@ttsc/win32-arm64 0.33.0 → 0.34.0

package/bin/go/src/crypto/tls/tls.go

@@ -28,12 +28,12 @@ import (
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/ed25519"
+	"crypto/mldsa"
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
 	"fmt"
-	"internal/godebug"
 	"net"
 	"os"
 	"strings"
@@ -112,6 +112,8 @@ func Listen(network, laddr string, config *Config) (net.Listener, error) {
 
 type timeoutError struct{}
 
+var _ error = timeoutError{}
+
 func (timeoutError) Error() string   { return "tls: DialWithDialer timed out" }
 func (timeoutError) Timeout() bool   { return true }
 func (timeoutError) Temporary() bool { return true }
@@ -239,10 +241,6 @@ func (d *Dialer) DialContext(ctx context.Context, network, addr string) (net.Con
 // files. The files must contain PEM encoded data. The certificate file may
 // contain intermediate certificates following the leaf certificate to form a
 // certificate chain. On successful return, Certificate.Leaf will be populated.
-//
-// Before Go 1.23 Certificate.Leaf was left nil, and the parsed certificate was
-// discarded. This behavior can be re-enabled by setting "x509keypairleaf=0"
-// in the GODEBUG environment variable.
 func LoadX509KeyPair(certFile, keyFile string) (Certificate, error) {
 	certPEMBlock, err := os.ReadFile(certFile)
 	if err != nil {
@@ -255,14 +253,8 @@ func LoadX509KeyPair(certFile, keyFile string) (Certificate, error) {
 	return X509KeyPair(certPEMBlock, keyPEMBlock)
 }
 
-var x509keypairleaf = godebug.New("x509keypairleaf")
-
 // X509KeyPair parses a public/private key pair from a pair of
 // PEM encoded data. On successful return, Certificate.Leaf will be populated.
-//
-// Before Go 1.23 Certificate.Leaf was left nil, and the parsed certificate was
-// discarded. This behavior can be re-enabled by setting "x509keypairleaf=0"
-// in the GODEBUG environment variable.
 func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error) {
 	fail := func(err error) (Certificate, error) { return Certificate{}, err }
 
@@ -316,12 +308,7 @@ func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error) {
 	if err != nil {
 		return fail(err)
 	}
-
-	if x509keypairleaf.Value() != "0" {
-		cert.Leaf = x509Cert
-	} else {
-		x509keypairleaf.IncNonDefault()
-	}
+	cert.Leaf = x509Cert
 
 	cert.PrivateKey, err = parsePrivateKey(keyDERBlock.Bytes)
 	if err != nil {
@@ -353,6 +340,14 @@ func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error) {
 		if !priv.Public().(ed25519.PublicKey).Equal(pub) {
 			return fail(errors.New("tls: private key does not match public key"))
 		}
+	case *mldsa.PublicKey:
+		priv, ok := cert.PrivateKey.(*mldsa.PrivateKey)
+		if !ok {
+			return fail(errors.New("tls: private key type does not match public key type"))
+		}
+		if !priv.PublicKey().Equal(pub) {
+			return fail(errors.New("tls: private key does not match public key"))
+		}
 	default:
 		return fail(errors.New("tls: unknown public key algorithm"))
 	}
@@ -364,20 +359,21 @@ func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error) {
 // PKCS #1 private keys by default, while OpenSSL 1.0.0 generates PKCS #8 keys.
 // OpenSSL ecparam generates SEC1 EC private keys for ECDSA. We try all three.
 func parsePrivateKey(der []byte) (crypto.PrivateKey, error) {
-	if key, err := x509.ParsePKCS1PrivateKey(der); err == nil {
-		return key, nil
+	key, err := x509.ParsePKCS8PrivateKey(der)
+	pkcs8Err := err // Return the PKCS#8 error if all parsing attempts fail.
+	if err != nil {
+		key, err = x509.ParsePKCS1PrivateKey(der)
 	}
-	if key, err := x509.ParsePKCS8PrivateKey(der); err == nil {
-		switch key := key.(type) {
-		case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey:
-			return key, nil
-		default:
-			return nil, errors.New("tls: found unknown private key type in PKCS#8 wrapping")
-		}
+	if err != nil {
+		key, err = x509.ParseECPrivateKey(der)
 	}
-	if key, err := x509.ParseECPrivateKey(der); err == nil {
+	if err != nil {
+		return nil, fmt.Errorf("tls: failed to parse private key: %w", pkcs8Err)
+	}
+	switch key := key.(type) {
+	case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey, *mldsa.PrivateKey:
 		return key, nil
+	default:
+		return nil, errors.New("tls: found unknown private key type in PKCS#8 wrapping")
 	}
-
-	return nil, errors.New("tls: failed to parse private key")
 }

package/bin/go/src/crypto/x509/cert_pool.go

@@ -105,10 +105,14 @@ func (s *CertPool) Clone() *CertPool {
 
 // SystemCertPool returns a copy of the system cert pool.
 //
-// On Unix systems other than macOS the environment variables SSL_CERT_FILE and
-// SSL_CERT_DIR can be used to override the system default locations for the SSL
-// certificate file and SSL certificate files directory, respectively. The
-// latter can be a colon-separated list.
+// The environment variables SSL_CERT_FILE and SSL_CERT_DIR can be used to
+// override the system default locations for the SSL certificate file and SSL
+// certificate files directory, respectively. The latter can be a
+// colon-separated list, or a semicolon-separated list on Windows. On platforms
+// which have system APIs for certificate verification (macOS and Windows),
+// setting SSL_CERT_FILE or SSL_CERT_DIR will prevent those APIs from being
+// used, unless the x509sslcertoverrideplatform=0 GODEBUG setting is used. (This
+// changed in Go 1.27.)
 //
 // Any mutations to the returned pool are not written to disk and do not affect
 // any other pool returned by SystemCertPool.

package/bin/go/src/crypto/x509/constraints.go

@@ -169,6 +169,11 @@ func newIPNetConstraints(l []*net.IPNet) interface {
 	}
 	var ipv4, ipv6 []*net.IPNet
 	for _, n := range l {
+		// Subtrees may carry non-zero host bits. Sort and search need the masked
+		// network address, so use a copy and leave the parsed constraint as encoded.
+		if masked := n.IP.Mask(n.Mask); masked != nil && !masked.Equal(n.IP) {
+			n = &net.IPNet{IP: masked, Mask: n.Mask}
+		}
 		if len(n.IP) == net.IPv4len {
 			ipv4 = append(ipv4, n)
 		} else {

package/bin/go/src/crypto/x509/parser.go

@@ -10,6 +10,7 @@ import (
 	"crypto/ecdh"
 	"crypto/ecdsa"
 	"crypto/ed25519"
+	"crypto/mldsa"
 	"crypto/rsa"
 	"crypto/x509/pkix"
 	"encoding/asn1"
@@ -138,6 +139,70 @@ func parseASN1String(tag cryptobyte_asn1.Tag, value []byte) (string, error) {
 	return "", fmt.Errorf("unsupported string type: %v", tag)
 }
 
+// readASN1Any parses types documented at [pkix.AttributeTypeAndValue].
+func readASN1Any(der *cryptobyte.String) (any, error) {
+	var fullValue cryptobyte.String
+	var valueTag cryptobyte_asn1.Tag
+	if !der.ReadAnyASN1Element(&fullValue, &valueTag) {
+		return nil, errors.New("invalid ASN.1 element")
+	}
+	switch valueTag {
+	case cryptobyte_asn1.T61String, cryptobyte_asn1.PrintableString,
+		cryptobyte_asn1.UTF8String, cryptobyte_asn1.Tag(asn1.TagBMPString),
+		cryptobyte_asn1.IA5String, cryptobyte_asn1.Tag(asn1.TagNumericString):
+		var rawValue []byte
+		if !fullValue.ReadASN1((*cryptobyte.String)(&rawValue), valueTag) {
+			return nil, errors.New("invalid ASN.1 element")
+		}
+		return parseASN1String(valueTag, rawValue)
+	case cryptobyte_asn1.INTEGER:
+		var i int64
+		if !fullValue.ReadASN1Integer(&i) {
+			return nil, errors.New("invalid ASN.1 integer")
+		}
+		return i, nil
+	case cryptobyte_asn1.BIT_STRING:
+		var bs asn1.BitString
+		if !fullValue.ReadASN1BitString(&bs) {
+			return nil, errors.New("invalid ASN.1 BIT STRING")
+		}
+		return bs, nil
+	case cryptobyte_asn1.OCTET_STRING:
+		var s []byte
+		if !fullValue.ReadASN1((*cryptobyte.String)(&s), cryptobyte_asn1.OCTET_STRING) {
+			return nil, errors.New("invalid ASN.1 OCTET STRING")
+		}
+		return s, nil
+	case cryptobyte_asn1.OBJECT_IDENTIFIER:
+		var oid asn1.ObjectIdentifier
+		if !fullValue.ReadASN1ObjectIdentifier(&oid) {
+			return nil, errors.New("invalid ASN.1 OBJECT IDENTIFIER")
+		}
+		return oid, nil
+	case cryptobyte_asn1.UTCTime, cryptobyte_asn1.GeneralizedTime:
+		out, err := readASN1Time(&fullValue)
+		return out, err
+	case cryptobyte_asn1.BOOLEAN:
+		var b bool
+		if !fullValue.ReadASN1Boolean(&b) {
+			return nil, errors.New("invalid ASN.1 BOOLEAN")
+		}
+		return b, nil
+	case cryptobyte_asn1.NULL:
+		return nil, nil
+	default:
+		var v asn1.RawValue
+		v.Class = int(valueTag >> 6)
+		v.IsCompound = valueTag&0x20 == 0x20
+		v.Tag = int(valueTag & 0x1f)
+		v.FullBytes = fullValue
+		if !fullValue.ReadAnyASN1((*cryptobyte.String)(&v.Bytes), &valueTag) {
+			return nil, errors.New("invalid ASN.1 element")
+		}
+		return v, nil
+	}
+}
+
 // parseName parses a DER encoded Name as defined in RFC 5280. We may
 // want to export this function in the future for use in crypto/tls.
 func parseName(raw cryptobyte.String) (*pkix.RDNSequence, error) {
@@ -161,13 +226,8 @@ func parseName(raw cryptobyte.String) (*pkix.RDNSequence, error) {
 			if !atav.ReadASN1ObjectIdentifier(&attr.Type) {
 				return nil, errors.New("x509: invalid RDNSequence: invalid attribute type")
 			}
-			var rawValue cryptobyte.String
-			var valueTag cryptobyte_asn1.Tag
-			if !atav.ReadAnyASN1(&rawValue, &valueTag) {
-				return nil, errors.New("x509: invalid RDNSequence: invalid attribute value")
-			}
 			var err error
-			attr.Value, err = parseASN1String(valueTag, rawValue)
+			attr.Value, err = readASN1Any(&atav)
 			if err != nil {
 				return nil, fmt.Errorf("x509: invalid RDNSequence: invalid attribute value: %s", err)
 			}
@@ -198,7 +258,7 @@ func parseAI(der cryptobyte.String) (pkix.AlgorithmIdentifier, error) {
 	return ai, nil
 }
 
-func parseTime(der *cryptobyte.String) (time.Time, error) {
+func readASN1Time(der *cryptobyte.String) (time.Time, error) {
 	var t time.Time
 	switch {
 	case der.PeekASN1Tag(cryptobyte_asn1.UTCTime):
@@ -216,11 +276,11 @@ func parseTime(der *cryptobyte.String) (time.Time, error) {
 }
 
 func parseValidity(der cryptobyte.String) (time.Time, time.Time, error) {
-	notBefore, err := parseTime(&der)
+	notBefore, err := readASN1Time(&der)
 	if err != nil {
 		return time.Time{}, time.Time{}, err
 	}
-	notAfter, err := parseTime(&der)
+	notAfter, err := readASN1Time(&der)
 	if err != nil {
 		return time.Time{}, time.Time{}, err
 	}
@@ -303,6 +363,15 @@ func parsePublicKey(keyData *publicKeyInfo) (any, error) {
 			return nil, errors.New("x509: wrong Ed25519 public key size")
 		}
 		return ed25519.PublicKey(data), nil
+	case oid.Equal(oidPublicKeyMLDSA44), oid.Equal(oidPublicKeyMLDSA65), oid.Equal(oidPublicKeyMLDSA87):
+		if len(params.FullBytes) != 0 {
+			return nil, errors.New("x509: ML-DSA key encoded with illegal parameters")
+		}
+		params, ok := mldsaParametersFromOID(oid)
+		if !ok {
+			return nil, errors.New("x509: unsupported ML-DSA parameters")
+		}
+		return mldsa.NewPublicKey(params, data)
 	case oid.Equal(oidPublicKeyX25519):
 		// RFC 8410, Section 3
 		// > For all of the OIDs, the parameters MUST be absent.
@@ -427,7 +496,12 @@ func parseSANExtension(der cryptobyte.String) (dnsNames, emailAddresses []string
 			uris = append(uris, uri)
 		case nameTypeIP:
 			switch len(data) {
-			case net.IPv4len, net.IPv6len:
+			case net.IPv6len:
+				if net.IP(data).To4() != nil {
+					return errors.New("x509: SAN iPAddress contains IPv4-mapped IPv6 address")
+				}
+				ipAddresses = append(ipAddresses, data)
+			case net.IPv4len:
 				ipAddresses = append(ipAddresses, data)
 			default:
 				return errors.New("x509: cannot parse IP address of length " + strconv.Itoa(len(data)))
@@ -614,6 +688,10 @@ func parseNameConstraintsExtension(out *Certificate, e pkix.Extension) (unhandle
 					return nil, nil, nil, nil, fmt.Errorf("x509: IP constraint contained invalid mask %x", mask)
 				}
 
+				if len(ip) == net.IPv6len && net.IP(ip).To4() != nil {
+					return nil, nil, nil, nil, errors.New("x509: IP constraint contained IPv4-mapped IPv6 address")
+				}
+
 				ips = append(ips, &net.IPNet{IP: net.IP(ip), Mask: net.IPMask(mask)})
 
 			case emailTag:
@@ -936,7 +1014,11 @@ func parseCertificate(der []byte) (*Certificate, error) {
 	cert.SerialNumber = serial
 
 	var sigAISeq cryptobyte.String
-	if !tbs.ReadASN1(&sigAISeq, cryptobyte_asn1.SEQUENCE) {
+	if !tbs.ReadASN1Element(&sigAISeq, cryptobyte_asn1.SEQUENCE) {
+		return nil, errors.New("x509: malformed signature algorithm identifier")
+	}
+	cert.RawSignatureAlgorithm = sigAISeq
+	if !sigAISeq.ReadASN1(&sigAISeq, cryptobyte_asn1.SEQUENCE) {
 		return nil, errors.New("x509: malformed signature algorithm identifier")
 	}
 	// Before parsing the inner algorithm identifier, extract
@@ -1143,7 +1225,11 @@ func ParseRevocationList(der []byte) (*RevocationList, error) {
 	}
 
 	var sigAISeq cryptobyte.String
-	if !tbs.ReadASN1(&sigAISeq, cryptobyte_asn1.SEQUENCE) {
+	if !tbs.ReadASN1Element(&sigAISeq, cryptobyte_asn1.SEQUENCE) {
+		return nil, errors.New("x509: malformed signature algorithm identifier")
+	}
+	rl.RawSignatureAlgorithm = sigAISeq
+	if !sigAISeq.ReadASN1(&sigAISeq, cryptobyte_asn1.SEQUENCE) {
 		return nil, errors.New("x509: malformed signature algorithm identifier")
 	}
 	// Before parsing the inner algorithm identifier, extract
@@ -1179,12 +1265,12 @@ func ParseRevocationList(der []byte) (*RevocationList, error) {
 	}
 	rl.Issuer.FillFromRDNSequence(issuerRDNs)
 
-	rl.ThisUpdate, err = parseTime(&tbs)
+	rl.ThisUpdate, err = readASN1Time(&tbs)
 	if err != nil {
 		return nil, err
 	}
 	if tbs.PeekASN1Tag(cryptobyte_asn1.GeneralizedTime) || tbs.PeekASN1Tag(cryptobyte_asn1.UTCTime) {
-		rl.NextUpdate, err = parseTime(&tbs)
+		rl.NextUpdate, err = readASN1Time(&tbs)
 		if err != nil {
 			return nil, err
 		}
@@ -1211,7 +1297,7 @@ func ParseRevocationList(der []byte) (*RevocationList, error) {
 			if !certSeq.ReadASN1Integer(rce.SerialNumber) {
 				return nil, errors.New("x509: malformed serial number")
 			}
-			rce.RevocationTime, err = parseTime(&certSeq)
+			rce.RevocationTime, err = readASN1Time(&certSeq)
 			if err != nil {
 				return nil, err
 			}

package/bin/go/src/crypto/x509/pkcs8.go

@@ -8,6 +8,7 @@ import (
 	"crypto/ecdh"
 	"crypto/ecdsa"
 	"crypto/ed25519"
+	"crypto/mldsa"
 	"crypto/rsa"
 	"crypto/x509/pkix"
 	"encoding/asn1"
@@ -28,8 +29,8 @@ type pkcs8 struct {
 // ParsePKCS8PrivateKey parses an unencrypted private key in PKCS #8, ASN.1 DER form.
 //
 // It returns a *[rsa.PrivateKey], an *[ecdsa.PrivateKey], an [ed25519.PrivateKey] (not
-// a pointer), or an *[ecdh.PrivateKey] (for X25519). More types might be supported
-// in the future.
+// a pointer), a *[mldsa.PrivateKey], or an *[ecdh.PrivateKey] (for X25519).
+// More types might be supported in the future.
 //
 // This kind of key is commonly encoded in PEM blocks of type "PRIVATE KEY".
 //
@@ -79,6 +80,36 @@ func ParsePKCS8PrivateKey(der []byte) (key any, err error) {
 		}
 		return ed25519.NewKeyFromSeed(curvePrivateKey), nil
 
+	case privKey.Algo.Algorithm.Equal(oidPublicKeyMLDSA44),
+		privKey.Algo.Algorithm.Equal(oidPublicKeyMLDSA65),
+		privKey.Algo.Algorithm.Equal(oidPublicKeyMLDSA87):
+		if l := len(privKey.Algo.Parameters.FullBytes); l != 0 {
+			return nil, errors.New("x509: invalid ML-DSA private key parameters")
+		}
+		if l := len(privKey.PrivateKey); l == 0 {
+			return nil, fmt.Errorf("x509: invalid ML-DSA private key length: %d", l)
+		}
+		switch privKey.PrivateKey[0] {
+		case 0x80: // IMPLICIT [0] OCTET STRING (seed)
+		case 0x04: // OCTET STRING (expandedKey)
+			return nil, errors.New("x509: semi-expanded ML-DSA private keys without seed are not supported")
+		case 0x30: // SEQUENCE (both)
+			return nil, errors.New(`x509: ML-DSA private keys with both seed and expanded key are not supported, use e.g. "openssl pkey -provparam ml-dsa.output_formats=seed-only" to convert to a seed-only key`)
+		default:
+			return nil, fmt.Errorf("x509: invalid ML-DSA private key: invalid ASN.1 tag %02x", privKey.PrivateKey[0])
+		}
+		if l := len(privKey.PrivateKey); l != 2+mldsa.PrivateKeySize {
+			return nil, fmt.Errorf("x509: invalid ML-DSA private key length: %d", l)
+		}
+		if privKey.PrivateKey[1] != mldsa.PrivateKeySize {
+			return nil, fmt.Errorf("x509: invalid ML-DSA private key ASN.1 encoding")
+		}
+		params, ok := mldsaParametersFromOID(privKey.Algo.Algorithm)
+		if !ok {
+			return nil, errors.New("x509: unknown ML-DSA parameters")
+		}
+		return mldsa.NewPrivateKey(params, privKey.PrivateKey[2:])
+
 	case privKey.Algo.Algorithm.Equal(oidPublicKeyX25519):
 		if l := len(privKey.Algo.Parameters.FullBytes); l != 0 {
 			return nil, errors.New("x509: invalid X25519 private key parameters")
@@ -97,8 +128,8 @@ func ParsePKCS8PrivateKey(der []byte) (key any, err error) {
 // MarshalPKCS8PrivateKey converts a private key to PKCS #8, ASN.1 DER form.
 //
 // The following key types are currently supported: *[rsa.PrivateKey],
-// *[ecdsa.PrivateKey], [ed25519.PrivateKey] (not a pointer), and *[ecdh.PrivateKey].
-// Unsupported key types result in an error.
+// *[ecdsa.PrivateKey], [ed25519.PrivateKey] (not a pointer), *[mldsa.PrivateKey],
+// and *[ecdh.PrivateKey]. Unsupported key types result in an error.
 //
 // This kind of key is commonly encoded in PEM blocks of type "PRIVATE KEY".
 //
@@ -147,6 +178,16 @@ func MarshalPKCS8PrivateKey(key any) ([]byte, error) {
 		}
 		privKey.PrivateKey = curvePrivateKey
 
+	case *mldsa.PrivateKey:
+		oid, ok := oidFromMLDSAParameters(k.PublicKey().Parameters())
+		if !ok {
+			return nil, errors.New("x509: unknown ML-DSA parameters while marshaling to PKCS#8")
+		}
+		privKey.Algo = pkix.AlgorithmIdentifier{
+			Algorithm: oid,
+		}
+		privKey.PrivateKey = append([]byte{0x80, mldsa.PrivateKeySize}, k.Bytes()...)
+
 	case *ecdh.PrivateKey:
 		if k.Curve() == ecdh.X25519() {
 			privKey.Algo = pkix.AlgorithmIdentifier{

package/bin/go/src/crypto/x509/pkix/pkix.go

@@ -11,6 +11,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"math/big"
+	"strings"
 	"time"
 )
 
@@ -38,24 +39,31 @@ var attributeTypeNames = map[string]string{
 // String returns a string representation of the sequence r,
 // roughly following the RFC 2253 Distinguished Names syntax.
 func (r RDNSequence) String() string {
-	s := ""
+	var buf strings.Builder
 	for i := 0; i < len(r); i++ {
 		rdn := r[len(r)-1-i]
 		if i > 0 {
-			s += ","
+			buf.WriteByte(',')
 		}
 		for j, tv := range rdn {
 			if j > 0 {
-				s += "+"
+				buf.WriteByte('+')
 			}
 
 			oidString := tv.Type.String()
 			typeName, ok := attributeTypeNames[oidString]
 			if !ok {
-				derBytes, err := asn1.Marshal(tv.Value)
-				if err == nil {
-					s += oidString + "=#" + hex.EncodeToString(derBytes)
-					continue // No value escaping necessary.
+				// RFC 2253 §2.4: if the value's ASN.1 type has a string
+				// representation, render it as a string; otherwise hex-encode
+				// the DER.
+				if _, ok := tv.Value.(string); !ok {
+					derBytes, err := asn1.Marshal(tv.Value)
+					if err == nil {
+						buf.WriteString(oidString)
+						buf.WriteString("=#")
+						buf.WriteString(hex.EncodeToString(derBytes))
+						continue // No value escaping necessary.
+					}
 				}
 
 				typeName = oidString
@@ -85,17 +93,33 @@ func (r RDNSequence) String() string {
 				}
 			}
 
-			s += typeName + "=" + string(escaped)
+			buf.WriteString(typeName)
+			buf.WriteByte('=')
+			buf.WriteString(string(escaped))
 		}
 	}
 
-	return s
+	return buf.String()
 }
 
 type RelativeDistinguishedNameSET []AttributeTypeAndValue
 
 // AttributeTypeAndValue mirrors the ASN.1 structure of the same name in
 // RFC 5280, Section 4.1.2.4.
+//
+// When parsed as part of a pkix.Name structure in a crypto/x509 type,
+// the Value will be
+//
+//   - a string if the ASN.1 type is PrintableString, IA5String,
+//     NumericString, BMPString, T61String, or UTF8String;
+//   - an int64 if the ASN.1 type is INTEGER;
+//   - an asn1.BitString if the ASN.1 type is BIT STRING;
+//   - a []byte if the ASN.1 type is OCTET STRING;
+//   - an asn1.ObjectIdentifier if the ASN.1 type is OBJECT IDENTIFIER;
+//   - a time.Time if the ASN.1 type is UTCTIME or GENERALIZEDTIME;
+//   - a bool if the ASN.1 type is BOOLEAN;
+//   - nil if the ASN.1 type is NULL;
+//   - an asn1.RawValue otherwise.
 type AttributeTypeAndValue struct {
 	Type  asn1.ObjectIdentifier
 	Value any

package/bin/go/src/crypto/x509/root.go

@@ -6,6 +6,11 @@ package x509
 
 import (
 	"internal/godebug"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
 	"sync"
 	_ "unsafe" // for linkname
 )
@@ -115,3 +120,111 @@ func SetFallbackRoots(roots *CertPool) {
 
 	systemRoots, systemRootsErr = roots, nil
 }
+
+const (
+	// certFileEnv is the environment variable which identifies where to locate
+	// the SSL certificate file. If set this overrides the system default.
+	certFileEnv = "SSL_CERT_FILE"
+
+	// certDirEnv is the environment variable which identifies which directory
+	// to check for SSL certificate files. If set this overrides the system default.
+	// See https://docs.openssl.org/4.0/man1/openssl-rehash/#environment.
+	certDirEnv = "SSL_CERT_DIR"
+)
+
+var x509sslcertoverrideplatform = godebug.New("x509sslcertoverrideplatform")
+
+func loadSystemRoots() (*CertPool, error) {
+	certFilePath, certDirPath := os.Getenv(certFileEnv), os.Getenv(certDirEnv)
+
+	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" || runtime.GOOS == "ios" {
+		if certFilePath == "" && certDirPath == "" {
+			return &CertPool{systemPool: true}, nil
+		}
+		if x509sslcertoverrideplatform.Value() == "0" {
+			x509sslcertoverrideplatform.IncNonDefault()
+			return &CertPool{systemPool: true}, nil
+		}
+	}
+
+	return loadOnDiskRoots(certFilePath, certDirPath)
+}
+
+func loadOnDiskRoots(certFilePath, certDirPath string) (*CertPool, error) {
+	roots := NewCertPool()
+
+	files := certFiles
+	if certFilePath != "" {
+		files = []string{certFilePath}
+	}
+
+	var firstErr error
+	for _, file := range files {
+		data, err := os.ReadFile(file)
+		if err == nil {
+			roots.AppendCertsFromPEM(data)
+			break
+		}
+		if firstErr == nil && !os.IsNotExist(err) {
+			firstErr = err
+		}
+	}
+
+	dirs := certDirectories
+	if certDirPath != "" {
+		// OpenSSL and BoringSSL both use ":" as the SSL_CERT_DIR separator on
+		// Unix-like systems, and ";" on Windows.
+		// See:
+		//  * https://golang.org/issue/35325
+		//  * https://docs.openssl.org/4.0/man1/openssl-rehash/#environment
+		dirs = filepath.SplitList(certDirPath)
+	}
+
+	for _, directory := range dirs {
+		fis, err := readUniqueDirectoryEntries(directory)
+		if err != nil {
+			if firstErr == nil && !os.IsNotExist(err) {
+				firstErr = err
+			}
+			continue
+		}
+		for _, fi := range fis {
+			data, err := os.ReadFile(filepath.Join(directory, fi.Name()))
+			if err == nil {
+				roots.AppendCertsFromPEM(data)
+			}
+		}
+	}
+
+	if roots.len() > 0 || firstErr == nil {
+		return roots, nil
+	}
+
+	return nil, firstErr
+}
+
+// readUniqueDirectoryEntries is like os.ReadDir but omits
+// symlinks that point within the directory.
+func readUniqueDirectoryEntries(dir string) ([]fs.DirEntry, error) {
+	files, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, err
+	}
+	uniq := files[:0]
+	for _, f := range files {
+		if !isSameDirSymlink(f, dir) {
+			uniq = append(uniq, f)
+		}
+	}
+	return uniq, nil
+}
+
+// isSameDirSymlink reports whether f in dir is a symlink with a
+// target not containing a slash.
+func isSameDirSymlink(f fs.DirEntry, dir string) bool {
+	if f.Type()&fs.ModeSymlink == 0 {
+		return false
+	}
+	target, err := os.Readlink(filepath.Join(dir, f.Name()))
+	return err == nil && !strings.ContainsRune(target, filepath.Separator)
+}

package/bin/go/src/crypto/x509/root_darwin.go

@@ -10,6 +10,9 @@ import (
 	"fmt"
 )
 
+// macOS has no default SSL_CERT_{FILE,DIR} paths.
+var certFiles, certDirectories []string
+
 func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate, err error) {
 	certs := macos.CFArrayCreateMutable()
 	defer macos.ReleaseCFArray(certs)
@@ -86,11 +89,16 @@ func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate
 		}
 		chain[0] = append(chain[0], cert)
 	}
+
 	if len(chain[0]) == 0 {
 		// This should _never_ happen, but to be safe
 		return nil, errors.New("x509: macos certificate verification internal error")
 	}
 
+	if containsDistrustedSPKIHash(chain[0]) {
+		return nil, CertificateInvalidError{c, NoValidChains, ""}
+	}
+
 	if opts.DNSName != "" {
 		// If we have a DNS name, apply our own name verification
 		if err := chain[0][0].VerifyHostname(opts.DNSName); err != nil {
@@ -125,7 +133,3 @@ func exportCertificate(cert macos.CFRef) (*Certificate, error) {
 	}
 	return ParseCertificate(data)
 }
-
-func loadSystemRoots() (*CertPool, error) {
-	return &CertPool{systemPool: true}, nil
-}