[microsoft/release-branch.go1.21] Update 1.21 branch

eng/_core/buildutil/buildutil.go

@@ -9,6 +9,7 @@ import (
 	"log"
 	"os"
 	"strconv"
+	"strings"
 )
 
 // Retry runs f until it succeeds or the attempt limit is reached.
@@ -91,6 +92,15 @@ func GetEnvOrDefault(varName, defaultValue string) (string, error) {
 // AppendExperimentEnv sets the GOEXPERIMENT env var to the given value, or if GOEXPERIMENT is
 // already set, appends a comma separator and then the given value.
 func AppendExperimentEnv(experiment string) {
+	// If the experiment enables a crypto backend, allow fallback to Go crypto. Go turns off cgo
+	// and/or cross-builds in various situations during the build/tests, so we need to allow for it.
+	if strings.Contains(experiment, "opensslcrypto") ||
+		strings.Contains(experiment, "cngcrypto") ||
+		strings.Contains(experiment, "boringcrypto") ||
+		strings.Contains(experiment, "systemcrypto") {
+
+		experiment += ",allowcryptofallback"
+	}
 	if v, ok := os.LookupEnv("GOEXPERIMENT"); ok {
 		experiment = v + "," + experiment
 	}

eng/_core/cmd/build/build.go

@@ -133,6 +133,10 @@ func build(o *options) error {
 		return err
 	}
 
+	if o.Experiment != "" {
+		buildutil.AppendExperimentEnv(o.Experiment)
+	}
+
 	if !o.SkipBuild {
 		// If we have a stage 0 copy of Go in an env variable (as set by run.ps1), use it in the
 		// build command by setting GOROOT_BOOTSTRAP. The upstream build script "make.bash" uses
@@ -225,17 +229,6 @@ func build(o *options) error {
 			// redirect doesn't cause an issue where tests succeed that should have failed.)
 			testCmd.Stderr = os.Stdout
 
-			if o.Experiment != "" {
-				buildutil.AppendExperimentEnv(o.Experiment)
-				// We aren't able to rebuild Go standard library packages under a crypto experiment,
-				// but "cmd/dist/test.go" will normally do this for local test runs to make sure the
-				// build is clean. The problem is that the build doesn't include cgo, which is
-				// required for some crypto backends. Set this variable specific to Microsoft Go to
-				// indicate that our build is fresh because it's running within our scripts and
-				// doesn't need a rebuild. A patch in the test runner detects this.
-				os.Setenv("GO_MSFT_SCRIPTED_BUILD", "1")
-			}
-
 			return runCmd(testCmd)
 		}
 

patches/0004-Add-OpenSSL-crypto-backend.patch

@@ -189,7 +189,7 @@ index 00000000000000..61ef3fdd90b607
 +var Dec = bbig.Dec
 diff --git a/src/crypto/internal/backend/openssl_linux.go b/src/crypto/internal/backend/openssl_linux.go
 new file mode 100644
-index 00000000000000..34c2b8a90c9526
+index 00000000000000..2c36a07866fd6a
 --- /dev/null
 +++ b/src/crypto/internal/backend/openssl_linux.go
 @@ -0,0 +1,203 @@
@@ -580,29 +580,29 @@ index c83a7272c9f01f..a0548a7f9179c5 100644
  package x509
 
 diff --git a/src/go.mod b/src/go.mod
-index 5ef63d4e3bf7d9..23b1e7323ec50d 100644
+index 25829e17f2dd9e..eb380c5a589cdf 100644
 --- a/src/go.mod
 +++ b/src/go.mod
 @@ -3,6 +3,7 @@ module std
  go 1.21
 
  require (
 +	github.com/microsoft/go-crypto-openssl v0.2.7
- 	golang.org/x/crypto v0.10.0
- 	golang.org/x/net v0.11.1-0.20230613203745-f5464ddb689c
+ 	golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d
+ 	golang.org/x/net v0.12.1-0.20230712162946-57553cbff163
  )
 diff --git a/src/go.sum b/src/go.sum
-index 93d34efbe889f7..a9a97eef7d763d 100644
+index e474b8be318c84..921f8a4a9923cd 100644
 --- a/src/go.sum
 +++ b/src/go.sum
 @@ -1,3 +1,5 @@
 +github.com/microsoft/go-crypto-openssl v0.2.7 h1:NKugDhOzj/ck0xRcATCL2L16B6IqZ/2AaG7b+KFa5aE=
 +github.com/microsoft/go-crypto-openssl v0.2.7/go.mod h1:xOSmQnWz4xvNB2+KQN2g2UUwMG9vqDHBk9nk/NdmyRw=
- golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
- golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
- golang.org/x/net v0.11.1-0.20230613203745-f5464ddb689c h1:icjsA5jFPWsTcuIb/yIeU6mgXRHPQBfo0Lzd1GQmKZI=
+ golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d h1:LiA25/KWKuXfIq5pMIBq1s5hz3HQxhJJSu/SUGlD+SM=
+ golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
+ golang.org/x/net v0.12.1-0.20230712162946-57553cbff163 h1:1EDKNuaCsog7zGLEml1qRuO4gt23jORUQX2f0IKZ860=
 diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
-index 3356154c7d1082..ef79bb8b7b24ca 100644
+index 4e4c0fa9f11f5b..7d32c7c63795d6 100644
 --- a/src/go/build/deps_test.go
 +++ b/src/go/build/deps_test.go
 @@ -425,6 +425,8 @@ var depsRules = `
@@ -683,7 +683,7 @@ index de79140b2d4780..8c3cd998d0e7e1 100644
  	// SystemCrypto enables the OpenSSL or CNG crypto experiment depending on
  	// which one is appropriate on the target GOOS.
 diff --git a/src/os/exec/exec_test.go b/src/os/exec/exec_test.go
-index 67cd446f420e8a..3015409ccb0f09 100644
+index 473f92ba8e43a1..b4df61a7b95c7a 100644
 --- a/src/os/exec/exec_test.go
 +++ b/src/os/exec/exec_test.go
 @@ -14,6 +14,7 @@ import (

patches/0005-Add-CNG-crypto-backend.patch

@@ -48,7 +48,7 @@ Subject: [PATCH] Add CNG crypto backend
  .../goexperiment/exp_cngcrypto_off.go         |   9 +
  src/internal/goexperiment/exp_cngcrypto_on.go |   9 +
  src/internal/goexperiment/flags.go            |   1 +
- 44 files changed, 403 insertions(+), 46 deletions(-)
+ 44 files changed, 402 insertions(+), 44 deletions(-)
  create mode 100644 src/crypto/internal/backend/bbig/big_cng.go
  create mode 100644 src/crypto/internal/backend/cng_windows.go
  create mode 100644 src/internal/goexperiment/exp_cngcrypto_off.go
@@ -167,7 +167,7 @@ index 00000000000000..92623031fd87d0
 +var Dec = bbig.Dec
 diff --git a/src/crypto/internal/backend/cng_windows.go b/src/crypto/internal/backend/cng_windows.go
 new file mode 100644
-index 00000000000000..bea98e0f838b41
+index 00000000000000..1e39e1fb5c8da1
 --- /dev/null
 +++ b/src/crypto/internal/backend/cng_windows.go
 @@ -0,0 +1,207 @@
@@ -379,7 +379,7 @@ index 00000000000000..bea98e0f838b41
 +	return cng.NewPublicKeyECDH(curve, bytes)
 +}
 diff --git a/src/crypto/internal/backend/common.go b/src/crypto/internal/backend/common.go
-index 19f6fc47e4daa3..7df07e9a8379fa 100644
+index efdd080a1b7708..9d7f7b849d6485 100644
 --- a/src/crypto/internal/backend/common.go
 +++ b/src/crypto/internal/backend/common.go
 @@ -5,7 +5,9 @@
@@ -392,7 +392,7 @@ index 19f6fc47e4daa3..7df07e9a8379fa 100644
  	"runtime"
  	"syscall"
  )
-@@ -70,7 +72,11 @@ func hasSuffix(s, t string) bool {
+@@ -67,7 +69,11 @@ func hasSuffix(s, t string) bool {
  // UnreachableExceptTests marks code that should be unreachable
  // when backend is in use. It panics.
  func UnreachableExceptTests() {
@@ -405,7 +405,7 @@ index 19f6fc47e4daa3..7df07e9a8379fa 100644
  		name := runtime_arg0()
  		// If ran on Windows we'd need to allow _test.exe and .test.exe as well.
  		if !hasSuffix(name, "_test") && !hasSuffix(name, ".test") {
-@@ -79,3 +85,28 @@ func UnreachableExceptTests() {
+@@ -76,3 +82,28 @@ func UnreachableExceptTests() {
  		}
  	}
  }
@@ -1024,31 +1024,31 @@ index a0548a7f9179c5..ae6117a1554b7f 100644
  package x509
 
 diff --git a/src/go.mod b/src/go.mod
-index 23b1e7323ec50d..69c746f405d27c 100644
+index eb380c5a589cdf..0453795f7d6119 100644
 --- a/src/go.mod
 +++ b/src/go.mod
 @@ -4,6 +4,7 @@ go 1.21
 
  require (
  	github.com/microsoft/go-crypto-openssl v0.2.7
 +	github.com/microsoft/go-crypto-winnative v0.0.0-20230502061212-6eb98854418e
- 	golang.org/x/crypto v0.10.0
- 	golang.org/x/net v0.11.1-0.20230613203745-f5464ddb689c
+ 	golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d
+ 	golang.org/x/net v0.12.1-0.20230712162946-57553cbff163
  )
 diff --git a/src/go.sum b/src/go.sum
-index a9a97eef7d763d..7dbe6f682268ef 100644
+index 921f8a4a9923cd..eb34153bfc5cb8 100644
 --- a/src/go.sum
 +++ b/src/go.sum
 @@ -1,5 +1,7 @@
  github.com/microsoft/go-crypto-openssl v0.2.7 h1:NKugDhOzj/ck0xRcATCL2L16B6IqZ/2AaG7b+KFa5aE=
  github.com/microsoft/go-crypto-openssl v0.2.7/go.mod h1:xOSmQnWz4xvNB2+KQN2g2UUwMG9vqDHBk9nk/NdmyRw=
 +github.com/microsoft/go-crypto-winnative v0.0.0-20230502061212-6eb98854418e h1:BB2UybwbUjtxG2OFs6KnKi8AOlk9rjH7ekjkbW+vHA0=
 +github.com/microsoft/go-crypto-winnative v0.0.0-20230502061212-6eb98854418e/go.mod h1:fveERXKbeK+XLmOyU24caKnIT/S5nniAX9XCRHfnrM4=
- golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
- golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
- golang.org/x/net v0.11.1-0.20230613203745-f5464ddb689c h1:icjsA5jFPWsTcuIb/yIeU6mgXRHPQBfo0Lzd1GQmKZI=
+ golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d h1:LiA25/KWKuXfIq5pMIBq1s5hz3HQxhJJSu/SUGlD+SM=
+ golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
+ golang.org/x/net v0.12.1-0.20230712162946-57553cbff163 h1:1EDKNuaCsog7zGLEml1qRuO4gt23jORUQX2f0IKZ860=
 diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
-index ef79bb8b7b24ca..65706944d6bdf5 100644
+index 7d32c7c63795d6..6146e20c7b027e 100644
 --- a/src/go/build/deps_test.go
 +++ b/src/go/build/deps_test.go
 @@ -425,6 +425,10 @@ var depsRules = `

patches/0006-Vendor-crypto-backends.patch

@@ -6268,7 +6268,7 @@ index 00000000000000..1722410e5af193
 +	return getSystemDirectory() + "\\" + dll
 +}
 diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
-index 438c2f447be441..6f2e303cc5f53c 100644
+index 2b5f965f8f890b..6310039510be28 100644
 --- a/src/vendor/modules.txt
 +++ b/src/vendor/modules.txt
 @@ -1,3 +1,15 @@
@@ -6284,6 +6284,6 @@ index 438c2f447be441..6f2e303cc5f53c 100644
 +github.com/microsoft/go-crypto-winnative/internal/bcrypt
 +github.com/microsoft/go-crypto-winnative/internal/subtle
 +github.com/microsoft/go-crypto-winnative/internal/sysdll
- # golang.org/x/crypto v0.10.0
+ # golang.org/x/crypto v0.11.1-0.20230711161743-2e82bdd1719d
  ## explicit; go 1.17
  golang.org/x/crypto/chacha20