feat(golang): source Azure Linux golang from the Microsoft build of Go

[Nan Liu (liunan-ms)]

Summary

Azure Linux 4.0 ships a single golang toolchain sourced from the Microsoft build of Go (1.26.5-2) instead of Fedora upstream. It is built with Fedora's golang packaging (F44, pinned 77411fa) to preserve the full subpackage split (golang, -bin, -src, -docs, -misc, -tests) and remain a drop-in for consumers that BuildRequire golang-bin / golang-src.

Changes

• Source swap — replace the Fedora golang spec Source0 with the Microsoft build of Go release archive (go1.26.5-20260709.6.src.tar.gz, SHA256 52aafddac2d7c6245d7759e65021197dc385732d4a7aefb4f15f064d0e3babfe).
• Compatibility — add Provides: msft-golang; keep the standard golang/go provides.
• Crypto backend — build all tools on Microsoft Go's default systemcrypto (OpenSSL) backend with GOEXPERIMENT=nodwarf5 (Azure Linux debugedit compatibility), bootstrapping from the distro golang toolchain.
• Runtime Requires (auto dep generation disabled via __find_requires) — add runtime dependencies: openssl, SymCrypt >= 103.6.0-1, SymCrypt-OpenSSL >= 1.6.1-1.
• Test skips — crypto/rsa PSS and testing/cryptotest ML-KEM tests that fail under the OpenSSL backend with system OpenSSL 3.5.
• Telemetry off by default — flip the Microsoft build of Go toolchain telemetry gate to opt-in (MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1). The cmd/go script-test harness enables it for its go subprocesses so the telemetry suite still passes.

Validation

• Full golang build passes with %check enabled — the entire Go + cmd/go test suite is green, including the 122 cmd/go TestScript cases affected by the telemetry change.
• Produces golang{,-bin,-docs,-misc,-src,-tests}-1.26.5-3.azl4.
• Runtime dependencies resolve against the in-repo openssl / SymCrypt / SymCrypt-OpenSSL packages; the toolchain reports go1.26.5-X:nodwarf5.
• Locks and rendered specs are self-consistent (Check Rendered Specs and Update Locks clean).
• Locally built 14 build-time dependent components and 4 runtime dependents (All 4 packages are installed cleanly alongside Microsoft build of Go).

Notes

• Two dependents that break on the toolchain swap are being handled separately (not in this PR): swig (drop a vestigial BuildRequires: golang-shared) and libcap (%check needs CGO_REQUIRED=1).

[Copilot]

Pull request overview

Switches Azure Linux’s Go toolchain to Microsoft build of Go 1.26.5-2 while retaining Fedora’s package layout.

Changes:

• Pins Fedora 44 packaging and Microsoft build of Go sources.
• Adds system-crypto dependencies and disables shared stdlib.
• Adds DWARF, crypto-test, and telemetry patches.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
base/comps/golang/golang.comp.toml	Defines source swap and overlays.
base/comps/golang/0001-Set-nodwarf5-in-go.env.patch	Defaults to DWARF v4.
base/comps/golang/0002-Skip-openssl-incompatible-crypto-tests.patch	Skips incompatible crypto tests.
base/comps/golang/0003-Disable-msft-go-telemetry-by-default.patch	Makes Microsoft telemetry opt-in.
locks/golang.lock	Pins Fedora 44 packaging inputs.
specs/g/golang/golang.spec	Renders the updated package definition.
specs/g/golang/sources	Records the Microsoft archive checksum.
specs/g/golang/0001-Set-nodwarf5-in-go.env.patch	Renders the DWARF patch.
specs/g/golang/0002-Skip-openssl-incompatible-crypto-tests.patch	Renders crypto-test exclusions.
specs/g/golang/0003-Disable-msft-go-telemetry-by-default.patch	Renders telemetry changes.
specs/g/golang/0001-Modify-go.env.patch	Removes the superseded Fedora patch.
specs/g/golang/0006-Default-to-ld.bfd-on-ARM64.patch	Removes an upstream-obsolete patch.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Nan Liu (liunan-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated no new comments.

Suppressed comments (2)

base/comps/golang/golang.comp.toml:22

• These non-trivial compatibility, test-suppression, and telemetry overlays lack overlay metadata. Add category and upstream-status/drop-condition metadata (or move related entries into overlay documents with shared metadata) so future Fedora/Go updates can determine why each divergence exists and when it can be removed.

    { description = "Retain Azure Linux's DWARF compatibility setting in Microsoft build of Go", type = "patch-add", source = "0001-Set-nodwarf5-in-go.env.patch" },
    { description = "Skip crypto/rsa PSS and testing/cryptotest ML-KEM tests that fail under the Microsoft build of Go OpenSSL crypto backend", type = "patch-add", source = "0002-Skip-openssl-incompatible-crypto-tests.patch" },
    { description = "Disable Microsoft build of Go toolchain telemetry by default (opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1)", type = "patch-add", source = "0003-Disable-msft-go-telemetry-by-default.patch" },

specs/g/golang/golang.spec:565

• This generated changelog still records Local changes (uncommitted) and resolves the package as 1.26.5-4, contradicting the PR's claim that rendered specs are clean and that the RPM is 1.26.5-3. A clean CI render will replace this entry and differ from the checked-in spec. Re-render after committing and amend the generated files; then update the validation version if -4 is the intended final release.

* Mon Aug 10 2026 azldev <azldev@local> - 1.26.5-4
- Local changes (uncommitted)

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated no new comments.

Suppressed comments (3)

base/comps/golang/0002-Skip-openssl-incompatible-crypto-tests.patch:32

• This top-level skip suppresses every TestSetGlobalRandom subtest, including the rand.Read, rand.Reader, ECDSA, and cryptocustomrand checks; only the nested mlkem.GenerateKey768 case is described as incompatible. Keep the other coverage by moving the skip into that ML-KEM subtest (or adapting only its expectation).

+	t.Skip("Azure Linux: skipped for the Microsoft build of Go OpenSSL crypto backend; ML-KEM key generation does not consume the deterministic test RNG")

base/comps/golang/0003-Disable-msft-go-telemetry-by-default.patch:28

• The telemetry suite is forced onto the opt-in path below, so it never verifies the newly introduced default-off policy. Add a test with this variable unset (and preferably with non-1 values) that asserts no App Insights request is recorded; otherwise a later regression back to default-on would still leave the suite green.

+	if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") != "1" {
+		// Azure Linux: Microsoft build of Go toolchain telemetry is off by default; opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1.

base/comps/golang/golang.comp.toml:6

• These non-trivial overlays do not include the category and upstream-status metadata required by the repository overlay guidance (.agents/skills/azldev-overlays/SKILL.md). Add per-overlay metadata, or group related changes into overlay files with shared metadata, so platform adaptations and test skips have explicit provenance and removal criteria.

overlays = [

[Copilot]

Pull request overview

Copilot reviewed 18 out of 19 changed files in this pull request and generated no new comments.

Suppressed comments (4)

base/comps/golang/overlays/0005-build-against-microsoft-build-of-go.overlay.toml:9

• Go 1.26 requires Go 1.24.6 or later as its bootstrap toolchain, so this lower bound also admits 1.24.0–1.24.5 even though make.bash rejects them. Encode the actual minimum to keep dependency resolution from selecting an unsupported bootstrap compiler.

replacement = "BuildRequires:  golang >= 1.24"

base/comps/golang/golang.comp.toml:11

• The replacement archive vendors Microsoft-specific telemetry code such as github.com/microsoft/go-infra/telemetry, which is MIT-licensed, while the rendered spec still declares only BSD-3-Clause and Fedora Public Domain. Audit the replacement archive's added vendored licenses and update the License tag through an overlay (and ensure the corresponding license texts are packaged), otherwise the RPM metadata is incomplete.

origin = { type = "download", uri = "https://github.com/microsoft/go/releases/download/v1.26.5-2/go1.26.5-20260709.6.src.tar.gz" }

specs/g/golang/golang.spec:148

• These bundled-module Provides still omit the Microsoft source's direct github.com/microsoft/go-infra/telemetry modules, even though the App Insights code imports and vendors them. Regenerate the bundled dependency metadata from the replacement archive and carry the Microsoft modules (with their exact versions) through component overlays so RPM vulnerability tracking reflects the shipped code.

Provides: bundled(golang(github.com/google/pprof)) = 0.0.0.20251114195745.4902fdda35c8

base/comps/golang/0007-Disable-msft-go-telemetry-by-default.patch:28

• The new privacy-sensitive default is not exercised: the same patch forces MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 for every script test, so %check only validates the opt-in path. Add a test that runs go build/install/run with the variable unset (and ideally a non-1 value) and verifies that the fake App Insights server receives no new request, while retaining coverage for explicit opt-in.

+	if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") != "1" {
+		// Azure Linux: Microsoft build of Go toolchain telemetry is off by default; opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1.

[Nan Liu (liunan-ms)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[Tobias Brick (tobiasb-ms)]

question(blocking): Does this really require openssl, or can it rely just on openssl-libs?

[Tobias Brick (tobiasb-ms)]

issue(blocking): I think that the version of SymCrypt-OpenSSL we have supports ML-KEM.