msft-golang update to 1.24.1 for CVE-2025-22870, CVE-2024-45341, CVE-2024-45336, CVE-2024-34158 (microsoft#13240)

Author: anphel31

SPECS/msft-golang/msft-golang.signatures.json

@@ -2,7 +2,8 @@
     "Signatures": {
         "go.20230802.5.src.tar.gz": "56b9e0e0c3c13ca95d5efa6de4e7d49a9d190eca77919beff99d33cd3fa74e95",
         "go.20240206.2.src.tar.gz": "7982e0011aa9ab95fd0530404060410af4ba57326d26818690f334fdcb6451cd",
-        "go1.23.6-20250211.6.src.tar.gz": "94da38c20c9272b3f2e23f5605b2af36550a1acbc958f278bf2cfaa34491a58e",
+        "go1.22.12-20250211.4.src.tar.gz": "e1cc3bff8fdf1f24843ffc9f0eaddfd344eb40fd9ca0d9ba2965165be519eeb7",
+        "go1.24.1-20250304.4.src.tar.gz": "d3bba6c5f7ff729121d2104c250fe96e5a6d7c6cb555d4ea038cfe69524417f6",
         "go1.4-bootstrap-20171003.tar.gz": "f4ff5b5eb3a3cae1c993723f3eab519c5bae18866b5e5f96fe1102f0cb5c3e52"
     }
 }

SPECS/msft-golang/msft-golang.spec

@@ -1,8 +1,7 @@
 %global goroot          %{_libdir}/golang
 %global gopath          %{_datadir}/gocode
-%global ms_go_filename  go1.23.6-20250211.6.src.tar.gz
-%global ms_go_revision  2
-%global go_priority %(echo %{version}.%{ms_go_revision} | tr -d .)
+%global ms_go_filename  go1.24.1-20250304.4.src.tar.gz
+%global ms_go_revision  1
 %ifarch aarch64
 %global gohostarch      arm64
 %else
@@ -15,7 +14,7 @@
 %define __find_requires %{nil}
 Summary:        Go
 Name:           msft-golang
-Version:        1.23.6
+Version:        1.24.1
 Release:        1%{?dist}
 License:        BSD
 Vendor:         Microsoft Corporation
@@ -29,6 +28,8 @@ Source1:        https://github.com/microsoft/go/releases/download/v1.4.0-1/go1.4
 Source2:        https://github.com/microsoft/go/releases/download/v1.19.12-1/go.20230802.5.src.tar.gz
 # bootstrap 02
 Source3:        https://github.com/microsoft/go/releases/download/v1.20.14-1/go.20240206.2.src.tar.gz
+# bootstrap 03
+Source4:        https://github.com/microsoft/go/releases/download/v1.22.12-2/go1.22.12-20250211.4.src.tar.gz
 Patch0:         go14_bootstrap_aarch64.patch
 Conflicts:      go
 Conflicts:      golang
@@ -48,6 +49,9 @@ mv -v go go-bootstrap-01
 tar xf %{SOURCE3} --no-same-owner
 mv -v go go-bootstrap-02
 
+tar xf %{SOURCE4} --no-same-owner
+mv -v go go-bootstrap-03
+
 %setup -q -n go
 
 %build
@@ -81,6 +85,7 @@ function go_bootstrap() {
 go_bootstrap 00
 go_bootstrap 01
 go_bootstrap 02
+go_bootstrap 03
 
 # Build current go version
 export GOHOSTOS=linux
@@ -154,6 +159,9 @@ fi
 %{_bindir}/*
 
 %changelog
+* Mon Mar 31 2025 Andrew Phelps <[email protected]> - 1.24.1-1
+- Bump version to 1.24.1 to address CVE-2025-22870, CVE-2024-45341, CVE-2024-45336, CVE-2024-34158
+
 * Tue Feb 18 2025 Kanishk Bansal <[email protected]> - 1.23.6-1
 - Bump version to 1.23.6 to resolve CVE-2025-25199
 - Clean up the existing patches

cgmanifest.json

@@ -13663,8 +13663,8 @@
         "type": "other",
         "other": {
           "name": "msft-golang",
-          "version": "1.23.6",
-          "downloadUrl": "https://github.com/microsoft/go/releases/download/v1.23.6-2/go1.23.6-20250211.6.src.tar.gz"
+          "version": "1.24.1",
+          "downloadUrl": "https://github.com/microsoft/go/releases/download/v1.24.1-1/go1.24.1-20250304.4.src.tar.gz"
         }
       }
     },