Log message:
Use Go 1.16 as the default version.

macOS on ARM has had 1.16 as the default already for a while. The next
branch should have it for all OSes. Some build breakage has been fixed
already in separate commits.

ok before freeze wiz@

Log message:
Update go115 to 1.15.10.

go1.15.8 (released 2021/02/04) includes fixes to the compiler, linker, runtime,
the go command, and the net/http package. See the Go 1.15.8 milestone on our
issue tracker for details.

go1.15.9 (released 2021/03/10) includes security fixes to the encoding/xml
package. See the Go 1.15.9 milestone on our issue tracker for details.

go1.15.10 (released 2021/03/11) includes fixes to the compiler, the go command,
and the net/http, os, syscall, and time packages. See the Go 1.15.10 milestone
on our issue tracker for details.

Log message:
Update go116 to 1.16.2.

go1.16.2 (released 2021/03/11) includes fixes to cgo, the compiler, linker,
the go command, and the syscall and time packages. See the Go 1.16.2 milestone
on our issue tracker for details.

Log message:
Update go116 to 1.16.1, fixing two security issues:

   - encoding/xml: infinite loop when using xml.NewTokenDecoder with a
   custom TokenReader

The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by
xml.NewTokenDecoder may enter an infinite loop when operating on a custom
xml.TokenReader which returns an EOF in the middle of an open XML element.

Thanks to Sam Whited for reporting this issue.

This issue is CVE-2021-27918 and Go issue golang.org/issue/44913.

   - archive/zip: panic when calling Reader.Open

The Reader.Open API, new in Go 1.16, will panic when used on a ZIP archive
containing files that start with "../".

This issue is CVE-2021-27919 and Go issue golang.org/issue/44916.

Log message:
go116: update to the final 1.16 release

I did not find a detailed changelog from rc1.

Log message:
Update go116 to 1.16 RC1.

This RC contains the recent security updates for Go and fixes a number
of bugs.

Log message:
Update go115 to 1.15.7.

* cmd/go: packages using cgo can cause arbitrary code execution at build time

The go command may execute arbitrary code at build time when cgo is in use on
Windows. This may occur when running “go get”, or any other command that builds
code. Only users who build untrusted code (and don’t execute it) are affected.

In addition to Windows users, this can also affect Unix users who have “.”
listed explicitly in their PATH and are running “go get” or build commands
outside of a module or with module mode disabled.

Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

This issue is CVE-2021-3115 and Go issue golang.org/issue/43783.

For more background on the cmd/go change and help deciding whether your own
programs might have similar issues, see our blog post at
https://blog.golang.org/path-security.

* crypto/elliptic: incorrect operations on the P-224 curve

The P224() Curve implementation can in rare circumstances generate incorrect
outputs, including returning invalid points from ScalarMult.

The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages
support P-224 ECDSA keys, but they are not supported by publicly trusted
certificate authorities. No other standard library or golang.org/x/crypto
package supports or uses the P-224 curve.

The incorrect output was found by the elliptic-curve-differential-fuzzer
project running on OSS-Fuzz and reported by Philippe Antoine (Catena cyber).

This issue is CVE-2021-3114 and Go issue golang.org/issue/43786.

Log message:
Update go114 to 1.14.14.

* cmd/go: packages using cgo can cause arbitrary code execution at build time

The go command may execute arbitrary code at build time when cgo is in use on
Windows. This may occur when running “go get”, or any other command that builds
code. Only users who build untrusted code (and don’t execute it) are affected.

In addition to Windows users, this can also affect Unix users who have “.”
listed explicitly in their PATH and are running “go get” or build commands
outside of a module or with module mode disabled.

Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

This issue is CVE-2021-3115 and Go issue golang.org/issue/43783.

For more background on the cmd/go change and help deciding whether your own
programs might have similar issues, see our blog post at
https://blog.golang.org/path-security.

* crypto/elliptic: incorrect operations on the P-224 curve

The P224() Curve implementation can in rare circumstances generate incorrect
outputs, including returning invalid points from ScalarMult.

The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages
support P-224 ECDSA keys, but they are not supported by publicly trusted
certificate authorities. No other standard library or golang.org/x/crypto
package supports or uses the P-224 curve.

The incorrect output was found by the elliptic-curve-differential-fuzzer
project running on OSS-Fuzz and reported by Philippe Antoine (Catena cyber).

This issue is CVE-2021-3114 and Go issue golang.org/issue/43786.

Log message:
Default to go116 on Darwin-*-aarch64

Log message:
Add a package for go116-1.16.beta1.

Normally, we would not package beta versions, except maybe in pkgsrc-wip.
This is different though, since 1.16.beta1 is the first Go version supporting
macOS on Apple Silicon.

Discussion about this was on tech-pkg@.