implement binary marshaller

patches/0002-Vendor-crypto-backends.patch

@@ -67,7 +67,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result
  .../go-crypto-darwin/xcrypto/ecdsa.go         | 181 +++++
  .../go-crypto-darwin/xcrypto/ed25519.go       | 100 +++
  .../microsoft/go-crypto-darwin/xcrypto/evp.go | 338 +++++++++
- .../go-crypto-darwin/xcrypto/hash.go          | 391 ++++++++++
+ .../go-crypto-darwin/xcrypto/hash.go          | 403 ++++++++++
  .../go-crypto-darwin/xcrypto/hkdf.go          |  66 ++
  .../go-crypto-darwin/xcrypto/hmac.go          | 113 +++
  .../go-crypto-darwin/xcrypto/pbkdf2.go        |  65 ++
@@ -101,7 +101,7 @@ Use a 'go' that was recently built by the current branch to ensure stable result
  .../internal/subtle/aliasing.go               |  32 +
  .../internal/sysdll/sys_windows.go            |  55 ++
  src/vendor/modules.txt                        |  16 +
- 95 files changed, 13787 insertions(+), 3 deletions(-)
+ 95 files changed, 13799 insertions(+), 3 deletions(-)
  create mode 100644 src/crypto/internal/backend/deps_ignore.go
  create mode 100644 src/vendor/github.com/golang-fips/openssl/v2/.gitignore
  create mode 100644 src/vendor/github.com/golang-fips/openssl/v2/.gitleaks.toml
@@ -222,7 +222,7 @@ index 00000000000000..ae4055d2d71303
 +// that are used by the backend package. This allows to track
 +// their versions in a single patch file.
 diff --git a/src/go.mod b/src/go.mod
-index 7a1318dcac32ba..18a071a7428728 100644
+index 7a1318dcac32ba..a59c5f120e7dfb 100644
 --- a/src/go.mod
 +++ b/src/go.mod
 @@ -11,3 +11,9 @@ require (
@@ -232,18 +232,18 @@ index 7a1318dcac32ba..18a071a7428728 100644
 +
 +require (
 +	github.com/golang-fips/openssl/v2 v2.0.4-0.20250115103809-bf655f6d08d6
-+	github.com/microsoft/go-crypto-darwin v0.0.2-0.20250109130249-2dee4e287e7c
++	github.com/microsoft/go-crypto-darwin v0.0.2-0.20250116101429-467bd63a2d67
 +	github.com/microsoft/go-crypto-winnative v0.0.0-20250110072644-50d2dfac4b70
 +)
 diff --git a/src/go.sum b/src/go.sum
-index 9e661352f16e0b..a2513aafc35631 100644
+index 9e661352f16e0b..b4273d691cbe36 100644
 --- a/src/go.sum
 +++ b/src/go.sum
 @@ -1,3 +1,9 @@
 +github.com/golang-fips/openssl/v2 v2.0.4-0.20250115103809-bf655f6d08d6 h1:FFp7Q2AwYX+IQhhQt3ljQDdWtG5ZbRu0u3ohWQdFow8=
 +github.com/golang-fips/openssl/v2 v2.0.4-0.20250115103809-bf655f6d08d6/go.mod h1:OYUBsoxLpFu8OFyhZHxfpN8lgcsw8JhTC3BQK7+XUc0=
-+github.com/microsoft/go-crypto-darwin v0.0.2-0.20250109130249-2dee4e287e7c h1:cPW7Q78w6ubgnQTxOFz5YuFmrXzt+p2UA+gSk/KAuDM=
-+github.com/microsoft/go-crypto-darwin v0.0.2-0.20250109130249-2dee4e287e7c/go.mod h1:LyP4oZ0QcysEJdqUTOk9ngNFArRFK94YRImkoJ8julQ=
++github.com/microsoft/go-crypto-darwin v0.0.2-0.20250116101429-467bd63a2d67 h1:SI0IFiHducwfamZR7pv6jb92oc5o/z5tn66wynS6ADE=
++github.com/microsoft/go-crypto-darwin v0.0.2-0.20250116101429-467bd63a2d67/go.mod h1:LyP4oZ0QcysEJdqUTOk9ngNFArRFK94YRImkoJ8julQ=
 +github.com/microsoft/go-crypto-winnative v0.0.0-20250110072644-50d2dfac4b70 h1:97wOagHu7OExwU929NjuPIlUEUaFIQtffQMaVj0mR5E=
 +github.com/microsoft/go-crypto-winnative v0.0.0-20250110072644-50d2dfac4b70/go.mod h1:JkxQeL8dGcyCuKjn1Etz4NmQrOMImMy4BA9hptEfVFA=
  golang.org/x/crypto v0.30.0 h1:RwoQn3GkWiMkzlX562cLB7OxWvjH1L8xutO2WoJcRoY=
@@ -9716,10 +9716,10 @@ index 00000000000000..fcdce4c49b6723
 +}
 diff --git a/src/vendor/github.com/microsoft/go-crypto-darwin/xcrypto/hash.go b/src/vendor/github.com/microsoft/go-crypto-darwin/xcrypto/hash.go
 new file mode 100644
-index 00000000000000..2618e53134e915
+index 00000000000000..94442fde5def16
 --- /dev/null
 +++ b/src/vendor/github.com/microsoft/go-crypto-darwin/xcrypto/hash.go
-@@ -0,0 +1,391 @@
+@@ -0,0 +1,403 @@
 +// Copyright (c) Microsoft Corporation.
 +// Licensed under the MIT License.
 +
@@ -9936,6 +9936,18 @@ index 00000000000000..2618e53134e915
 +	return append(b, digest...)
 +}
 +
++func (h *evpHash) MarshalBinary() ([]byte, error) {
++	return nil, errors.New("xcrypto: hash state is not marshallable")
++}
++
++func (h *evpHash) AppendBinary(b []byte) ([]byte, error) {
++	return nil, errors.New("xcrypto: hash state is not marshallable")
++}
++
++func (h *evpHash) UnmarshalBinary(data []byte) error {
++	return errors.New("xcrypto: hash state is not marshallable")
++}
++
 +// Clone returns a new evpHash object that is a deep clone of itself.
 +// The duplicate object contains all state and data contained in the
 +// original object at the point of duplication.
@@ -15137,15 +15149,15 @@ index 00000000000000..1722410e5af193
 +	return getSystemDirectory() + "\\" + dll
 +}
 diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
-index 1c8de570cc2f1f..2013c56709b909 100644
+index 1c8de570cc2f1f..a249bbfa93dac3 100644
 --- a/src/vendor/modules.txt
 +++ b/src/vendor/modules.txt
 @@ -1,3 +1,19 @@
 +# github.com/golang-fips/openssl/v2 v2.0.4-0.20250115103809-bf655f6d08d6
 +## explicit; go 1.22
 +github.com/golang-fips/openssl/v2
 +github.com/golang-fips/openssl/v2/bbig
-+# github.com/microsoft/go-crypto-darwin v0.0.2-0.20250109130249-2dee4e287e7c
++# github.com/microsoft/go-crypto-darwin v0.0.2-0.20250116101429-467bd63a2d67
 +## explicit; go 1.22
 +github.com/microsoft/go-crypto-darwin/bbig
 +github.com/microsoft/go-crypto-darwin/internal/cryptokit

patches/0004-Use-crypto-backends.patch

@@ -38,7 +38,7 @@ Subject: [PATCH] Use crypto backends
  src/crypto/internal/cryptotest/allocations.go |   2 +-
  .../internal/cryptotest/implementations.go    |   2 +-
  src/crypto/md5/md5.go                         |  10 +
- src/crypto/md5/md5_test.go                    |  21 ++
+ src/crypto/md5/md5_test.go                    |  16 ++
  src/crypto/pbkdf2/pbkdf2.go                   |   4 +
  src/crypto/pbkdf2/pbkdf2_test.go              |   2 +-
  src/crypto/purego_test.go                     |   2 +-
@@ -55,11 +55,11 @@ Subject: [PATCH] Use crypto backends
  src/crypto/rsa/rsa.go                         |   4 +-
  src/crypto/rsa/rsa_test.go                    |  15 +-
  src/crypto/sha1/sha1.go                       |   8 +-
- src/crypto/sha1/sha1_test.go                  |  19 +-
+ src/crypto/sha1/sha1_test.go                  |   9 +-
  src/crypto/sha256/sha256.go                   |   6 +-
- src/crypto/sha256/sha256_test.go              |  29 +++
+ src/crypto/sha256/sha256_test.go              |  16 ++
  src/crypto/sha512/sha512.go                   |   2 +-
- src/crypto/sha512/sha512_test.go              |  29 +++
+ src/crypto/sha512/sha512_test.go              |  16 ++
  src/crypto/tls/cipher_suites.go               |   2 +-
  src/crypto/tls/fipsonly/fipsonly.go           |   2 +-
  src/crypto/tls/fipsonly/fipsonly_test.go      |   2 +-
@@ -75,13 +75,13 @@ Subject: [PATCH] Use crypto backends
  src/go/build/deps_test.go                     |   5 +-
  src/hash/boring_test.go                       |   9 +
  src/hash/example_test.go                      |   2 +
- src/hash/marshal_test.go                      |   9 +
+ src/hash/marshal_test.go                      |   4 +
  src/hash/notboring_test.go                    |   9 +
  src/net/lookup_test.go                        |   3 +
  src/net/smtp/smtp_test.go                     |  72 ++++---
  src/os/exec/exec_test.go                      |   9 +
  src/runtime/pprof/vminfo_darwin_test.go       |   6 +
- 77 files changed, 1143 insertions(+), 109 deletions(-)
+ 77 files changed, 1097 insertions(+), 109 deletions(-)
  create mode 100644 src/crypto/dsa/boring.go
  create mode 100644 src/crypto/dsa/notboring.go
  create mode 100644 src/crypto/ecdsa/badlinkname.go
@@ -1166,7 +1166,7 @@ index a0384e175f31bd..f7aa6da36f02de 100644
  	d.Reset()
  	d.Write(data)
 diff --git a/src/crypto/md5/md5_test.go b/src/crypto/md5/md5_test.go
-index 437d9b9d4c0e0d..ee28c55f846e81 100644
+index 437d9b9d4c0e0d..50728df60ea7ec 100644
 --- a/src/crypto/md5/md5_test.go
 +++ b/src/crypto/md5/md5_test.go
 @@ -6,12 +6,14 @@ package md5
@@ -1184,19 +1184,7 @@ index 437d9b9d4c0e0d..ee28c55f846e81 100644
  	"testing"
  	"unsafe"
  )
-@@ -88,6 +90,11 @@ func TestGolden(t *testing.T) {
- }
-
- func TestGoldenMarshal(t *testing.T) {
-+	if boring.Enabled {
-+		if _, ok := New().(encoding.BinaryMarshaler); !ok {
-+			t.Skip("BinaryMarshaler not implemented")
-+		}
-+	}
- 	for _, g := range golden {
- 		h := New()
- 		h2 := New()
-@@ -96,6 +103,9 @@ func TestGoldenMarshal(t *testing.T) {
+@@ -96,6 +98,9 @@ func TestGoldenMarshal(t *testing.T) {
 
  		state, err := h.(encoding.BinaryMarshaler).MarshalBinary()
  		if err != nil {
@@ -1206,7 +1194,7 @@ index 437d9b9d4c0e0d..ee28c55f846e81 100644
  			t.Errorf("could not marshal: %v", err)
  			continue
  		}
-@@ -157,6 +167,9 @@ func TestLarge(t *testing.T) {
+@@ -157,6 +162,9 @@ func TestLarge(t *testing.T) {
 
  // Tests that blockGeneric (pure Go) and block (in assembly for amd64, 386, arm) match.
  func TestBlockGeneric(t *testing.T) {
@@ -1216,7 +1204,7 @@ index 437d9b9d4c0e0d..ee28c55f846e81 100644
  	gen, asm := New().(*digest), New().(*digest)
  	buf := make([]byte, BlockSize*20) // arbitrary factor
  	rand.Read(buf)
-@@ -204,10 +217,18 @@ func safeSum(h hash.Hash) (sum []byte, err error) {
+@@ -204,10 +212,18 @@ func safeSum(h hash.Hash) (sum []byte, err error) {
  }
 
  func TestLargeHashes(t *testing.T) {
@@ -1759,7 +1747,7 @@ index d2ffaac0aeb674..23d8ad44d0bd9a 100644
  	d.Reset()
  	d.Write(data)
 diff --git a/src/crypto/sha1/sha1_test.go b/src/crypto/sha1/sha1_test.go
-index 9d707b7cde5c2d..8da08b3d860a85 100644
+index 9d707b7cde5c2d..8e1f92ea7304a8 100644
 --- a/src/crypto/sha1/sha1_test.go
 +++ b/src/crypto/sha1/sha1_test.go
 @@ -8,13 +8,14 @@ package sha1
@@ -1778,19 +1766,7 @@ index 9d707b7cde5c2d..8da08b3d860a85 100644
  	"testing"
  )
 
-@@ -97,6 +98,11 @@ func TestGolden(t *testing.T) {
- }
-
- func TestGoldenMarshal(t *testing.T) {
-+	if boring.Enabled {
-+		if _, ok := New().(encoding.BinaryMarshaler); !ok {
-+			t.Skip("BinaryMarshaler not implemented")
-+		}
-+	}
- 	h := New()
- 	h2 := New()
- 	for _, g := range golden {
-@@ -107,6 +113,9 @@ func TestGoldenMarshal(t *testing.T) {
+@@ -107,6 +108,9 @@ func TestGoldenMarshal(t *testing.T) {
 
  		state, err := h.(encoding.BinaryMarshaler).MarshalBinary()
  		if err != nil {
@@ -1800,16 +1776,7 @@ index 9d707b7cde5c2d..8da08b3d860a85 100644
  			t.Errorf("could not marshal: %v", err)
  			continue
  		}
-@@ -210,10 +219,18 @@ func safeSum(h hash.Hash) (sum []byte, err error) {
- }
-
- func TestLargeHashes(t *testing.T) {
-+	if boring.Enabled {
-+		if _, ok := New().(encoding.BinaryMarshaler); !ok {
-+			t.Skip("BinaryMarshaler not implemented")
-+		}
-+	}
- 	for i, test := range largeUnmarshalTests {
+@@ -214,6 +218,9 @@ func TestLargeHashes(t *testing.T) {
 
  		h := New()
  		if err := h.(encoding.BinaryUnmarshaler).UnmarshalBinary([]byte(test.state)); err != nil {
@@ -1851,7 +1818,7 @@ index 069938a22dbc5a..8d0e06b86f4359 100644
  	}
  	h := New224()
 diff --git a/src/crypto/sha256/sha256_test.go b/src/crypto/sha256/sha256_test.go
-index e1af9640e25547..c4f142c1430285 100644
+index e1af9640e25547..8896c6e85f4ada 100644
 --- a/src/crypto/sha256/sha256_test.go
 +++ b/src/crypto/sha256/sha256_test.go
 @@ -8,11 +8,13 @@ package sha256
@@ -1868,19 +1835,7 @@ index e1af9640e25547..c4f142c1430285 100644
  	"testing"
  )
 
-@@ -155,6 +157,11 @@ func testGoldenMarshal(t *testing.T) {
-
- 	for _, tt := range tests {
- 		t.Run(tt.name, func(t *testing.T) {
-+			if boring.Enabled {
-+				if _, ok := tt.newHash().(encoding.BinaryMarshaler); !ok {
-+					t.Skip("BinaryMarshaler not implemented")
-+				}
-+			}
- 			for _, g := range tt.gold {
- 				h := tt.newHash()
- 				h2 := tt.newHash()
-@@ -163,6 +170,9 @@ func testGoldenMarshal(t *testing.T) {
+@@ -163,6 +165,9 @@ func testGoldenMarshal(t *testing.T) {
 
  				state, err := h.(encoding.BinaryMarshaler).MarshalBinary()
  				if err != nil {
@@ -1890,18 +1845,8 @@ index e1af9640e25547..c4f142c1430285 100644
  					t.Errorf("could not marshal: %v", err)
  					continue
  				}
-@@ -204,8 +214,19 @@ func TestMarshalTypeMismatch(t *testing.T) {
- 	h1 := New()
- 	h2 := New224()
+@@ -206,6 +211,9 @@ func TestMarshalTypeMismatch(t *testing.T) {
 
-+	if boring.Enabled {
-+		_, ok1 := h1.(encoding.BinaryMarshaler)
-+		_, ok2 := h2.(encoding.BinaryUnmarshaler)
-+		if !ok1 || !ok2 {
-+			t.Skip("BinaryMarshaler not implemented")
-+		}
-+	}
-+
  	state1, err := h1.(encoding.BinaryMarshaler).MarshalBinary()
  	if err != nil {
 +		if strings.Contains(err.Error(), "hash state is not marshallable") {
@@ -1910,7 +1855,7 @@ index e1af9640e25547..c4f142c1430285 100644
  		t.Errorf("could not marshal: %v", err)
  	}
 
-@@ -275,10 +296,18 @@ func safeSum(h hash.Hash) (sum []byte, err error) {
+@@ -275,10 +283,18 @@ func safeSum(h hash.Hash) (sum []byte, err error) {
  	return h.Sum(nil), nil
  }
  func TestLargeHashes(t *testing.T) {
@@ -1943,7 +1888,7 @@ index 1435eac1f5b5dc..17e8501154762a 100644
  	"hash"
  )
 diff --git a/src/crypto/sha512/sha512_test.go b/src/crypto/sha512/sha512_test.go
-index 1fe9d132bb186d..97b7da8c2d3d88 100644
+index 1fe9d132bb186d..0692be8461e964 100644
 --- a/src/crypto/sha512/sha512_test.go
 +++ b/src/crypto/sha512/sha512_test.go
 @@ -8,12 +8,14 @@ package sha512
@@ -1961,19 +1906,7 @@ index 1fe9d132bb186d..97b7da8c2d3d88 100644
  	"testing"
  )
 
-@@ -744,6 +746,11 @@ func testGoldenMarshal(t *testing.T) {
- 	for _, tt := range tests {
- 		t.Run(tt.name, func(t *testing.T) {
- 			for _, test := range tt.golden {
-+				if boring.Enabled {
-+					if _, ok := tt.newHash().(encoding.BinaryMarshaler); !ok {
-+						t.Skip("BinaryMarshaler not implemented")
-+					}
-+				}
- 				h := tt.newHash()
- 				h2 := tt.newHash()
-
-@@ -751,6 +758,9 @@ func testGoldenMarshal(t *testing.T) {
+@@ -751,6 +753,9 @@ func testGoldenMarshal(t *testing.T) {
 
  				state, err := h.(encoding.BinaryMarshaler).MarshalBinary()
  				if err != nil {
@@ -1983,18 +1916,8 @@ index 1fe9d132bb186d..97b7da8c2d3d88 100644
  					t.Errorf("could not marshal: %v", err)
  					return
  				}
-@@ -805,8 +815,19 @@ func TestMarshalMismatch(t *testing.T) {
- 			h1 := fn1()
- 			h2 := fn2()
-
-+			if boring.Enabled {
-+				_, ok1 := h1.(encoding.BinaryMarshaler)
-+				_, ok2 := h2.(encoding.BinaryUnmarshaler)
-+				if !ok1 || !ok2 {
-+					t.Skip("BinaryMarshaler not implemented")
-+				}
-+			}
-+
+@@ -807,6 +812,9 @@ func TestMarshalMismatch(t *testing.T) {
+
  			state, err := h1.(encoding.BinaryMarshaler).MarshalBinary()
  			if err != nil {
 +				if strings.Contains(err.Error(), "hash state is not marshallable") {
@@ -2003,7 +1926,7 @@ index 1fe9d132bb186d..97b7da8c2d3d88 100644
  				t.Errorf("i=%d: could not marshal: %v", i, err)
  				continue
  			}
-@@ -880,10 +901,18 @@ func safeSum(h hash.Hash) (sum []byte, err error) {
+@@ -880,10 +888,18 @@ func safeSum(h hash.Hash) (sum []byte, err error) {
  }
 
  func TestLargeHashes(t *testing.T) {
@@ -2610,7 +2533,7 @@ index f07b9aaa2c4898..b380537215634d 100644
 
  import (
 diff --git a/src/hash/marshal_test.go b/src/hash/marshal_test.go
-index 3091f7a67acede..23736034d5c352 100644
+index 3091f7a67acede..d952cf45797ac6 100644
 --- a/src/hash/marshal_test.go
 +++ b/src/hash/marshal_test.go
 @@ -21,6 +21,7 @@ import (
@@ -2621,19 +2544,7 @@ index 3091f7a67acede..23736034d5c352 100644
  	"testing"
  )
 
-@@ -65,6 +66,11 @@ func TestMarshalHash(t *testing.T) {
- 			}
-
- 			h := tt.new()
-+			if boringEnabled {
-+				if _, ok := h.(encoding.BinaryMarshaler); !ok {
-+					t.Skip("BinaryMarshaler not implemented")
-+				}
-+			}
- 			h.Write(buf[:256])
- 			sum := h.Sum(nil)
-
-@@ -80,6 +86,9 @@ func TestMarshalHash(t *testing.T) {
+@@ -80,6 +81,9 @@ func TestMarshalHash(t *testing.T) {
  			}
  			enc, err := h2m.MarshalBinary()
  			if err != nil {