[tor-bugs] #22398 [Applications/Tor Browser]: Upgrade Go to 1.7.6 / 1.8.3 (was: Upgrade Go to 1.8.3)

[Tor Bug Tracker & Wiki]

#22398: Upgrade Go to 1.7.6 / 1.8.3
----------------------------------------------+----------------------------
 Reporter:  yawning                           |          Owner:  tbb-team
     Type:  task                              |         Status:
                                              |  needs_review
 Priority:  Medium                            |      Milestone:
Component:  Applications/Tor Browser          |        Version:
 Severity:  Normal                            |     Resolution:
 Keywords:  tbb-gitian TorBrowserTeam201705R  |  Actual Points:
Parent ID:                                    |         Points:
 Reviewer:                                    |        Sponsor:
----------------------------------------------+----------------------------
Changes (by dcf):

 * keywords:  tbb-gitian => tbb-gitian TorBrowserTeam201705R
 * status:  new => needs_review


Old description:

> Minor release notes:
> https://golang.org/doc/devel/release.html#go1.8.minor
>
> This also should include: https://github.com/golang/go/issues/20040
>
> Certain parts of our code do use P-256, but it's probably not
> exploitable.  Updating is still a good idea.

New description:

 Minor release notes: https://golang.org/doc/devel/release.html#go1.7
 https://golang.org/doc/devel/release.html#go1.8.minor

 This also should include: https://github.com/golang/go/issues/20040

 Certain parts of our code do use P-256, but it's probably not exploitable.
 Updating is still a good idea.

--

Comment:

 The P-256 fix from 1.8.2 was also backported to 1.7.6.

 Here is a patch for current maint-6.5 that upgrades to 1.7.6. I tested a
 build on all platforms but only tested running on GNU/Linux.

 attachment:0001-Bug-22398-Upgrade-go-to-1.7.6.patch

 I'll start another build for 1.8.3 on the master branch.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22398#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online