Update to Go 1.26.5

VERSION

@@ -1,2 +1,2 @@
-go1.26.4
-time 2026-05-29T15:26:39Z
+go1.26.5
+time 2026-07-01T21:24:27Z

src/cmd/compile/internal/ppc64/ssa.go

@@ -135,6 +135,7 @@ func ssaGenValue(s *ssagen.State, v *ssa.Value) {
 		// AND/OR	Rarg1, Rtmp
 		// STBCCC/STWCCC Rtmp, (Rarg0)
 		// BNE		-3(PC)
+		// LWSYNC
 		ld := ppc64.ALBAR
 		st := ppc64.ASTBCCC
 		if v.Op == ssa.OpPPC64LoweredAtomicAnd32 || v.Op == ssa.OpPPC64LoweredAtomicOr32 {
@@ -170,6 +171,10 @@ func ssaGenValue(s *ssagen.State, v *ssa.Value) {
 		p3 := s.Prog(ppc64.ABNE)
 		p3.To.Type = obj.TYPE_BRANCH
 		p3.To.SetTarget(p)
+		// LWSYNC - Provide acquire ordering to pair with the
+		// release (pre-LWSYNC) above, making the operation
+		// sequentially consistent.
+		s.Prog(ppc64.ALWSYNC)
 
 	case ssa.OpPPC64LoweredAtomicAdd32,
 		ssa.OpPPC64LoweredAtomicAdd64:
@@ -179,6 +184,7 @@ func ssaGenValue(s *ssagen.State, v *ssa.Value) {
 		// STDCCC/STWCCC Rout, (Rarg0)
 		// BNE         -3(PC)
 		// MOVW		Rout,Rout (if Add32)
+		// LWSYNC
 		ld := ppc64.ALDAR
 		st := ppc64.ASTDCCC
 		if v.Op == ssa.OpPPC64LoweredAtomicAdd32 {
@@ -188,10 +194,10 @@ func ssaGenValue(s *ssagen.State, v *ssa.Value) {
 		r0 := v.Args[0].Reg()
 		r1 := v.Args[1].Reg()
 		out := v.Reg0()
-		// LWSYNC - Assuming shared data not write-through-required nor
-		// caching-inhibited. See Appendix B.2.2.2 in the ISA 2.07b.
-		plwsync := s.Prog(ppc64.ALWSYNC)
-		plwsync.To.Type = obj.TYPE_NONE
+		// LWSYNC - Provide acquire ordering to pair with the
+		// release (pre-LWSYNC) above, making the operation
+		// sequentially consistent.
+		s.Prog(ppc64.ALWSYNC)
 		// LDAR or LWAR
 		p := s.Prog(ld)
 		p.From.Type = obj.TYPE_MEM
@@ -223,6 +229,11 @@ func ssaGenValue(s *ssagen.State, v *ssa.Value) {
 			p5.From.Type = obj.TYPE_REG
 			p5.From.Reg = out
 		}
+		// LWSYNC - Provide acquire ordering to pair with the
+		// release (pre-LWSYNC) above, making the operation
+		// sequentially consistent.
+		plwsync2 := s.Prog(ppc64.ALWSYNC)
+		plwsync2.To.Type = obj.TYPE_NONE
 
 	case ssa.OpPPC64LoweredAtomicExchange8,
 		ssa.OpPPC64LoweredAtomicExchange32,

src/cmd/go/internal/modindex/read.go

@@ -681,7 +681,7 @@ func (rp *IndexPackage) Import(bctxt build.Context, mode build.ImportMode) (p *b
 // and otherwise falling back to internal/goroot.IsStandardPackage
 func IsStandardPackage(goroot_, compiler, path string) bool {
 	if !enabled || compiler != "gc" {
-		return goroot.IsStandardPackage(goroot_, compiler, path)
+		return goroot.IsStandardPackage(fsys.ReadDir, goroot_, compiler, path)
 	}
 
 	reldir := filepath.FromSlash(path) // relative dir path in module index for package
@@ -696,7 +696,7 @@ func IsStandardPackage(goroot_, compiler, path string) bool {
 	} else if errors.Is(err, ErrNotIndexed) {
 		// Fall back because package isn't indexable. (Probably because
 		// a file was modified recently)
-		return goroot.IsStandardPackage(goroot_, compiler, path)
+		return goroot.IsStandardPackage(fsys.ReadDir, goroot_, compiler, path)
 	}
 	return false
 }

src/cmd/go/testdata/mod/example.com_importcrypto_v1.0.0.txt

@@ -0,0 +1,19 @@
+example.com/importcrypto contains a package that imports crypto/sha256
+It's used by the script test case mod_get_fips140_issue73649
+
+-- .info --
+{"Version":"v1.0.0"}
+-- .mod --
+module example.com/importcrypto
+
+go 1.27
+-- go.mod --
+module example.com/importcrypto
+
+go 1.27
+-- importcypto.go --
+package p
+
+import _ "crypto/sha256"
+
+func main() {}

src/cmd/go/testdata/script/mod_get_fips140_issue73649.txt

@@ -0,0 +1,10 @@
+[GOEXPERIMENT:boringcrypto] skip
+
+env GOFIPS140=v1.0.0
+env GOCACHE=$WORK/cache
+go get example.com/importcrypto
+
+-- go.mod --
+module m
+
+go 1.24

src/crypto/tls/handshake_messages.go

@@ -5,6 +5,7 @@
 package tls
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"slices"
@@ -317,7 +318,8 @@ func (m *clientHelloMsg) marshalMsg(echInner bool) ([]byte, error) {
 			})
 		})
 	}
-	if len(m.pskIdentities) > 0 { // pre_shared_key must be the last extension
+	// pre_shared_key must be the last extension
+	if len(m.pskIdentities) > 0 && (echInner || len(m.encryptedClientHello) == 0 || bytes.Equal(m.encryptedClientHello, []byte{byte(innerECHExt)})) {
 		// RFC 8446, Section 4.2.11
 		exts.AddUint16(extensionPreSharedKey)
 		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {

src/crypto/tls/handshake_messages_test.go

@@ -215,7 +215,16 @@ func (*clientHelloMsg) Generate(rand *rand.Rand, size int) reflect.Value {
 	case 2:
 		m.pskModes = []uint8{pskModeDHE, pskModePlain}
 	}
-	for i := 0; i < rand.Intn(5); i++ {
+	// clientHelloMsg.marshal uses echInner == false. If m.encryptedClientHello > 0 and
+	// does not equal []byte{innerECHExt}, then the psk extension will be omitted,
+	// so either only emit empty encryptedClientHello and psk, encryptedClientHello with
+	// []byte{innerECHExt} and psk, or random encryptedClientHello and no psk.
+	if rand.Intn(10) > 5 {
+		m.encryptedClientHello = randomBytes(rand.Intn(50)+1, rand)
+	} else {
+		if rand.Intn(10) > 5 {
+			m.encryptedClientHello = []byte{byte(innerECHExt)}
+		}
 		var psk pskIdentity
 		psk.obfuscatedTicketAge = uint32(rand.Intn(500000))
 		psk.label = randomBytes(rand.Intn(500)+1, rand)
@@ -228,9 +237,6 @@ func (*clientHelloMsg) Generate(rand *rand.Rand, size int) reflect.Value {
 	if rand.Intn(10) > 5 {
 		m.earlyData = true
 	}
-	if rand.Intn(10) > 5 {
-		m.encryptedClientHello = randomBytes(rand.Intn(50)+1, rand)
-	}
 
 	return reflect.ValueOf(m)
 }
@@ -587,3 +593,88 @@ func TestRejectDuplicateExtensions(t *testing.T) {
 		t.Fatal("Unmarshaled ServerHello with duplicate extensions")
 	}
 }
+
+func TestECHRemoveOuterPSK(t *testing.T) {
+	r := rand.New(rand.NewSource(0))
+
+	for _, tc := range []struct {
+		name          string
+		echInner      bool
+		echExt        []byte
+		expectRemoved bool
+	}{
+		{
+			name:          "echInner true",
+			echInner:      true,
+			expectRemoved: false,
+		},
+		{
+			name:          "echInner true, no ech ext",
+			echInner:      true,
+			expectRemoved: false,
+		},
+		{
+			name:          "echInner true, ech ext present",
+			echInner:      true,
+			echExt:        []byte{254},
+			expectRemoved: false,
+		},
+		{
+			name:          "echInner true, ech ext present, inner ech sentinel",
+			echInner:      true,
+			echExt:        []byte{byte(innerECHExt)},
+			expectRemoved: false,
+		},
+		{
+			name:          "echInner false, no ech ext",
+			echInner:      false,
+			expectRemoved: false,
+		},
+		{
+			name:          "echInner false, ech ext present",
+			echInner:      false,
+			echExt:        []byte{254},
+			expectRemoved: true,
+		},
+		{
+			name:          "echInner false, ech ext present, inner ech sentinel",
+			echInner:      false,
+			echExt:        []byte{byte(innerECHExt)},
+			expectRemoved: false,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ch := (&clientHelloMsg{}).Generate(r, 0).Interface().(*clientHelloMsg)
+
+			ch.pskBinders = [][]byte{[]byte("test")}
+			ch.pskIdentities = []pskIdentity{{label: []byte("test")}}
+			ch.encryptedClientHello = tc.echExt
+
+			b, err := ch.marshalMsg(tc.echInner)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var rch clientHelloMsg
+			if !rch.unmarshal(b) {
+				t.Fatal("Failed to unmarshal ClientHello")
+			}
+
+			if tc.expectRemoved {
+				if rch.pskIdentities != nil {
+					t.Error("expected PSK identities to be removed")
+				}
+				if rch.pskBinders != nil {
+					t.Error("expected PSK binders to be removed")
+				}
+			} else {
+				if rch.pskIdentities == nil {
+					t.Error("expected PSK identities to be present")
+				}
+				if rch.pskBinders == nil {
+					t.Error("expected PSK binders to be present")
+				}
+			}
+		})
+	}
+
+}

src/crypto/tls/tls_test.go

@@ -2379,6 +2379,7 @@ func TestECH(t *testing.T) {
 	clientConfig.RootCAs.AddCert(secretCert)
 	clientConfig.RootCAs.AddCert(publicCert)
 	clientConfig.EncryptedClientHelloConfigList = echConfigList
+	clientConfig.ClientSessionCache = NewLRUClientSessionCache(2)
 	serverConfig.InsecureSkipVerify = false
 	serverConfig.Rand = rand.Reader
 	serverConfig.Time = nil

src/go/build/build.go

@@ -746,7 +746,7 @@ func (ctxt *Context) Import(path string, srcDir string, mode ImportMode) (*Packa
 				}
 				tried.goroot = dir
 			}
-			if ctxt.Compiler == "gccgo" && goroot.IsStandardPackage(ctxt.GOROOT, ctxt.Compiler, path) {
+			if ctxt.Compiler == "gccgo" && goroot.IsStandardPackage(os.ReadDir, ctxt.GOROOT, ctxt.Compiler, path) {
 				// TODO(bcmills): Setting p.Dir here is misleading, because gccgo
 				// doesn't actually load its standard-library packages from this
 				// directory. See if we can leave it unset.

src/internal/goroot/gc.go

@@ -15,12 +15,12 @@ import (
 )
 
 // IsStandardPackage reports whether path is a standard package,
-// given goroot and compiler.
-func IsStandardPackage(goroot, compiler, path string) bool {
+// given goroot and compiler. readDir accepts OS filesystem paths.
+func IsStandardPackage(readDir func(string) ([]os.DirEntry, error), goroot, compiler, path string) bool {
 	switch compiler {
 	case "gc":
 		dir := filepath.Join(goroot, "src", path)
-		dirents, err := os.ReadDir(dir)
+		dirents, err := readDir(dir)
 		if err != nil {
 			return false
 		}

src/internal/runtime/atomic/atomic_ppc64x.s

@@ -220,6 +220,7 @@ TEXT ·Xadd(SB), NOSPLIT, $0-20
 	ADD	R5, R3
 	STWCCC	R3, (R4)
 	BNE	-3(PC)
+	LWSYNC
 	MOVW	R3, ret+16(FP)
 	RET
 
@@ -235,6 +236,7 @@ TEXT ·Xadd64(SB), NOSPLIT, $0-24
 	ADD	R5, R3
 	STDCCC	R3, (R4)
 	BNE	-3(PC)
+	LWSYNC
 	MOVD	R3, ret+16(FP)
 	RET
 
@@ -343,6 +345,7 @@ again:
 	OR	R4, R6
 	STBCCC	R6, (R3)
 	BNE	again
+	LWSYNC
 	RET
 
 // void ·And8(byte volatile*, byte);
@@ -355,6 +358,7 @@ again:
 	AND	R4, R6
 	STBCCC	R6, (R3)
 	BNE	again
+	LWSYNC
 	RET
 
 // func Or(addr *uint32, v uint32)
@@ -367,6 +371,7 @@ again:
 	OR	R4, R6
 	STWCCC	R6, (R3)
 	BNE	again
+	LWSYNC
 	RET
 
 // func And(addr *uint32, v uint32)
@@ -379,6 +384,7 @@ again:
 	AND	R4, R6
 	STWCCC	R6, (R3)
 	BNE	again
+	LWSYNC
 	RET
 
 // func Or32(addr *uint32, v uint32) old uint32
@@ -391,6 +397,7 @@ again:
 	OR	R4, R6, R7
 	STWCCC	R7, (R3)
 	BNE	again
+	LWSYNC
 	MOVW	R6, ret+16(FP)
 	RET
 
@@ -404,6 +411,7 @@ again:
 	AND	R4, R6, R7
 	STWCCC	R7, (R3)
 	BNE	again
+	LWSYNC
 	MOVW	R6, ret+16(FP)
 	RET
 
@@ -417,6 +425,7 @@ again:
 	OR	R4, R6, R7
 	STDCCC	R7, (R3)
 	BNE	again
+	LWSYNC
 	MOVD	R6, ret+16(FP)
 	RET
 
@@ -430,6 +439,7 @@ again:
 	AND	R4, R6, R7
 	STDCCC	R7, (R3)
 	BNE	again
+	LWSYNC
 	MOVD	R6, ret+16(FP)
 	RET
 

src/internal/runtime/gc/scan/scan_amd64.go

@@ -38,4 +38,5 @@ var avx512ScanPackedReqsMet = cpu.X86.HasAVX512VL &&
 	cpu.X86.HasAVX512BW &&
 	cpu.X86.HasGFNI &&
 	cpu.X86.HasAVX512BITALG &&
+	cpu.X86.HasAVX512DQ && // for kmovb, see #79871
 	cpu.X86.HasAVX512VBMI

src/net/lookup_test.go

@@ -335,8 +335,8 @@ func TestLookupIPv6LinkLocalAddrWithZone(t *testing.T) {
 var lookupCNAMETests = []struct {
 	name, cname string
 }{
-	{"www.iana.org", "icann.org."},
-	{"www.iana.org.", "icann.org."},
+	{"www.golang.org", "golang.org."},
+	{"www.golang.org.", "golang.org."},
 	{"www.google.com", "google.com."},
 	{"google.com", "google.com."},
 	{"cname-to-txt.go4.org", "test-txt-record.go4.org."},

src/os/export_test.go

@@ -9,6 +9,7 @@ package os
 var Atime = atime
 var ErrWriteAtInAppendMode = errWriteAtInAppendMode
 var ErrPatternHasSeparator = errPatternHasSeparator
+var ErrPathEscapes = errPathEscapes
 
 func init() {
 	checkWrapErr = true