Log message:
lang/go/version.mk: Use ${TOOLBASE}, not ${PREFIX}, for GO.

This is the command used at compile-time to run the Go toolchain.

Preparation for cross-compiling golang packages.  No change for
native builds because in that case TOOLBASE and PREFIX are the same.

Log message:
lang/go/bootstrap.mk: Use ${TOOLBASE}, not ${PREFIX}.

Preparation for cross-compiling golang packages.  No change for
native builds because in that case TOOLBASE and PREFIX are the same.

Log message:
Update go122 to 1.22.11 and go123 to 1.23.5.

These minor releases include 2 security fixes following the security policy:

- crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

  A certificate with a URI which has a IPv6 address with a zone ID may
  incorrectly satisfy a URI name constraint that applies to the certificate
  chain.

  Certificates containing URIs are not permitted in the web PKI, so this
  only affects users of private PKIs which make use of URIs.

  Thanks to Juho Forsén of Mattermost for reporting this issue.

  This is CVE-2024-45341 and Go issue https://go.dev/issue/71156.

- net/http: sensitive headers incorrectly sent after cross-domain redirect

  The HTTP client drops sensitive headers after following a cross-domain
  redirect.  For example, a request to a.com/ containing an
  Authorization header which is redirected to b.com/ will not send that
  header to b.com.

  In the event that the client received a subsequent same-domain
  redirect, however, the sensitive headers would be restored. For
  example, a chain of redirects from a.com/, to b.com/1, and finally to
  b.com/2 would incorrectly send the Authorization header to b.com/2.

  Thanks to Kyle Seely for reporting this issue.

  This is CVE-2024-45336 and Go issue https://go.dev/issue/70530.

Log message:
go: Set GOTMPDIR.

Go uses TMPDIR for ephemeral objects, but unlike other compilers does not
clean up quickly enough, so even with a reasonably large tmpfs limit of 1G
some package builds can fail due to too many leftover objects.

Use the same directory as GOCACHE and ensure it is created after distfile
extraction.

Tested in a bulk build on SmartOS and confirmed to fix a number of package
builds.  No feedback on proposal to tech-pkg@.

Log message:
Update Go to 1.22.10, 1.23.4

go1.23.4 (released 2024-12-03) includes fixes to the compiler, the runtime, the
trace command, and the syscall package. See the Go 1.23.4 milestone on our
issue tracker for details.

go1.22.10 (released 2024-12-03) includes fixes to the runtime and the syscall
package. See the Go 1.22.10 milestone on our issue tracker for details.

Log message:
go: update to 1.22.9 and 1.23.2.

go1.23.3 (released 2024-11-06) includes fixes to the linker, the runtime, and
the net/http, os, and syscall packages. See the Go 1.23.3 milestone on our
issue tracker for details.

go1.22.9 (released 2024-11-06) includes fixes to the linker. See the Go 1.22.9
milestone on our issue tracker for details.

Log message:
go: Fix the telemetry stuff.

Didn't work for packages that set GO_VERSION_REQD.

Log message:
Set default Go version to 1.23.

Re-add the "go telemetry off" line that caused some breakage, but guarded
to be 1.23-only.

The only package that's still unfixed with 1.23 is wireguard-go, which does
not have a fix available upstream.