Log message:
go: update to 1.21.13 and 1.22.6

go1.21.13 (released 2024-08-06) includes fixes to the go command, the covdata
command, and the bytes package.

go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler,
the linker, the trace command, the covdata command, and the bytes, go/types, and
os/exec packages.

Log message:
go-bin: add FreeBSD binaries

go14 does not build on FreeBSD 14, so the bootstrap from source does not
work. Thus, use go-bin for bootstrapping on FreeBSD 14.

Log message:
lang/go/go-dep.mk: Add a warning not to use this any more.

Does it even make sense to keep?  Do we still have users?  I don't
see any in a cursory skim for GO_DEPS -- last one to use that looks
like it was databases/influxdb, which was migrated to go-module.mk
back in 2021.

Log message:
go: update to 1.22.5 and 1.21.12 (security)

These minor releases include 1 security fix following the security policy:

net/http: denial of service due to improper 100-continue handling

The net/http HTTP/1.1 client mishandled the case where a server responds to a
request with an "Expect: 100-continue" header with a non-informational \ 
(200 or
higher) status. This mishandling could leave a client connection in an invalid
state, where the next request sent on the connection will fail.

An attacker sending a request to a net/http/httputil.ReverseProxy proxy can
exploit this mishandling to cause a denial of service by sending "Expect:
100-continue" requests which elicit a non-informational response from the
backend. Each such request leaves the proxy with an invalid connection, and
causes one subsequent request using that connection to fail.

Thanks to Geoff Franks for reporting this issue.

This is CVE-2024-24791 and Go issue https://go.dev/issue/67555.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.22.5

Log message:
go122: update to 1.22.4 (security)

This minor release includes 2 security fixes following the security policy:

- archive/zip: mishandling of corrupt central directory record

  The archive/zip package's handling of certain types of invalid zip files
  differed from the behavior of most zip implementations. This misalignment
  could be exploited to create an zip file with contents that vary depending on
  the implementation reading the file. The archive/zip package now rejects
  files containing these errors.

  Thanks to Yufan You (@ouuan) for reporting this issue.

  This is CVE-2024-24789 and Go issue https://go.dev/issue/66869.

- net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected
  for IPv4-mapped IPv6 addresses, returning false for addresses which would
  return true in their traditional IPv4 forms.

  Thanks to Enze Wang of Alioth (@zer0yu) and Jianjun Chen of Zhongguancun Lab
  (@chenjj) for reporting this issue.

  This is CVE-2024-24790 and Go issue https://go.dev/issue/67680.

Log message:
go121: update to 1.21.11 (security)

This minor release includes 2 security fixes following the security policy:

- archive/zip: mishandling of corrupt central directory record

  The archive/zip package's handling of certain types of invalid zip files
  differed from the behavior of most zip implementations. This misalignment
  could be exploited to create an zip file with contents that vary depending on
  the implementation reading the file. The archive/zip package now rejects
  files containing these errors.

  Thanks to Yufan You (@ouuan) for reporting this issue.

  This is CVE-2024-24789 and Go issue https://go.dev/issue/66869.

- net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected
  for IPv4-mapped IPv6 addresses, returning false for addresses which would
  return true in their traditional IPv4 forms.

  Thanks to Enze Wang of Alioth (@zer0yu) and Jianjun Chen of Zhongguancun Lab
  (@chenjj) for reporting this issue.

  This is CVE-2024-24790 and Go issue https://go.dev/issue/67680.

Log message:
Flip default Go version to 1.22.

I did a bulk build with this applied a few weeks ago and fixed the two
broken packages.

ok gdt@

Log message:
go: fix typo

Log message:
go: do not unpack go modules by default

Before this change, they were unpacked into ${WRKDIR}, but the actual build
process started from the zip archives again, leading to two copies of the
files on disk; even worse, you could assume the extracted sources were
used and could be patched.

Now, only the main tar.gz will be extracted into ${WRKDIR} and other
files need to be added to GO_MODULE_EXTRACT to be extracted.

Adapt the couple packages that already patch go sources, or need other
files extracted.

With help from bsiegert, thanks!

Log message:
go: silence "extraction" step

For some packages, like grafana, it spams the terminal.