [ Michael Hudson-Doyle ] * Respect "nocheck" in DEB_BUILD_OPTIONS while building to skip tests (Closes: #807290) * Trim Build-Depends (Closes: #807299) * Fix several minor debian/copyright issues (Closes: #807304) * Remove inconsistently included race-built packages (Closes: #807294) [ Tianon Gravi ] * Add "-k" to "run.bash" invocation so that we do a full test run every time golang (2:1.5.3-1) unstable; urgency=high * Update to 1.5.3 upstream release - Fix CVE-2015-8618: Carry propagation in Int.Exp Montgomery code in math/big library (Closes: #809168) * Add "Breaks" to properly complement our "Replaces" (Closes: #810595) golang (2:1.5.2-1) unstable; urgency=medium * Update to 1.5.2 upstream release (Closes: #807136) golang (2:1.5.1-4) unstable; urgency=medium * Add Conflicts to force newer golang-go.tools too (Closes: #803559) golang (2:1.5.1-3) unstable; urgency=medium * Remove architecture qualification on golang-go Build-Depend now that golang-go is available for more architectures. golang (2:1.5.1-2) unstable; urgency=medium * Add Conflicts to force newer golang-golang-x-tools (Closes: #802945). golang (2:1.5.1-1) unstable; urgency=medium * Upload to unstable. * Update to 1.5.1 upstream release (see notes from experimental uploads for what's changed). * Skip tests on architectures where the tests fail. golang (2:1.4.3-3) unstable; urgency=medium * Fix FTBFS for non-amd64 architectures due to handling of "-race". golang (2:1.5.1-1~exp2) experimental; urgency=medium * Upload to experimental. * Add arch-qualifiers to "golang-go" build-depends to unblock the buildds (Closes: #800479); thanks Tim! golang (2:1.4.3-2) unstable; urgency=medium * Update Recommends/Suggests, especially to add gcc, etc. * Refactor "debian/rules" to utilize debhelper more effectively, especially for arch vs indep building (mostly backported from the 1.5+ changes), which fixes the "arch:all" FTBFS. golang (2:1.5.1-1~exp1) experimental; urgency=low * Upload to experimental. * Update to 1.5.1 upstream release (Closes: #796150). - Compiler and runtime written entirely in Go. - Concurrent garbage collector. - GOMAXPROCS=runtime.NumCPU() by default. - "internal" packages for all, not just core. - Experimental "vendoring" support. - Cross-compilation no longer requires a complete rebuild of the stdlib in GOROOT, and thus the golang-go-GOHOST-GOARCH packages are removed. * Sync debian/copyright with the Ubuntu delta. (thanks doko!) * Remove patches that no longer apply. * Add more supported arches to "debian/rules" code for detecting appropriate GOARCH/GOHOSTARCH values; thanks mwhudson and tpot! (Closes: #799907) * Refactor "debian/rules" to utilize debhelper more effectively, especially for arch vs indep building. * Move "dpkg-architecture" to "GOOS"/"GOARCH" code into a simple shell script for easier maintenance. golang (2:1.4.3-1) unstable; urgency=medium * New upstream version (https://golang.org/doc/devel/release.html#go1.4.minor) - includes previous CVE and non-CVE security fixes, especially TEMP-0000000-1C4729 golang (2:1.4.2-4) unstable; urgency=high * Apply backported CVE fixes (Closes: #795106). - CVE-2015-5739: Invalid headers are parsed as valid headers - CVE-2015-5740: RFC 7230 3.3.3 4 violation - CVE-2015-5741: other discoveries of security-relevant RFC 7230 violations golang (2:1.4.2-3) unstable; urgency=medium * Add missing "prerm" for our new alternatives (thanks piuparts). golang (2:1.4.2-2) unstable; urgency=medium * Move "go" and "gofmt" into "/usr/lib/go" and use alternatives to provide appropriate symlinks (Closes: #779503, #782301). * Relax "golang-go.tools" relationship to Suggests (from Recommends). * Add "go get" VCS options to Suggests for golang-go (bzr, git, mercurial, subversion). golang (2:1.4.2-1) unstable; urgency=medium * New upstream version (https://golang.org/doc/devel/release.html#go1.4.minor) golang (2:1.4.1-1~exp1) experimental; urgency=low * New upstream version (https://golang.org/doc/go1.4) - all editor support files have been removed from misc/ upstream upstream, so golang-mode, kate-syntax-go, and vim-syntax-go can no longer be provided; see https://github.com/golang/go/wiki/IDEsAndTextEditorPlugins for an upstream-maintained list of potential replacements golang (2:1.3.3-1) unstable; urgency=medium * New upstream version (https://code.google.com/p/go/source/list?name=go1.3.3) - time: removed from tests now obsolete assumption about Australian tz abbreviations - net: temporarily skip TestAcceptIgnoreSomeErrors - runtime: hide cgocallback_gofunc calling cgocallbackg from linker - runtime: fix GOTRACEBACK reading on Windows, Plan 9 - nacltest.bash: unset GOROOT - cmd/5l, cmd/6l, cmd/8l: fix nacl binary corruption bug * Add Paul and myself as uploaders. Many, many thanks to Michael for his work so far on this package (and hopefully more to come). golang (2:1.3.2-1) unstable; urgency=medium * New upstream version golang (2:1.3.1-1) unstable; urgency=medium * New upstream version golang (2:1.3-4) unstable; urgency=medium [ Tianon Gravi ] * update debian/watch for upstream's latest move (Closes: #756415) * backport archive/tar patch to fix PAX headers (Closes: #756416) golang (2:1.3-3) unstable; urgency=medium * don’t depend on emacs23, depend on emacs instead (Closes: #754013) * install include/ in golang-src, VERSION in golang-go (Closes: #693186) golang (2:1.3-2) unstable; urgency=medium * Add /usr/lib/go/test symlink * Build with GO386=387 to favor the 387 floating point unit over sse2 instructions (Closes: #753160) * Add debian/patches/0001-backport-delete-whole-line.patch to fix a deprecation warning about flet in the emacs part of golang-mode (Closes: #753607) * Migrate to emacsen >2 (Closes: #753607) * Backport two patches to improve archive/tar performance (for docker): debian/patches/0002-archive-tar-reuse-temporary-buffer-in-writeHeader.patch debian/patches/0003-archive-tar-reuse-temporary-buffer-in-readHeader.patch golang (2:1.3-1) unstable; urgency=medium * New upstream version. * Drop patches merged upstream: - debian/patches/add-tar-xattr-support.patch - debian/patches/add-tar-xattr-support.patch * Fix debian/watch (Thanks Tianon) (Closes: #748290) * Remove dangling symlink /usr/lib/go/lib/godoc (Closes: #747968) golang (2:1.2.1-2) unstable; urgency=low * Re-apply debian/patches/add-tar-xattr-support.patch which got lost when uploading 1.2.1-1; sorry about that. golang (2:1.2.1-1) unstable; urgency=low * New upstream release. golang (2:1.2-3) unstable; urgency=low * add debian/patches/add-tar-xattr-support.patch to have xattr support in tar (cherry-picked from upstream) (Thanks proppy) (Closes: #739586) golang (2:1.2-2) unstable; urgency=low * add patches/add-src-pkg-debug-elf-testdata-hello.patch to provide source for the testdata/ ELF binaries (Closes: #716853) golang (2:1.2-1) unstable; urgency=low * New upstream release. * drop patches/archive-tar-fix-links-and-pax.patch, it is merged upstream * godoc(1) is now in the Debian package golang-go.tools, it was moved into a separate repository by upstream. * move patches/godoc-symlinks.diff to golang-go.tools golang (2:1.1.2-3) unstable; urgency=low * cherry-pick upstream commit: archive-tar-fix-links-and-pax.patch (Closes: #730566) golang (2:1.1.2-2) unstable; urgency=low * Build golang-go-linux-* for each architecture (Thanks James Page) (Closes: #719611) * Update lintian-overrides to override statically-linked-binary and unstripped-binary-or-object for all of golang-go golang (2:1.1.2-1) unstable; urgency=low * New upstream release. * Relicense debian/ under the Go license to match upstream. All copyright holders agreed to this. (Closes: #716907) * golang-mode: don’t install for a number of emacs versions which are not supported upstream (Thanks Kevin Ryde) (Closes: #702511, #717521) golang (2:1.1.1-4) unstable; urgency=low * Disable stripping, it breaks go binaries on some architectures. This drops the golang-dbg package which would be empty now. (Thanks Robie Basak) (Closes: #717172) golang (2:1.1.1-3) unstable; urgency=low * Ship */runtime/cgo.a in golang-go to ensure it is present. It can only be used on the native architecture anyway (cannot be used when cross-compiling), so having it in golang-go-$GOOS-$GOARCH is not necessary. Even worse, since these packages are arch: all, they will be built precisely once, and only the runtime/cgo.a for the buildd’s native arch will be present. (Closes: #715025) golang (2:1.1.1-2) unstable; urgency=low [ James Page ] * Ensure smooth upgrade path from << 2:1.1-2 (Closes: #714838) golang (2:1.1.1-1) unstable; urgency=low * Imported Upstream version 1.1.1 golang (2:1.1-2) unstable; urgency=low [ Ondřej Surý ] * Promote Michael to Maintainer [ Michael Stapelberg ] * Build golang-go-$GOOS-$GOARCH packages for cross-compiling (Closes: #710090) * Build race detector on linux/amd64 (only supported arch) (Closes: #710691) * Switch compression to xz (50% smaller binaries) golang (2:1.1-1) unstable; urgency=low * New upstream release: Go 1.1! * Remove the long obsolete goinstall debconf question and config file. goinstall does not exist anymore since a long time. This also obsoletes the need for any translations (Closes: #685923, #692478) * Emacs go-mode auto-mode-alist entry was fixed upstream (Closes: #670371) golang (2:1.1~hg20130405-1) experimental; urgency=low * Provide a new hg tip snapshot. This includes what was recently released as Go 1.1 beta. golang (2:1.1~hg20130323-1) experimental; urgency=low * Provide a new hg tip snapshot. * Add debian/watch (Closes: #699698) golang (2:1.1~hg20130304-2) experimental; urgency=low * Fix FTBFS of binary-arch only builds (as performed by buildds) caused by 'rm' not finding jquery.js in golang-doc (Thanks Peter Green) golang (2:1.1~hg20130304-1) experimental; urgency=low * Provide a hg tip snapshot (2013-03-04) in Debian experimental. Current hg tip is a good approximation to Go 1.1 and should get some testing within Debian in order to package Go 1.1 well when it is released. Thanks to Andrew Gerrand. golang (2:1.0.2-2) unstable; urgency=low * Add myself to uploaders, as discussed in #683421. * cherry-pick r820ffde8c396 (net/http: non-keepalive connections close successfully) (Closes: #683421) golang (2:1.0.2-1.1) unstable; urgency=low * Non-maintainer upload. (as discussed with Ondřej in #679692) * Fix godoc-symlinks.diff (godoc didn’t find docs) (Closes: #679692) golang (2:1.0.2-1) unstable; urgency=low [ Ondřej Surý ] * Imported Upstream version 1.0.2 * Update Vcs fields to reflect new git repository location * Kill get-orig-source, since 1.0.0, the tarballs can be downloaded from webpage [ Michael Stapelberg ] * golang-mode: use debian-pkg-add-load-path-item (Closes: #664802) * add manpages (Closes: #632964) * Use updated pt.po from Pedro Ribeiro (Closes: #674958) golang (2:1.0.1-1) unstable; urgency=low * Imported Upstream version 1.0.1 * Apply godoc patch to display package list correctly (Closes: #669354) golang (2:1-6) unstable; urgency=low * Merge upstream patch to fix homedir issue (http://code.google.com/p/go/source/detail?r=709120aecee0) * Disable GNU/KFreeBSD build (Closes: #668794) golang (2:1-5) unstable; urgency=low * Rewrite test conditions to make them more readable (and fix the debian/rules to really not check on armel+kfreebsd) * Patch upstream test to not fail on missing home directory golang (2:1-4) unstable; urgency=low * Disable tests on Debian GNU/KFreeBSD, they just hang now (Closes: #668794) * Disable tests on armel, but the invalid instruction needs fixing in upstream * Create fake home directory to pass the os/user test golang (2:1-3) unstable; urgency=high * Use VERSION provided by upstream for packaging purposes * Run tests as a part of a build process * Install full src tree (except pkg/debug) because go command depend on sources available * Install sources without testdata and *_test.go * Remove circular dependency golang-go->golang-doc->golang-go * Make sure that timestamp on installed binaries and libraries is same because go build/install recompiles everything if the go binary has more recent timestamp than libraries (Closes: #668235) + Need to update timestamps at postinst time because already created directories can have time in the past * Fix couple of lintian errors and warnings golang (2:1-2) unstable; urgency=low * Remove preserving of old -tools settings, there are too many options now anyway (Closes: #666007) golang (2:1-1) unstable; urgency=low * New major upstream release Go 1 (Closes: #666942) * Bumb epoch to 2, since 1 < 60 < 2011 (I wonder if next version will be 0 :) * Debconf templates and debian/control reviewed by the debian-l10n- english team as part of the Smith review project. (Closes: #663181) * [Debconf translation updates] + Pick existing translations from golang-weekly and do appropriate sed magic to fit golang templates. (Closes: #666884, #666880, #666881) + Dutch; (Jeroen Schot). (Closes: #664598) + Czech (Michal Simunek). (Closes: #665385) + Spanish; (Camaleón). (Closes: #666177) + Danish (Joe Hansen). (Closes: #666526) golang (1:60.3-2) unstable; urgency=low * debconf-gettextize package templates golang (1:60.3-1) unstable; urgency=low * Imported Upstream version 60.3 golang (1:60.2-1) unstable; urgency=low * Imported Upstream version 60.2 golang (1:60.1-1) unstable; urgency=low * Imported Upstream version 60.1 golang (1:60-1) unstable; urgency=low * Imported Upstream version 60 * Save upstream VERSION to the archive * Use GOVERSION as generated by src/version.bash on hg archive time * Add support for goinstall dashboard debconf question in the Debian packaging * Read goinstall dashboard option from debian configuration file * Remove 005-goinstall_dont_call_home_by_default.patch; replaced by configuration option * Fix directory name for upstream archive checkout golang (1:59-1) unstable; urgency=low * Imported Upstream version 59 * Refresh patches to a new release * Fix FTBFS on ARM (Closes: #634270) * Update version.bash to work with Debian packaging and not hg repository golang (1:58.1-2) unstable; urgency=low * Install golang-doc package by default (Recommends from golang-tools, Depends from golang) golang (1:58.1-1) unstable; urgency=low * Imported Upstream version 58.1 golang (1:58-1) unstable; urgency=low * Imported Upstream version 58 + Add NEWS file with upstream API changes * Remove patch to not update standard package, fixed in upstream golang (1:57.2-1) unstable; urgency=low * Imported Upstream version 57.2 * More spelling fixes (Closes: #630660) golang (1:57.1-4) unstable; urgency=low * Description update to have proper articles and capitalization (Closes: #630189) * Add extended description about Go being experimental and that the languager can change between releases golang (1:57.1-3) unstable; urgency=low * Fix "the Google's Go implementation" in extended description (Closes: #627814) * Update Vcs-* links * Install vim ftplugin files into correct directory (Closes: #629844) golang (1:57.1-2) unstable; urgency=low * Bump standards version to 3.9.2 * Capitalize Kate (Closes: #627036) * Import slightly modified patch to be more clear about $GOPATH installs for non-root users * Remove don't install deps patch from goinstall; deprecated by $GOPATH installs golang (1:57.1-1) unstable; urgency=low * Add support for dot-minor releases * Imported Upstream version 57.1 golang (1:57-3) unstable; urgency=low [ Florian Weimer ] * golang-tools: install gofix binary [ Ondřej Surý ] * Add lintian-overrides for gofix binary golang (1:57-2) unstable; urgency=low * Remove weekly code from debian/rules * Add golang meta-package * Don't create tool chain symlinks twice * Make debian/rules more generic for simpler sync between weekly and release branches golang (1:57-1) unstable; urgency=low * Imported Upstream version r57 * Bumped epoch version to 1, to convert from date based versions to release number based version * Allow release to migrate to testing (Closes: #624408) * Add kate and vim syntax highlighting (Closes: #624544) * Add -dbg package with debugging symbols golang (2011.04.27-2) unstable; urgency=low * Fix yet another build failure on kfreebsd (use linux userspace) golang (2011.04.27-1) unstable; urgency=low * Imported Upstream version 2011.04.27 * Update debian/rules to allow pulling weekly upstream releases * Don't remove RUNPATH from binaries; fixed upstream (golang#1527) * Set GOHOSTOS and GOHOSTARCH to match dpkg-architecture variables * Add support for kfreebsd-i386, kfreebsd-amd64, armel and armhf architectures + 006-fix_kfreebsd_build.patch: - Add GNU/KFreeBSD support by replacing all uname calls by $(GOOS) + 007-use_native_dynamic_linker_on_kfreebsd.patch: - Use native kfreebsd dynamic linker (/lib/ld-*.so.1) * Add information about available architectures (Closes: #623877) * Don't strip gotest * Add Depends: golang-go to golang-tools * Add better support for armhf golang (2011.04.13-1) unstable; urgency=low [ Florian Weimer ] * Delete bin directory in clean target * Enable parallel build * golang-src: install source files directly * Use proper symlink targets for architecture-independent toolchain names * Emacs mode: indent keys in struct literals properly [ Ondřej Surý ] * Imported Upstream weekly version 2011.04.13 * Update patches to new weekly release * Add lintian-override for gotest binary golang (2011.03.07.1-1) unstable; urgency=low * Imported Upstream version 2011.03.07.1 * Install to /usr/lib/go * Remove xkcd strip to get rid of CC-NC-BY * Update golang-src.install to new upstream * Remove 002-use_GOROOT_FINAL_in_generated_binaries.patch; merged upstream * Make all .go files no-executable * Update lintian-overrides to include both types of syntax golang (2011.02.15-2) unstable; urgency=low [ Ondřej Surý ] * Add ${misc:Depends} to golang-mode to shutup lintian * Rehaul build system and add golang-src package with .go source files * goinstall: do not automatically install prerequisities * goinstall: don't report to dashboard by default * Add a README.Debian about local modifications to goinstall * Add warning about local modifications also directly to goinstall command [ Florian Weimer ] * Fix syntax error in 004- dont_reinstall_dependencies_in_goinstall.patch golang (2011.02.15-1) unstable; urgency=low [ Obey Arthur Liu ] * Added pkg-google git repo to control file [ Florian Weimer ] * Build golang-mode package [ Ondřej Surý ] * Imported Upstream version 2011.02.15 * Don't compress godoc documentation * Correctly use $GOROOT_FINAL in the build chain * Remove RPATH/RUNPATH from go binaries golang (2011.02.01.1-1) unstable; urgency=low [ Ivan Wong ] * Initial release (Closes: #574371) [ Jonathan Nieder ] * Fill out copyright file * Rewrite debian/rules using dh driver * debian: fix get-orig-source rule * debian: do not install extra files on repeated build * debian: fix reversed ‘if’ * debian: do not leave around stale debian/env.sh+ file * debian: Build-Depends on awk instead of gawk * debian: add run-time dependency on perl * debian: add build-time dependency on perl * debian: fix setting of GOARM on arm * debian: do not compress files in web page * debian: install favicon [ Ondřej Surý ] * Make myself a maintainer * Add patch to allow IPv4 on IPv6 sockets (Courtesy of Florian Weimer) * Use GOROOT_FINAL and change GOBIN to /usr/bin * Get rid of env.sh and wrappers * Add support for building in i386 pbuilder on amd64 architecture * Rename source package to golang to match upstream repository name * Add golang-doc package * Split package into compiler, docs and tools * Don't install quietgcc and hgpatch * Don't generate fake gomake * Update golang-doc package * Export GOHOSTARCH and GOHOSTOS * Disable build time checks * Fail on missed installed files * Revert s{tmp{golang-go{ change in DESTDIR * Relicence debian/ files from versionless GPL to GPL-3 * Move golang-doc to doc section * Add more lintian overrides for Go binaries * Install all 6,8,5 variants of commands * Install golang-* symlinks for 6,8,5* commands * Don't strip govet as well * Remove ${shlibs:Depends} where it doesn't belong * Move more html files to golang-doc package * Remove codereview directory - some python code to deal with mercurial

golang-1.14 (1.14~beta1-2) unstable; urgency=medium * Source-only upload. * Add two more lintian overrides for testdata golang-1.14 (1.14~beta1-1) unstable; urgency=medium * New upstream major version. golang-1.13 (1.13.5-1) unstable; urgency=medium * New upstream version 1.13.5 golang-1.13 (1.13.4-1) unstable; urgency=medium * New upstream version 1.13.4 - Refresh patches golang-1.13 (1.13.3-1) unstable; urgency=medium * New upstream version 1.13.3 - Refresh patch - crypto/dsa: invalid public key causes panic in dsa.Verify. Fixes CVE-2019-17596. Closes: #942628 * Update Standards-Version to 4.4.1, no changes needed golang-1.13 (1.13.1-1) unstable; urgency=medium * New upstream version 1.13.1 - net/textproto: don't normalize headers with spaces before the colon. Fixes CVE-2019-16276. See golang/go#34541 and Debian bug #941173 golang-1.13 (1.13-1) unstable; urgency=medium * New upstream version 1.13 - Refresh patch * Set pristine-tar for gbp to False golang-1.13 (1.13~rc2-1) unstable; urgency=medium * New upstream version 1.13~rc2 - Remove patch for CVE-2019-9512 and CVE-2019-9514, has been applied upstream golang-1.13 (1.13~rc1-2) unstable; urgency=medium * Exclude testdata from dh_makeshlibs. Otherwise, the build fails at least on armel and armhf. * Apply changes from cme fix dpkg * Set Rules-Requires-Root: no golang-1.13 (1.13~rc1-1) unstable; urgency=medium * New upstream version 1.13~rc1 - Remove patch for CVE-2019-14809, has been applied upstream * Use dh_missing instead of deprecated dh_install --fail-missing * Do not run dh_dwz, there is no debugging information * Use debhelper-compat (= 12) golang-1.13 (1.13~beta1-3) unstable; urgency=high * Fix Denial of Service vulnerabilities in the HTTP/2 implementation. golang/go#33631 CVE-2019-9512, CVE-2019-9514. Closes: #934955 * Fix multiple Parsing Issues in URL.Parse golang/go#29098 CVE-2019-14809. Closes: #934954 golang-1.13 (1.13~beta1-2) unstable; urgency=medium * Set GOCACHE to fix a FTBFS. (See bug #933958) golang-1.13 (1.13~beta1-1) unstable; urgency=medium * New upstream major version. - Remove Reproducible-BUILD_PATH_PREFIX_MAP.patch. This patch is finally no longer needed with Go 1.13. Upstream has implemented a new flag "-trimpath" for the command "go build" which either strips the path or replaces it in the resulting binaries. References: golang/go#16860 https://go-review.googlesource.com/c/go/+/173345/ https://go-review.googlesource.com/c/go/+/173344/ - Remove arm64-arm64asm-recognise-new-ssbb-pssbb-mnemonics-fr.patch. This patch has been cherry-picked from upstream and is now included. - Refresh remaining patches - Fix lintian warning: make scripts executable * Switch to debhelper-compat, but stay at v11 for now golang-1.12 (1.12.7-1) unstable; urgency=medium * New upstream version 1.12.7 - Refresh patches * Update Standards-Version to 4.4.0, no changes needed golang-1.12 (1.12.5-1) unstable; urgency=medium * New upstream version 1.12.5 golang-1.12 (1.12.4-1) unstable; urgency=medium [ Anthony Fok ] * Add /usr/lib/go-X.Y/{api,misc} symlinks. For example, programs such as https://github.com/vugu/vugu and documentation such as https://github.com/golang/go/wiki/WebAssembly expect to find wasm_exec.js at "$(go env GOROOT)/misc/wasm/wasm_exec.js". [ Dr. Tobias Quathamer ] * New upstream version 1.12.4 * Add five lintian overrides for false positives golang-1.12 (1.12.1-1) unstable; urgency=medium * New upstream version 1.12.1 * Use upstream signing key for tarball verification golang-1.12 (1.12-1) unstable; urgency=medium * New upstream version 1.12 - Remove patch 0005-Fix-CVE-2019-6486, applied upstream golang-1.12 (1.12~beta2-2) unstable; urgency=medium * Refresh patch Reproducible BUILD_PATH_PREFIX_MAP. Thanks to Michael Stapelberg! * Add patch to fix CVE-2019-6486. (Closes: #920548) golang-1.12 (1.12~beta2-1) unstable; urgency=medium * New upstream version 1.12~beta2 - Remove two patches, applied upstream. Refresh remaining patch. golang-1.12 (1.12~beta1-4) unstable; urgency=medium * Switch watch file to version 4 * Update d/copyright golang-1.12 (1.12~beta1-3) unstable; urgency=medium [ Anthony Fok ] * Add patch "unix: fix Fstatat by using fillStat_t on linux/mips64x" This fixes the "Fstatat: returned stat does not match Stat/Lstat" errors detected by TestFstatat. See https://go-review.googlesource.com/c/sys/+/155747 [ Dr. Tobias Quathamer ] * Add another lintian override golang-1.12 (1.12~beta1-2) unstable; urgency=medium [ Anthony Fok ] * Add patch "cmd/compile: fix MIPS SGTconst-with-shift rules" by Cherry Zhang. This fixes the root problem behind the "slice bounds out of range" build error seen in 1.11.4 on mips and mipsel architectures. See https://go-review.googlesource.com/c/go/+/155798 * Bump Standards-Version to 4.3.0 (no change) [ Dr. Tobias Quathamer ] * Do not compress favicon.ico. Thanks to Dato Simó <dato@debian.org> (Closes: #917132) golang-1.12 (1.12~beta1-1) unstable; urgency=medium * New upstream major version. - Refresh patches - Add new patch to disable test for UserHomeDir * Switch team address to tracker.d.o * Add another lintian override for a false positive golang-1.11 (1.11.4-1) unstable; urgency=medium * New upstream version 1.11.4 * Make lintian override agnostic of golang version golang-1.11 (1.11.3-1) unstable; urgency=medium * New upstream version 1.11.3 - Refresh patches * Update gbp.conf to new style syntax * Suggest brz as alternative to bzr; it provides the same command-line API. * Add myself to Uploaders golang-1.11 (1.11.2-2) unstable; urgency=medium * d/patches/arm64-arm64asm-recognise-new-ssbb-pssbb-mnemonics-fr.patch: backport workaround for objdump's support of newer mnemonics on arm64. golang-1.11 (1.11.2-1) unstable; urgency=medium * Team upload. [ Michael Hudson-Doyle ] * New upstream major version. * Update debhelper compat level to 11. * Remove GOCACHE files after running tests. * Stop dh_strip_nondeterminism from looking at testdata directories. [ Dr. Tobias Quathamer ] * Build-Depend on debhelper v11 * Override two false positive Lintian errors (missing depends on sensible-utils) * Add Lintian overrides for testdata * Include /usr/share/dpkg/architecture.mk for DEB_HOST_ARCH * Refresh patch for new upstream version * Fix Lintian warnings about wrong interpreter path * Make two scripts executable which have been missed by upstream * Remove three unneeded lintian overrides * Use HTTPS URL for d/watch * Update to Standards-Version 4.2.1 - Use HTTPS for d/copyright * Update d/copyright golang-1.10 (1.10.3-1) unstable; urgency=medium * New upstream version 1.10.3 * Restore changelog entry for 1.10.1-3, and fix that for 1.10.2-1, oops. golang-1.10 (1.10.2-1) unstable; urgency=medium * New upstream version 1.10.2. - d/patches/0003-Backport_nopie_fix.patch: removed, now included upstream. - d/patches/0004-Backport_mips_octeon3_fp_fix.patch: removed, also included upstream. golang-1.10 (1.10.1-3) unstable; urgency=high * Team upload. [ Michael Hudson-Doyle ] * Install the 'misc' and 'api' directories as part of the golang-1.10-src package as some tools (vgo, go tool trace) expect them to be there. (Closes: 894992¸ LP: #1743598) [ Martín Ferrari ] * Backport fix for FP bug in mips/Octeon III. Closes: #892088. Raising severity. golang-1.10 (1.10.1-2) unstable; urgency=medium * Team upload. * Backport patch that fixes FTBFS in arm64. * debian/copyright: Update attribution. * debian/source: Update lintian-overrides. golang-1.10 (1.10.1-1) unstable; urgency=medium * New upstream version 1.10.1. * d/patches/0002-reproducible-BUILD_PATH_PREFIX_MAP.patch: update patch tags to reference upstream discussion of this topic. * d/control, d/control.in: Update Vcs-* to point to salsa. golang-1.10 (1.10-1) unstable; urgency=medium * New upstream version 1.10 golang-1.10 (1.10~rc2-1) unstable; urgency=medium * New upstream version, fixing CVE-2018-6574. * d/patches/0001-os-signal-skip-TestTerminalSignal-if-posix_openpt-fa.patch, d/patches/0003-cmd-vendor-github.com-google-pprof-cherry-pick-fix-t.patch, d/patches/0004-cmd-link-internal-loadelf-fix-logic-for-computing-EL.patch: removed, now included upstream. golang-1.10 (1.10~rc1-2) unstable; urgency=medium * d/patches/0004-cmd-link-internal-loadelf-fix-logic-for-computing-EL.patch: Backport from upstream to fix build issues on armhf (causes ftbfs on Ubuntu but not Debian for some reason, but could produce broken binaries on Debian too). golang-1.10 (1.10~rc1-1) unstable; urgency=medium * New upstream version 1.10~rc1. * d/patches/0004-cmd-dist-use-buildmode-pie-for-pie-testing.patch, d/patches/0006-misc-cgo-testcarchive-use-no-pie-where-needed.patch, d/patches/0003-Do-not-use-SP-as-index-reg.patch: removed, included upstream. * d/patches/0002-reproducible-BUILD_PATH_PREFIX_MAP.patch: refreshed. * d/patches/0001-os-signal-skip-TestTerminalSignal-if-posix_openpt-fa.patch: Add to fix test failure in chroot. * d/patches/0003-cmd-vendor-github.com-google-pprof-cherry-pick-fix-t.patch: Add to fix test failure when $HOME is not writable. * d/rules: Set GOCACHE to "off" during build to avoid shipping cache files. golang-1.9 (1.9.2-4) unstable; urgency=medium * Enable building on mips, mipsel and mips64. (Closes: 879764) golang-1.9 (1.9.2-3) unstable; urgency=medium * Remove workaround for now fixed debhelper bug #879762 * Backport three patches from upstream to fix ftbfs on ppc64el with new kernel. golang-1.9 (1.9.2-2) unstable; urgency=medium [ Martín Ferrari ] * Add debian/patches/0003-Do-not-use-SP-as-index-reg.patch (Closes: #877541) golang-1.9 (1.9.2-1) unstable; urgency=medium * New upstream version 1.9.2 * Work around debhelper bug #879762 golang-1.9 (1.9.1-2) unstable; urgency=medium * Update debian/copyright (Closes: #873740) golang-1.9 (1.9.1-1) unstable; urgency=medium * New upstream release. * Use my @debian.org address in Uploaders. golang-1.9 (1.9-1) unstable; urgency=medium [ Michael Hudson-Doyle ] * New upstream release. * Suppress some new lintian errors in golang-1.9-src. [ Michael Stapelberg ] * Add debian/patches/0002-reproducible-BUILD_PATH_PREFIX_MAP.patch golang-1.8 (1.8.3-1) unstable; urgency=medium * New upstream release. (Closes: 863292, 863307) golang-1.8 (1.8.1-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~rc3-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~rc2-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~rc1-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~beta2-1) unstable; urgency=medium * New upstream release. golang-1.8 (1.8~beta1-1) unstable; urgency=medium * New upstream release. * Remove d/patches/cl-29995--tzdata-2016g.patch, included upstream. golang-1.7 (1.7.4-1) unstable; urgency=medium * Update to 1.7.4 upstream release (Closes: #846545) - https://groups.google.com/d/topic/golang-announce/2lP5z9i9ySY/discussion - https://golang.org/issue/17965 (potential DoS vector in net/http) - golang/go@go1.7.3...go1.7.4 golang-1.7 (1.7.3-1) unstable; urgency=medium * New upstream release. * Delete d/patches/cl-28850.patch, applied upstream. golang-1.7 (1.7.1-3) unstable; urgency=medium * Backport CL 29995 for tzdata 2016g changes (Closes: #839317) golang-1.7 (1.7.1-2) unstable; urgency=medium * Add upstream patch for s390x FTBFS golang-1.7 (1.7.1-1) unstable; urgency=medium * New upstream release. * Re-enable tests on s390x now that gcc-6 has been fixed in unstable. golang-1.7 (1.7-3) unstable; urgency=medium * Add "s390x" to Architectures golang-1.7 (1.7-2) unstable; urgency=medium * Disable tests on armel. golang-1.7 (1.7-1) unstable; urgency=medium * New upstream release. golang-1.7 (1.7~rc4-1) unstable; urgency=medium * New upstream release. golang-1.7 (1.7~rc3-1) unstable; urgency=medium [ Tianon Gravi ] * Remove outdated README files (README.source and README.Debian) [ Michael Hudson-Doyle ] * New upstream release. * Suppress inaccurate source-is-missing lintian warnings. * Update Standards-Version to 3.9.8 (no changes required). golang-1.7 (1.7~rc2-1) unstable; urgency=medium * Update to 1.7rc2 upstream release. golang-1.7 (1.7~rc1-1) unstable; urgency=medium [ Paul Tagliamonte ] * Use a secure transport for the Vcs-Git and Vcs-Browser URL [ Tianon Gravi ] * Update to 1.7rc1 upstream release (new packages, not used by default; see also src:golang-defaults) * Update Vcs-Git to reference a particular branch golang-1.6 (1.6.2-2) unstable; urgency=medium * Update "golang-any" in "Build-Depends" to fallback to "golang-go | gccgo" (will help with backporting) golang-1.6 (1.6.2-1) unstable; urgency=medium * Update to 1.6.2 upstream release (Closes: #825696) * Build-Depend on golang-any instead of golang-go (Closes: #824421) golang-1.6 (1.6.1-1) unstable; urgency=medium * Build golang version-specific packages (Closes: #818415) * Things that (conceptually at least) move to new golang version independent golang-defaults source package: - Man pages. - Suggesting golang-golang-x-tools. - Breaks/Replace-ing of old golang-go-$GOOS-$GOARCH packages. * Stop using alternatives to manage /usr/bin/go. * sed trickery in debian/rules to support easy changes to new golang versions. golang (2:1.6.1-2) unstable; urgency=medium * Don't strip testdata files, causes build failures on some platforms. golang (2:1.6.1-1) unstable; urgency=medium [ Michael Hudson-Doyle ] * Breaks/Replaces: older golang-golang-x-tools, not Conflicts, to ensure smooth upgrades. * Strip the binaries as it has worked for the last five years or so and upstream sees no reason to disable it. [ Tianon Gravi ] * Update to 1.6.1 upstream release (Closes: #820369) - Fix CVE-2016-3959: infinite loop in several big integer routines golang (2:1.6-1) unstable; urgency=medium * Update to 1.6 upstream release (thanks Hilko!) - change "ar" arguments to quiet spurious warnings while using gccgo (Closes: #807138) - skip multicast listen test (Closes: #814849) - skip userns tests when chrooted (Closes: #807303) - use correct ELF header for armhf binaries (Closes: #734357) - Update debian/rules clean for new location of generated file. [ Michael Hudson-Doyle ] * Respect "nocheck" in DEB_BUILD_OPTIONS while building to skip tests (Closes: #807290) * Trim Build-Depends (Closes: #807299) * Fix several minor debian/copyright issues (Closes: #807304) * Remove inconsistently included race-built packages (Closes: #807294) [ Tianon Gravi ] * Add "-k" to "run.bash" invocation so that we do a full test run every time golang (2:1.5.3-1) unstable; urgency=high * Update to 1.5.3 upstream release - Fix CVE-2015-8618: Carry propagation in Int.Exp Montgomery code in math/big library (Closes: #809168) * Add "Breaks" to properly complement our "Replaces" (Closes: #810595) golang (2:1.5.2-1) unstable; urgency=medium * Update to 1.5.2 upstream release (Closes: #807136) golang (2:1.5.1-4) unstable; urgency=medium * Add Conflicts to force newer golang-go.tools too (Closes: #803559) golang (2:1.5.1-3) unstable; urgency=medium * Remove architecture qualification on golang-go Build-Depend now that golang-go is available for more architectures. golang (2:1.5.1-2) unstable; urgency=medium * Add Conflicts to force newer golang-golang-x-tools (Closes: #802945). golang (2:1.5.1-1) unstable; urgency=medium * Upload to unstable. * Update to 1.5.1 upstream release (see notes from experimental uploads for what's changed). * Skip tests on architectures where the tests fail. golang (2:1.4.3-3) unstable; urgency=medium * Fix FTBFS for non-amd64 architectures due to handling of "-race". golang (2:1.5.1-1~exp2) experimental; urgency=medium * Upload to experimental. * Add arch-qualifiers to "golang-go" build-depends to unblock the buildds (Closes: #800479); thanks Tim! golang (2:1.4.3-2) unstable; urgency=medium * Update Recommends/Suggests, especially to add gcc, etc. * Refactor "debian/rules" to utilize debhelper more effectively, especially for arch vs indep building (mostly backported from the 1.5+ changes), which fixes the "arch:all" FTBFS. golang (2:1.5.1-1~exp1) experimental; urgency=low * Upload to experimental. * Update to 1.5.1 upstream release (Closes: #796150). - Compiler and runtime written entirely in Go. - Concurrent garbage collector. - GOMAXPROCS=runtime.NumCPU() by default. - "internal" packages for all, not just core. - Experimental "vendoring" support. - Cross-compilation no longer requires a complete rebuild of the stdlib in GOROOT, and thus the golang-go-GOHOST-GOARCH packages are removed. * Sync debian/copyright with the Ubuntu delta. (thanks doko!) * Remove patches that no longer apply. * Add more supported arches to "debian/rules" code for detecting appropriate GOARCH/GOHOSTARCH values; thanks mwhudson and tpot! (Closes: #799907) * Refactor "debian/rules" to utilize debhelper more effectively, especially for arch vs indep building. * Move "dpkg-architecture" to "GOOS"/"GOARCH" code into a simple shell script for easier maintenance. golang (2:1.4.3-1) unstable; urgency=medium * New upstream version (https://golang.org/doc/devel/release.html#go1.4.minor) - includes previous CVE and non-CVE security fixes, especially TEMP-0000000-1C4729 golang (2:1.4.2-4) unstable; urgency=high * Apply backported CVE fixes (Closes: #795106). - CVE-2015-5739: Invalid headers are parsed as valid headers - CVE-2015-5740: RFC 7230 3.3.3 4 violation - CVE-2015-5741: other discoveries of security-relevant RFC 7230 violations golang (2:1.4.2-3) unstable; urgency=medium * Add missing "prerm" for our new alternatives (thanks piuparts). golang (2:1.4.2-2) unstable; urgency=medium * Move "go" and "gofmt" into "/usr/lib/go" and use alternatives to provide appropriate symlinks (Closes: #779503, #782301). * Relax "golang-go.tools" relationship to Suggests (from Recommends). * Add "go get" VCS options to Suggests for golang-go (bzr, git, mercurial, subversion). golang (2:1.4.2-1) unstable; urgency=medium * New upstream version (https://golang.org/doc/devel/release.html#go1.4.minor) golang (2:1.4.1-1~exp1) experimental; urgency=low * New upstream version (https://golang.org/doc/go1.4) - all editor support files have been removed from misc/ upstream upstream, so golang-mode, kate-syntax-go, and vim-syntax-go can no longer be provided; see https://github.com/golang/go/wiki/IDEsAndTextEditorPlugins for an upstream-maintained list of potential replacements golang (2:1.3.3-1) unstable; urgency=medium * New upstream version (https://code.google.com/p/go/source/list?name=go1.3.3) - time: removed from tests now obsolete assumption about Australian tz abbreviations - net: temporarily skip TestAcceptIgnoreSomeErrors - runtime: hide cgocallback_gofunc calling cgocallbackg from linker - runtime: fix GOTRACEBACK reading on Windows, Plan 9 - nacltest.bash: unset GOROOT - cmd/5l, cmd/6l, cmd/8l: fix nacl binary corruption bug * Add Paul and myself as uploaders. Many, many thanks to Michael for his work so far on this package (and hopefully more to come). golang (2:1.3.2-1) unstable; urgency=medium * New upstream version golang (2:1.3.1-1) unstable; urgency=medium * New upstream version golang (2:1.3-4) unstable; urgency=medium [ Tianon Gravi ] * update debian/watch for upstream's latest move (Closes: #756415) * backport archive/tar patch to fix PAX headers (Closes: #756416) golang (2:1.3-3) unstable; urgency=medium * don’t depend on emacs23, depend on emacs instead (Closes: #754013) * install include/ in golang-src, VERSION in golang-go (Closes: #693186) golang (2:1.3-2) unstable; urgency=medium * Add /usr/lib/go/test symlink * Build with GO386=387 to favor the 387 floating point unit over sse2 instructions (Closes: #753160) * Add debian/patches/0001-backport-delete-whole-line.patch to fix a deprecation warning about flet in the emacs part of golang-mode (Closes: #753607) * Migrate to emacsen >2 (Closes: #753607) * Backport two patches to improve archive/tar performance (for docker): debian/patches/0002-archive-tar-reuse-temporary-buffer-in-writeHeader.patch debian/patches/0003-archive-tar-reuse-temporary-buffer-in-readHeader.patch golang (2:1.3-1) unstable; urgency=medium * New upstream version. * Drop patches merged upstream: - debian/patches/add-tar-xattr-support.patch - debian/patches/add-tar-xattr-support.patch * Fix debian/watch (Thanks Tianon) (Closes: #748290) * Remove dangling symlink /usr/lib/go/lib/godoc (Closes: #747968) golang (2:1.2.1-2) unstable; urgency=low * Re-apply debian/patches/add-tar-xattr-support.patch which got lost when uploading 1.2.1-1; sorry about that. golang (2:1.2.1-1) unstable; urgency=low * New upstream release. golang (2:1.2-3) unstable; urgency=low * add debian/patches/add-tar-xattr-support.patch to have xattr support in tar (cherry-picked from upstream) (Thanks proppy) (Closes: #739586) golang (2:1.2-2) unstable; urgency=low * add patches/add-src-pkg-debug-elf-testdata-hello.patch to provide source for the testdata/ ELF binaries (Closes: #716853) golang (2:1.2-1) unstable; urgency=low * New upstream release. * drop patches/archive-tar-fix-links-and-pax.patch, it is merged upstream * godoc(1) is now in the Debian package golang-go.tools, it was moved into a separate repository by upstream. * move patches/godoc-symlinks.diff to golang-go.tools golang (2:1.1.2-3) unstable; urgency=low * cherry-pick upstream commit: archive-tar-fix-links-and-pax.patch (Closes: #730566) golang (2:1.1.2-2) unstable; urgency=low * Build golang-go-linux-* for each architecture (Thanks James Page) (Closes: #719611) * Update lintian-overrides to override statically-linked-binary and unstripped-binary-or-object for all of golang-go golang (2:1.1.2-1) unstable; urgency=low * New upstream release. * Relicense debian/ under the Go license to match upstream. All copyright holders agreed to this. (Closes: #716907) * golang-mode: don’t install for a number of emacs versions which are not supported upstream (Thanks Kevin Ryde) (Closes: #702511, #717521) golang (2:1.1.1-4) unstable; urgency=low * Disable stripping, it breaks go binaries on some architectures. This drops the golang-dbg package which would be empty now. (Thanks Robie Basak) (Closes: #717172) golang (2:1.1.1-3) unstable; urgency=low * Ship */runtime/cgo.a in golang-go to ensure it is present. It can only be used on the native architecture anyway (cannot be used when cross-compiling), so having it in golang-go-$GOOS-$GOARCH is not necessary. Even worse, since these packages are arch: all, they will be built precisely once, and only the runtime/cgo.a for the buildd’s native arch will be present. (Closes: #715025) golang (2:1.1.1-2) unstable; urgency=low [ James Page ] * Ensure smooth upgrade path from << 2:1.1-2 (Closes: #714838) golang (2:1.1.1-1) unstable; urgency=low * Imported Upstream version 1.1.1 golang (2:1.1-2) unstable; urgency=low [ Ondřej Surý ] * Promote Michael to Maintainer [ Michael Stapelberg ] * Build golang-go-$GOOS-$GOARCH packages for cross-compiling (Closes: #710090) * Build race detector on linux/amd64 (only supported arch) (Closes: #710691) * Switch compression to xz (50% smaller binaries) golang (2:1.1-1) unstable; urgency=low * New upstream release: Go 1.1! * Remove the long obsolete goinstall debconf question and config file. goinstall does not exist anymore since a long time. This also obsoletes the need for any translations (Closes: #685923, #692478) * Emacs go-mode auto-mode-alist entry was fixed upstream (Closes: #670371) golang (2:1.1~hg20130405-1) experimental; urgency=low * Provide a new hg tip snapshot. This includes what was recently released as Go 1.1 beta. golang (2:1.1~hg20130323-1) experimental; urgency=low * Provide a new hg tip snapshot. * Add debian/watch (Closes: #699698) golang (2:1.1~hg20130304-2) experimental; urgency=low * Fix FTBFS of binary-arch only builds (as performed by buildds) caused by 'rm' not finding jquery.js in golang-doc (Thanks Peter Green) golang (2:1.1~hg20130304-1) experimental; urgency=low * Provide a hg tip snapshot (2013-03-04) in Debian experimental. Current hg tip is a good approximation to Go 1.1 and should get some testing within Debian in order to package Go 1.1 well when it is released. Thanks to Andrew Gerrand. golang (2:1.0.2-2) unstable; urgency=low * Add myself to uploaders, as discussed in #683421. * cherry-pick r820ffde8c396 (net/http: non-keepalive connections close successfully) (Closes: #683421) golang (2:1.0.2-1.1) unstable; urgency=low * Non-maintainer upload. (as discussed with Ondřej in #679692) * Fix godoc-symlinks.diff (godoc didn’t find docs) (Closes: #679692) golang (2:1.0.2-1) unstable; urgency=low [ Ondřej Surý ] * Imported Upstream version 1.0.2 * Update Vcs fields to reflect new git repository location * Kill get-orig-source, since 1.0.0, the tarballs can be downloaded from webpage [ Michael Stapelberg ] * golang-mode: use debian-pkg-add-load-path-item (Closes: #664802) * add manpages (Closes: #632964) * Use updated pt.po from Pedro Ribeiro (Closes: #674958) golang (2:1.0.1-1) unstable; urgency=low * Imported Upstream version 1.0.1 * Apply godoc patch to display package list correctly (Closes: #669354) golang (2:1-6) unstable; urgency=low * Merge upstream patch to fix homedir issue (http://code.google.com/p/go/source/detail?r=709120aecee0) * Disable GNU/KFreeBSD build (Closes: #668794) golang (2:1-5) unstable; urgency=low * Rewrite test conditions to make them more readable (and fix the debian/rules to really not check on armel+kfreebsd) * Patch upstream test to not fail on missing home directory golang (2:1-4) unstable; urgency=low * Disable tests on Debian GNU/KFreeBSD, they just hang now (Closes: #668794) * Disable tests on armel, but the invalid instruction needs fixing in upstream * Create fake home directory to pass the os/user test golang (2:1-3) unstable; urgency=high * Use VERSION provided by upstream for packaging purposes * Run tests as a part of a build process * Install full src tree (except pkg/debug) because go command depend on sources available * Install sources without testdata and *_test.go * Remove circular dependency golang-go->golang-doc->golang-go * Make sure that timestamp on installed binaries and libraries is same because go build/install recompiles everything if the go binary has more recent timestamp than libraries (Closes: #668235) + Need to update timestamps at postinst time because already created directories can have time in the past * Fix couple of lintian errors and warnings golang (2:1-2) unstable; urgency=low * Remove preserving of old -tools settings, there are too many options now anyway (Closes: #666007) golang (2:1-1) unstable; urgency=low * New major upstream release Go 1 (Closes: #666942) * Bumb epoch to 2, since 1 < 60 < 2011 (I wonder if next version will be 0 :) * Debconf templates and debian/control reviewed by the debian-l10n- english team as part of the Smith review project. (Closes: #663181) * [Debconf translation updates] + Pick existing translations from golang-weekly and do appropriate sed magic to fit golang templates. (Closes: #666884, #666880, #666881) + Dutch; (Jeroen Schot). (Closes: #664598) + Czech (Michal Simunek). (Closes: #665385) + Spanish; (Camaleón). (Closes: #666177) + Danish (Joe Hansen). (Closes: #666526) golang (1:60.3-2) unstable; urgency=low * debconf-gettextize package templates golang (1:60.3-1) unstable; urgency=low * Imported Upstream version 60.3 golang (1:60.2-1) unstable; urgency=low * Imported Upstream version 60.2 golang (1:60.1-1) unstable; urgency=low * Imported Upstream version 60.1 golang (1:60-1) unstable; urgency=low * Imported Upstream version 60 * Save upstream VERSION to the archive * Use GOVERSION as generated by src/version.bash on hg archive time * Add support for goinstall dashboard debconf question in the Debian packaging * Read goinstall dashboard option from debian configuration file * Remove 005-goinstall_dont_call_home_by_default.patch; replaced by configuration option * Fix directory name for upstream archive checkout golang (1:59-1) unstable; urgency=low * Imported Upstream version 59 * Refresh patches to a new release * Fix FTBFS on ARM (Closes: #634270) * Update version.bash to work with Debian packaging and not hg repository golang (1:58.1-2) unstable; urgency=low * Install golang-doc package by default (Recommends from golang-tools, Depends from golang) golang (1:58.1-1) unstable; urgency=low * Imported Upstream version 58.1 golang (1:58-1) unstable; urgency=low * Imported Upstream version 58 + Add NEWS file with upstream API changes * Remove patch to not update standard package, fixed in upstream golang (1:57.2-1) unstable; urgency=low * Imported Upstream version 57.2 * More spelling fixes (Closes: #630660) golang (1:57.1-4) unstable; urgency=low * Description update to have proper articles and capitalization (Closes: #630189) * Add extended description about Go being experimental and that the languager can change between releases golang (1:57.1-3) unstable; urgency=low * Fix "the Google's Go implementation" in extended description (Closes: #627814) * Update Vcs-* links * Install vim ftplugin files into correct directory (Closes: #629844) golang (1:57.1-2) unstable; urgency=low * Bump standards version to 3.9.2 * Capitalize Kate (Closes: #627036) * Import slightly modified patch to be more clear about $GOPATH installs for non-root users * Remove don't install deps patch from goinstall; deprecated by $GOPATH installs golang (1:57.1-1) unstable; urgency=low * Add support for dot-minor releases * Imported Upstream version 57.1 golang (1:57-3) unstable; urgency=low [ Florian Weimer ] * golang-tools: install gofix binary [ Ondřej Surý ] * Add lintian-overrides for gofix binary golang (1:57-2) unstable; urgency=low * Remove weekly code from debian/rules * Add golang meta-package * Don't create tool chain symlinks twice * Make debian/rules more generic for simpler sync between weekly and release branches golang (1:57-1) unstable; urgency=low * Imported Upstream version r57 * Bumped epoch version to 1, to convert from date based versions to release number based version * Allow release to migrate to testing (Closes: #624408) * Add kate and vim syntax highlighting (Closes: #624544) * Add -dbg package with debugging symbols golang (2011.04.27-2) unstable; urgency=low * Fix yet another build failure on kfreebsd (use linux userspace) golang (2011.04.27-1) unstable; urgency=low * Imported Upstream version 2011.04.27 * Update debian/rules to allow pulling weekly upstream releases * Don't remove RUNPATH from binaries; fixed upstream (golang#1527) * Set GOHOSTOS and GOHOSTARCH to match dpkg-architecture variables * Add support for kfreebsd-i386, kfreebsd-amd64, armel and armhf architectures + 006-fix_kfreebsd_build.patch: - Add GNU/KFreeBSD support by replacing all uname calls by $(GOOS) + 007-use_native_dynamic_linker_on_kfreebsd.patch: - Use native kfreebsd dynamic linker (/lib/ld-*.so.1) * Add information about available architectures (Closes: #623877) * Don't strip gotest * Add Depends: golang-go to golang-tools * Add better support for armhf golang (2011.04.13-1) unstable; urgency=low [ Florian Weimer ] * Delete bin directory in clean target * Enable parallel build * golang-src: install source files directly * Use proper symlink targets for architecture-independent toolchain names * Emacs mode: indent keys in struct literals properly [ Ondřej Surý ] * Imported Upstream weekly version 2011.04.13 * Update patches to new weekly release * Add lintian-override for gotest binary golang (2011.03.07.1-1) unstable; urgency=low * Imported Upstream version 2011.03.07.1 * Install to /usr/lib/go * Remove xkcd strip to get rid of CC-NC-BY * Update golang-src.install to new upstream * Remove 002-use_GOROOT_FINAL_in_generated_binaries.patch; merged upstream * Make all .go files no-executable * Update lintian-overrides to include both types of syntax golang (2011.02.15-2) unstable; urgency=low [ Ondřej Surý ] * Add ${misc:Depends} to golang-mode to shutup lintian * Rehaul build system and add golang-src package with .go source files * goinstall: do not automatically install prerequisities * goinstall: don't report to dashboard by default * Add a README.Debian about local modifications to goinstall * Add warning about local modifications also directly to goinstall command [ Florian Weimer ] * Fix syntax error in 004- dont_reinstall_dependencies_in_goinstall.patch golang (2011.02.15-1) unstable; urgency=low [ Obey Arthur Liu ] * Added pkg-google git repo to control file [ Florian Weimer ] * Build golang-mode package [ Ondřej Surý ] * Imported Upstream version 2011.02.15 * Don't compress godoc documentation * Correctly use $GOROOT_FINAL in the build chain * Remove RPATH/RUNPATH from go binaries golang (2011.02.01.1-1) unstable; urgency=low [ Ivan Wong ] * Initial release (Closes: #574371) [ Jonathan Nieder ] * Fill out copyright file * Rewrite debian/rules using dh driver * debian: fix get-orig-source rule * debian: do not install extra files on repeated build * debian: fix reversed ‘if’ * debian: do not leave around stale debian/env.sh+ file * debian: Build-Depends on awk instead of gawk * debian: add run-time dependency on perl * debian: add build-time dependency on perl * debian: fix setting of GOARM on arm * debian: do not compress files in web page * debian: install favicon [ Ondřej Surý ] * Make myself a maintainer * Add patch to allow IPv4 on IPv6 sockets (Courtesy of Florian Weimer) * Use GOROOT_FINAL and change GOBIN to /usr/bin * Get rid of env.sh and wrappers * Add support for building in i386 pbuilder on amd64 architecture * Rename source package to golang to match upstream repository name * Add golang-doc package * Split package into compiler, docs and tools * Don't install quietgcc and hgpatch * Don't generate fake gomake * Update golang-doc package * Export GOHOSTARCH and GOHOSTOS * Disable build time checks * Fail on missed installed files * Revert s{tmp{golang-go{ change in DESTDIR * Relicence debian/ files from versionless GPL to GPL-3 * Move golang-doc to doc section * Add more lintian overrides for Go binaries * Install all 6,8,5 variants of commands * Install golang-* symlinks for 6,8,5* commands * Don't strip govet as well * Remove ${shlibs:Depends} where it doesn't belong * Move more html files to golang-doc package * Remove codereview directory - some python code to deal with mercurial

bradfitz closed this as completed Aug 24, 2016

bradfitz mentioned this issue Aug 24, 2016

cmd/go, cmd/cgo: repeatable builds on OS X with external linker #9206

Closed

bradfitz reopened this Aug 24, 2016

bradfitz changed the title ~~Bit-for-bit deterministic / reproducible builds~~ cmd/go: support reproducible builds regardless of build path? Aug 24, 2016

ianlancetaylor assigned neild Aug 24, 2016

ianlancetaylor added this to the Unplanned milestone Aug 24, 2016

Kubuxu mentioned this issue Sep 6, 2016

Provide tarballs for offline-builds ipfs/kubo#3195

Closed

prashanthpai mentioned this issue Jul 4, 2017

Add an RPM specfile gluster/glusterd2#333

Merged

celskeggs mentioned this issue Jul 9, 2017

Make builds reproducible sipb/homeworld#1

Open

bpicode mentioned this issue Oct 14, 2017

Reproducible builds bpicode/fritzctl#93

Closed

3 tasks

juniorz mentioned this issue Oct 25, 2017

Add debian buster docker image for reproducible builds coyim/coyim#457

Merged

stapelberg mentioned this issue Oct 30, 2017

proposal: cmd/link: support BUILD_PATH_PREFIX_MAP for reproducible binaries when built under varying path #22491

Closed

rsc modified the milestones: Unplanned, Go1.11 Nov 6, 2017

ghost mentioned this issue Dec 19, 2017

proposal: runtime, time: add API BuildTimestamp to report an application's build time #23175

Closed

bauerm97 mentioned this issue Mar 4, 2019

cmd/link: ABI hash for package in shared library should not include file path of dependency #30531

Closed

thepudds mentioned this issue Mar 10, 2019

cmd/go: provide cache support for code rewriting tools #29430

Open

costela mentioned this issue Mar 28, 2019

current release builds not easily reproducible costela/wesher#2

Closed

gopherbot closed this as completed in 7469564 Apr 24, 2019

mvdan mentioned this issue May 6, 2019

go build result is different when using dep and go mod #31850

Closed

bcmills mentioned this issue May 7, 2019

plugin: spurious version-mismatch error for packages that differ only in debug information #31278

Open

juhwany mentioned this issue Jun 14, 2019

cmd/go: plugin versions do not match when built within vs. outside a module #31354

Open

chrahunt mentioned this issue Jun 18, 2019

Ensure 'pip wheel' can create .so artifacts deterministically pypa/pip#6505

Closed

cespare mentioned this issue Jun 26, 2019

Proposal: Make built executables deterministic #32782

Closed

dsnet mentioned this issue Aug 21, 2019

cmd/go: working directory affects binaries even with -trimpath #33772

Closed

longsleep mentioned this issue Sep 9, 2019

cmd/go: support reproducible buildid when building with -trimpath #34186

Closed

samuelkarp mentioned this issue Sep 19, 2019

Produce reproducible builds awslabs/amazon-ecr-credential-helper#186

Open

golang locked and limited conversation to collaborators Jul 3, 2020

gopherbot added the FrozenDueToAge label Jul 3, 2020

rsc removed their assignment Jun 23, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cmd/go: support reproducible builds regardless of build path? #16860

cmd/go: support reproducible builds regardless of build path? #16860

infinity0 commented Aug 24, 2016 •

edited

ianlancetaylor commented Aug 24, 2016

bradfitz commented Aug 24, 2016

bradfitz commented Aug 24, 2016

ianlancetaylor commented Aug 24, 2016

infinity0 commented Aug 24, 2016 •

edited

infinity0 commented Aug 24, 2016

jmikedupont2 commented Oct 23, 2016

whyrusleeping commented Mar 31, 2017

rhysh commented Apr 1, 2017

stapelberg commented Jul 29, 2017 •

edited

gopherbot commented Oct 26, 2017

rsc commented Nov 6, 2017

stapelberg commented Nov 9, 2017

rsc commented Nov 9, 2017

stapelberg commented Nov 9, 2017

bauerm97 commented Mar 6, 2019

bcmills commented Mar 6, 2019

zx2c4 commented Mar 7, 2019

gopherbot commented Apr 23, 2019

gopherbot commented Apr 23, 2019

thepudds commented May 8, 2019

xinbenlv commented Jul 4, 2019 •

edited

cmd/go: support reproducible builds regardless of build path? #16860

cmd/go: support reproducible builds regardless of build path? #16860

Comments

infinity0 commented Aug 24, 2016 • edited

ianlancetaylor commented Aug 24, 2016

bradfitz commented Aug 24, 2016

bradfitz commented Aug 24, 2016

ianlancetaylor commented Aug 24, 2016

infinity0 commented Aug 24, 2016 • edited

infinity0 commented Aug 24, 2016

jmikedupont2 commented Oct 23, 2016

whyrusleeping commented Mar 31, 2017

rhysh commented Apr 1, 2017

stapelberg commented Jul 29, 2017 • edited

gopherbot commented Oct 26, 2017

rsc commented Nov 6, 2017

stapelberg commented Nov 9, 2017

rsc commented Nov 9, 2017

stapelberg commented Nov 9, 2017

bauerm97 commented Mar 6, 2019

bcmills commented Mar 6, 2019

zx2c4 commented Mar 7, 2019

gopherbot commented Apr 23, 2019

gopherbot commented Apr 23, 2019

thepudds commented May 8, 2019

xinbenlv commented Jul 4, 2019 • edited

infinity0 commented Aug 24, 2016 •

edited

infinity0 commented Aug 24, 2016 •

edited

stapelberg commented Jul 29, 2017 •

edited

xinbenlv commented Jul 4, 2019 •

edited