go.mod: update golang.org/x dependencies

Update golang.org/x dependencies to their latest tagged versions.

Change-Id: I93de641462a54b0ae565bb60e2a0e6e7c2c3b883
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/693999
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: David Chase <drchase@google.com>

acme/pebble_test.go

@@ -692,14 +692,14 @@ func startPebbleEnvironment(t *testing.T, config *environmentConfig) environment
 func waitForServer(t *testing.T, addr string) {
 	t.Helper()
 
-	for i := 0; i < 10; i++ {
+	for i := 0; i < 20; i++ {
 		if conn, err := net.Dial("tcp", addr); err == nil {
 			conn.Close()
 			return
 		}
 		time.Sleep(time.Duration(i*100) * time.Millisecond)
 	}
-	t.Fatalf("failed to connect to %q after 10 tries", addr)
+	t.Fatalf("failed to connect to %q after 20 tries", addr)
 }
 
 // fetchModule fetches the module at the given version and returns the directory
@@ -776,14 +776,29 @@ func prepareBinaries(t *testing.T, pebbleDir string) string {
 func spawnServerProcess(t *testing.T, dir string, cmd string, args ...string) {
 	t.Helper()
 
+	var stdout, stderr bytes.Buffer
+
 	cmdInstance := exec.Command("./"+cmd, args...)
 	cmdInstance.Dir = dir
-	cmdInstance.Stdout = os.Stdout
-	cmdInstance.Stderr = os.Stderr
+	cmdInstance.Stdout = &stdout
+	cmdInstance.Stderr = &stderr
+
 	if err := cmdInstance.Start(); err != nil {
 		t.Fatalf("failed to start %s: %v", cmd, err)
 	}
+
 	t.Cleanup(func() {
 		cmdInstance.Process.Kill()
+		cmdInstance.Wait()
+
+		if t.Failed() || testing.Verbose() {
+			t.Logf("=== %s output ===", cmd)
+			if stdout.Len() > 0 {
+				t.Logf("stdout:\n%s", strings.TrimSpace(stdout.String()))
+			}
+			if stderr.Len() > 0 {
+				t.Logf("stderr:\n%s", strings.TrimSpace(stderr.String()))
+			}
+		}
 	})
 }

go.mod

@@ -3,9 +3,9 @@ module golang.org/x/crypto
 go 1.23.0
 
 require (
-	golang.org/x/net v0.41.0 // tagx:ignore
-	golang.org/x/sys v0.34.0
-	golang.org/x/term v0.33.0
+	golang.org/x/net v0.42.0 // tagx:ignore
+	golang.org/x/sys v0.35.0
+	golang.org/x/term v0.34.0
 )
 
-require golang.org/x/text v0.27.0 // indirect
+require golang.org/x/text v0.28.0 // indirect

go.sum

@@ -1,8 +1,8 @@
-golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
-golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
-golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
-golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
-golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
-golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
-golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=

x509roots/fallback/bundle_test.go

@@ -0,0 +1,32 @@
+// Copyright 2025 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package fallback
+
+import (
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/hex"
+	"testing"
+)
+
+func TestBundle(t *testing.T) {
+	for i, unparsed := range unparsedCertificates {
+		cert, err := x509.ParseCertificate(rawCerts[unparsed.certStartOff : unparsed.certStartOff+unparsed.certLength])
+		if err != nil {
+			t.Errorf("ParseCertificate(unparsedCertificates[%v]) unexpected error: %v", i, err)
+			continue
+		}
+
+		if unparsed.cn != cert.Subject.String() {
+			t.Errorf("unparsedCertificates[%v].cn = %q; want = %q", i, unparsed.cn, cert.Subject.String())
+		}
+
+		sum := sha256.Sum256(cert.Raw)
+		sumHex := hex.EncodeToString(sum[:])
+		if sumHex != unparsed.sha256Hash {
+			t.Errorf("unparsedCertificates[%v].sha256Hash = %q; want = %q", i, unparsed.sha256Hash, sumHex)
+		}
+	}
+}

x509roots/fallback/fallback.go

@@ -20,11 +20,14 @@ package fallback
 
 import (
 	"crypto/x509"
-	"encoding/pem"
+	_ "embed"
 	"fmt"
 	"time"
 )
 
+//go:embed bundle.der
+var rawCerts []byte
+
 func init() {
 	x509.SetFallbackRoots(newFallbackCertPool())
 }
@@ -49,9 +52,10 @@ func newFallbackCertPool() *x509.CertPool {
 }
 
 type unparsedCertificate struct {
-	cn         string
-	sha256Hash string
-	pem        string
+	cn           string
+	sha256Hash   string
+	certStartOff int
+	certLength   int
 
 	// possible constraints
 	distrustAfter string
@@ -63,19 +67,9 @@ type parsedCertificate struct {
 }
 
 func mustParse(unparsedCerts []unparsedCertificate) []parsedCertificate {
-	var b []parsedCertificate
+	b := make([]parsedCertificate, 0, len(unparsedCerts))
 	for _, unparsed := range unparsedCerts {
-		block, rest := pem.Decode([]byte(unparsed.pem))
-		if block == nil {
-			panic(fmt.Sprintf("unexpected nil PEM block for %q", unparsed.cn))
-		}
-		if len(rest) != 0 {
-			panic(fmt.Sprintf("unexpected trailing data in PEM for %q", unparsed.cn))
-		}
-		if block.Type != "CERTIFICATE" {
-			panic(fmt.Sprintf("unexpected PEM block type for %q: %s", unparsed.cn, block.Type))
-		}
-		cert, err := x509.ParseCertificate(block.Bytes)
+		cert, err := x509.ParseCertificate(rawCerts[unparsed.certStartOff : unparsed.certStartOff+unparsed.certLength])
 		if err != nil {
 			panic(err)
 		}

x509roots/gen_fallback_bundle.go

@@ -11,7 +11,6 @@ package main
 import (
 	"bytes"
 	"crypto/sha256"
-	"encoding/pem"
 	"flag"
 	"fmt"
 	"go/format"
@@ -37,6 +36,7 @@ var (
 	certDataURL  = flag.String("certdata-url", "https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt", "URL to the raw certdata.txt file to parse (certdata-path overrides this, if provided)")
 	certDataPath = flag.String("certdata-path", "", "Path to the NSS certdata.txt file to parse (this overrides certdata-url, if provided)")
 	output       = flag.String("output", "fallback/bundle.go", "Path to file to write output to")
+	derOutput    = flag.String("deroutput", "fallback/bundle.der", "Path to file to write output to (DER certificate bundle)")
 )
 
 func main() {
@@ -92,8 +92,9 @@ func main() {
 		return subjI < subjJ
 	})
 
-	b := new(bytes.Buffer)
-	b.WriteString(tmpl)
+	rawCertsData := new(bytes.Buffer)
+	goSrcOut := new(bytes.Buffer)
+	goSrcOut.WriteString(tmpl)
 	for _, c := range certs {
 		var constraints []string
 		var skip bool
@@ -110,19 +111,24 @@ func main() {
 		if skip {
 			continue
 		}
-		fmt.Fprintf(b, "{\ncn: %q,\nsha256Hash: \"%x\",\npem: `%s`,\n",
+
+		off := rawCertsData.Len()
+		rawCertsData.Write(c.X509.Raw)
+
+		fmt.Fprintf(goSrcOut, "{\ncn: %q,\nsha256Hash: \"%x\",\ncertStartOff: %v,\ncertLength: %v,\n",
 			c.X509.Subject.String(),
 			sha256.Sum256(c.X509.Raw),
-			string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: c.X509.Raw})),
+			off,
+			len(c.X509.Raw),
 		)
 		for _, constraint := range constraints {
-			fmt.Fprintln(b, constraint)
+			fmt.Fprintln(goSrcOut, constraint)
 		}
-		fmt.Fprintln(b, "},")
+		fmt.Fprintln(goSrcOut, "},")
 	}
-	fmt.Fprintln(b, "}")
+	fmt.Fprintln(goSrcOut, "}")
 
-	formatted, err := format.Source(b.Bytes())
+	formatted, err := format.Source(goSrcOut.Bytes())
 	if err != nil {
 		log.Fatalf("failed to format source: %s", err)
 	}
@@ -130,4 +136,8 @@ func main() {
 	if err := os.WriteFile(*output, formatted, 0644); err != nil {
 		log.Fatalf("failed to write to %q: %s", *output, err)
 	}
+
+	if err := os.WriteFile(*derOutput, rawCertsData.Bytes(), 0644); err != nil {
+		log.Fatalf("failed to write to %q: %s", *output, err)
+	}
 }