Log message:
Support UNLIMIT_RESOURCES for go packages.

Log message:
Update go113 to 1.13.9.

This release includes fixes to the go command, tools, the runtime,
the toolchain, and to the crypto/cypher package.

View the release notes for more information:
    https://golang.org/doc/devel/release.html#go1.13.minor

Log message:
Remove GO112_VERSION and GO111_VERSION.

Log message:
Update go114 to 1.14.1.

This release include fixes to the go command, tools, the runtime,
the toolchain, and to the crypto/cypher package.

View the release notes for more information:
    https://golang.org/doc/devel/release.html#go1.14.minor

Log message:
Update go113 to 1.13.8.

This release includes fixes to the runtime, the crypto/x509, and
net/http packages.

Log message:
Add a package for Go 1.14.

The default will remain at 1.13 for the next branch.

The latest Go release, version 1.14, arrives six months after Go 1.13. Most of
its changes are in the implementation of the toolchain, runtime, and libraries.
As always, the release maintains the Go 1 promise of compatibility. We expect
almost all Go programs to continue to compile and run as before.

See the release notes at https://golang.org/doc/go1.14.

Log message:
Update go112 to 1.12.7.

These releases include fixes to the runtime, the crypto/x509, and
net/http packages.

Log message:
Forcibly turn off Go module support.

We don't currently build any packages using modules, and the switch to
newer versions of Go has resulted in the default changing to modules
being sometimes enabled.
This now causes random packages to begin fetching from the Internet during
builds, which goes against pkgsrc policy.

Doesn't seem to harm the ability to build a random subset of the Go packages
in pkgsrc.

Log message:
Update go113 to 1.13.7 (security release).

Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte

On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.

The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.

Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue.

The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.

This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of
golang.org/x/crypto/cryptobyte.

Log message:
Update go112 to 1.12.16 (security release).

Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte

On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.

The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.

Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue.

The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.

This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of
golang.org/x/crypto/cryptobyte.