feat(golang): source Azure Linux golang from the Microsoft build of Go

base/comps/golang/0001-Set-nodwarf5-in-go.env.patch

@@ -0,0 +1,13 @@
+diff --git a/go.env b/go.env
+--- a/go.env
++++ b/go.env
+@@ -12,3 +12,6 @@ GOSUMDB=sum.golang.org
+ # to a Go toolchain not built by Microsoft, and we want to avoid that.
+ # See https://go.dev/doc/toolchain for details.
+ GOTOOLCHAIN=local
++
++# Keep DWARF v4 until Azure Linux debugedit supports DWARF v5.
++GOEXPERIMENT=nodwarf5
+
+--
+2.50.1

base/comps/golang/0002-Skip-openssl-incompatible-crypto-tests.patch

@@ -0,0 +1,35 @@
+Skip crypto tests incompatible with the Microsoft Go OpenSSL backend
+
+TestPSSGolden/TestPSSSigning use SHA-1 RSA-PSS, which the system OpenSSL
+provider rejects. TestSetGlobalRandom asserts a golden ML-KEM key from a
+deterministic RNG that the OpenSSL backend does not consume. These are
+backend policy differences, not defects.
+---
+--- a/src/crypto/rsa/pss_test.go	2026-08-03 22:47:04.746315785 +0000
++++ b/src/crypto/rsa/pss_test.go	2026-08-03 22:47:04.746315785 +0000
+@@ -26,6 +26,7 @@
+ // TestPSSGolden tests all the test vectors in pss-vect.txt from
+ // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip
+ func TestPSSGolden(t *testing.T) {
++	t.Skip("Azure Linux: skipped for the Microsoft Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS")
+ 	inFile, err := os.Open("testdata/pss-vect.txt.bz2")
+ 	if err != nil {
+ 		t.Fatalf("Failed to open input file: %s", err)
+@@ -153,6 +154,7 @@
+ }
+
+ func TestPSSSigning(t *testing.T) {
++	t.Skip("Azure Linux: skipped for the Microsoft Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS")
+ 	var saltLengthCombinations = []struct {
+ 		signSaltLength, verifySaltLength int
+ 		good, fipsGood                   bool
+--- a/src/testing/cryptotest/rand_test.go	2026-08-03 22:47:04.766315745 +0000
++++ b/src/testing/cryptotest/rand_test.go	2026-08-03 22:47:04.766315745 +0000
+@@ -17,6 +17,7 @@
+ )
+
+ func TestSetGlobalRandom(t *testing.T) {
++	t.Skip("Azure Linux: skipped for the Microsoft Go OpenSSL crypto backend; ML-KEM key generation does not consume the deterministic test RNG")
+ 	seed1, _ := hex.DecodeString("6ae6783f4fbde91b6eb88b73a48ed247dbe5882e2579683432c1bfc525454add" +
+ 		"0cd87274d67084caaf0e0d36c8496db7fef55fe0e125750aa608d5e20ffc2d12")
+

base/comps/golang/0003-Disable-msft-go-telemetry-by-default.patch

@@ -0,0 +1,37 @@
+Disable Microsoft Go toolchain telemetry by default
+
+Azure Linux ships the Microsoft build of Go with the Microsoft-specific
+AppInsights telemetry turned off by default. Upstream starts it for
+`go build`, `go install`, and `go run` unless the environment variable
+MS_GOTOOLCHAIN_TELEMETRY_ENABLED=0 is set. That variable is read with
+os.Getenv (not the `go env` / go.env configuration) and is evaluated before
+the go command normalizes its environment, so a package cannot reliably set
+it for every invocation. Flip the gate to opt-in instead: Microsoft telemetry
+runs only when MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 is explicitly set.
+
+This does not affect the separate upstream Go telemetry, which defaults to
+"local" mode and uploads nothing unless the user runs `go telemetry on`.
+
+The cmd/go script test harness asserts that an App Insights request is
+recorded whenever `go build`/`install`/`run` is invoked, which assumed the
+upstream default-on behavior. Now that telemetry is opt-in, the harness sets
+MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 for the go subprocesses it spawns so the
+telemetry plumbing is still exercised by the test suite.
+---
+--- a/src/cmd/internal/telemetry/counter/counter.go
++++ b/src/cmd/internal/telemetry/counter/counter.go
+@@ -41,6 +41,6 @@
+ func OpenMicrosoft() {
+-	if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") == "0" {
+-		// Telemetry disabled.
++	if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") != "1" {
++		// Azure Linux: Microsoft Go toolchain telemetry is off by default; opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1.
+ 		return
+ 	}
+ 	var logger *slog.Logger
+--- a/src/cmd/go/script_test.go
++++ b/src/cmd/go/script_test.go
+@@ -259,2 +259,3 @@
+ 		"MS_GOTOOLCHAIN_TELEMETRY_ALLOW_GO_DEVEL=1", // allow telemetry for Go development versions
++		"MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1", // Azure Linux: telemetry is opt-in by default; enable it here so the test harness can exercise telemetry plumbing
+ 		"newline=\n",

base/comps/golang/golang.comp.toml

@@ -1,9 +1,31 @@
+# Azure Linux 4.0 golang: the Microsoft build of Go, packaged with Fedora's golang
+# spec. This replaces the Fedora upstream golang entirely, so the distro ships a
+# single golang toolchain sourced from Microsoft Go (systemcrypto / OpenSSL backend).
 [components.golang]
-# Override to pick up golang-1.25.8-1.fc43, which fixes an expired TLS test
-# certificate in net/smtp that causes %check failures after 2026-03-18.
-# Upstream: https://github.com/golang/go/issues/77504
-# Backport: https://github.com/golang/go/issues/77531 (Go 1.25.8)
-# Fedora commit: https://src.fedoraproject.org/rpms/golang/c/e0faaabdb215feb6be2b3232f480a03ce76ca132?branch=f43
-# TODO: Drop this override once the default Fedora 43 snapshot
-# in distro/azurelinux.distro.toml advances past this commit.
-spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "e0faaabdb215feb6be2b3232f480a03ce76ca132" }
+spec = { type = "upstream", upstream-distro = { name = "fedora", version = "44" }, upstream-commit = "77411fa4053581833ce67c9dd241d7545d4ed6e0" }
+overlays = [
+    { description = "Build from the Microsoft Go release archive while retaining Fedora's local source filename", type = "spec-update-tag", tag = "Source0", value = "https://github.com/microsoft/go/releases/download/v1.26.5-2/go1.26.5-20260709.6.src.tar.gz#/go1.26.5.src.tar.gz" },
+    { description = "Point package metadata to Microsoft Go", type = "spec-update-tag", tag = "URL", value = "https://github.com/microsoft/go" },
+    { description = "Start the RPM release at the Microsoft Go revision (upstream v1.26.5-2)", type = "spec-search-replace", regex = '^Release:\s+%autorelease$', replacement = "Release:        %autorelease -b 2" },
+    { description = "Retain the historical Microsoft Go virtual provide", type = "spec-add-tag", tag = "Provides", value = "msft-golang = %{version}-%{release}" },
+    { description = "Microsoft Go's default systemcrypto backend dlopens libcrypto at runtime; auto-dependency generation is disabled, so require openssl explicitly", type = "spec-add-tag", tag = "Requires", value = "openssl" },
+    { description = "Require the SymCrypt FIPS provider so the OpenSSL crypto backend can route through a FIPS-validated implementation", type = "spec-add-tag", tag = "Requires", value = "SymCrypt >= 103.6.0-1" },
+    { description = "Require the SymCrypt OpenSSL (SCOSSL) provider that plugs SymCrypt into the system OpenSSL used by the Go crypto backend", type = "spec-add-tag", tag = "Requires", value = "SymCrypt-OpenSSL >= 1.6.1-1" },
+    { description = "Require a bootstrap compiler new enough for Go 1.26", type = "spec-search-replace", regex = '^BuildRequires:\s+golang > 1\.4$', replacement = "BuildRequires:  golang >= 1.24" },
+    { description = "Use the installed bootstrap compiler regardless of package GOROOT", type = "spec-search-replace", section = "%build", regex = '^export GOROOT_BOOTSTRAP=%\{goroot\}$', replacement = 'export GOROOT_BOOTSTRAP="$(go env GOROOT)"' },
+    { description = "Build every Microsoft Go tool with the nodwarf5 default installed in go.env", type = "spec-search-replace", section = "%build", regex = '^export GOHOSTOS=linux$', replacement = "export GOEXPERIMENT=nodwarf5\nexport GOHOSTOS=linux" },
+    { description = "Disable the shared stdlib build that duplicates crosscall2 with Microsoft system-crypto backends", type = "spec-search-replace", regex = '^%global shared 1$', replacement = "%global shared 0" },
+    { description = "Avoid publishing test fixture shared libraries as RPM capabilities", type = "spec-prepend-lines", lines = ["%define __find_provides %{nil}"] },
+    { description = "Replace Fedora's environment patch with one compatible with Microsoft Go defaults", type = "patch-remove", file = "0001-Modify-go.env.patch" },
+    { description = "Retain Azure Linux's DWARF compatibility setting in Microsoft Go", type = "patch-add", source = "0001-Set-nodwarf5-in-go.env.patch" },
+    { description = "Skip crypto/rsa PSS and testing/cryptotest ML-KEM tests that fail under the Microsoft Go OpenSSL crypto backend", type = "patch-add", source = "0002-Skip-openssl-incompatible-crypto-tests.patch" },
+    { description = "Disable Microsoft Go toolchain telemetry by default (opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1)", type = "patch-add", source = "0003-Disable-msft-go-telemetry-by-default.patch" },
+]
+
+[[components.golang.source-files]]
+filename = "go1.26.5.src.tar.gz"
+hash = "52aafddac2d7c6245d7759e65021197dc385732d4a7aefb4f15f064d0e3babfe"
+hash-type = "SHA256"
+origin = { type = "download", uri = "https://github.com/microsoft/go/releases/download/v1.26.5-2/go1.26.5-20260709.6.src.tar.gz" }
+replace-upstream = true
+replace-reason = "Ship the Microsoft Go 1.26.5-2 source as Azure Linux's golang while reusing Fedora's golang packaging"

locks/golang.lock

@@ -1,6 +1,6 @@
 # Managed by azldev component update. Do not edit manually.
 version = 1
-import-commit = 'e0faaabdb215feb6be2b3232f480a03ce76ca132'
-upstream-commit = 'e0faaabdb215feb6be2b3232f480a03ce76ca132'
-input-fingerprint = 'sha256:9cc64cbce0e0b54b23f9513393fc3ffe17bcb0bb310618d0096e484865b24f4b'
-resolution-input-hash = 'sha256:53918cf7d5c133c8dbf203ddcd7ce8174b81a9d65257d368c208971150252e50'
+import-commit = '77411fa4053581833ce67c9dd241d7545d4ed6e0'
+upstream-commit = '77411fa4053581833ce67c9dd241d7545d4ed6e0'
+input-fingerprint = 'sha256:205b966dafaefa01082a5f241c92b88bb551ee1610846fb7921fb9bd10350a40'
+resolution-input-hash = 'sha256:ce833778f104c7540309ac2ee9079d8a9a17e22d9ae90bbb6811f0284ec1e1f8'

specs/g/golang/0001-Set-nodwarf5-in-go.env.patch

@@ -0,0 +1,13 @@
+diff --git a/go.env b/go.env
+--- a/go.env
++++ b/go.env
+@@ -12,3 +12,6 @@ GOSUMDB=sum.golang.org
+ # to a Go toolchain not built by Microsoft, and we want to avoid that.
+ # See https://go.dev/doc/toolchain for details.
+ GOTOOLCHAIN=local
++
++# Keep DWARF v4 until Azure Linux debugedit supports DWARF v5.
++GOEXPERIMENT=nodwarf5
+
+--
+2.50.1

specs/g/golang/0002-Skip-openssl-incompatible-crypto-tests.patch

@@ -0,0 +1,35 @@
+Skip crypto tests incompatible with the Microsoft Go OpenSSL backend
+
+TestPSSGolden/TestPSSSigning use SHA-1 RSA-PSS, which the system OpenSSL
+provider rejects. TestSetGlobalRandom asserts a golden ML-KEM key from a
+deterministic RNG that the OpenSSL backend does not consume. These are
+backend policy differences, not defects.
+---
+--- a/src/crypto/rsa/pss_test.go	2026-08-03 22:47:04.746315785 +0000
++++ b/src/crypto/rsa/pss_test.go	2026-08-03 22:47:04.746315785 +0000
+@@ -26,6 +26,7 @@
+ // TestPSSGolden tests all the test vectors in pss-vect.txt from
+ // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip
+ func TestPSSGolden(t *testing.T) {
++	t.Skip("Azure Linux: skipped for the Microsoft Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS")
+ 	inFile, err := os.Open("testdata/pss-vect.txt.bz2")
+ 	if err != nil {
+ 		t.Fatalf("Failed to open input file: %s", err)
+@@ -153,6 +154,7 @@
+ }
+
+ func TestPSSSigning(t *testing.T) {
++	t.Skip("Azure Linux: skipped for the Microsoft Go OpenSSL crypto backend; system OpenSSL rejects SHA-1 RSA-PSS")
+ 	var saltLengthCombinations = []struct {
+ 		signSaltLength, verifySaltLength int
+ 		good, fipsGood                   bool
+--- a/src/testing/cryptotest/rand_test.go	2026-08-03 22:47:04.766315745 +0000
++++ b/src/testing/cryptotest/rand_test.go	2026-08-03 22:47:04.766315745 +0000
+@@ -17,6 +17,7 @@
+ )
+
+ func TestSetGlobalRandom(t *testing.T) {
++	t.Skip("Azure Linux: skipped for the Microsoft Go OpenSSL crypto backend; ML-KEM key generation does not consume the deterministic test RNG")
+ 	seed1, _ := hex.DecodeString("6ae6783f4fbde91b6eb88b73a48ed247dbe5882e2579683432c1bfc525454add" +
+ 		"0cd87274d67084caaf0e0d36c8496db7fef55fe0e125750aa608d5e20ffc2d12")
+

specs/g/golang/0003-Disable-msft-go-telemetry-by-default.patch

@@ -0,0 +1,37 @@
+Disable Microsoft Go toolchain telemetry by default
+
+Azure Linux ships the Microsoft build of Go with the Microsoft-specific
+AppInsights telemetry turned off by default. Upstream starts it for
+`go build`, `go install`, and `go run` unless the environment variable
+MS_GOTOOLCHAIN_TELEMETRY_ENABLED=0 is set. That variable is read with
+os.Getenv (not the `go env` / go.env configuration) and is evaluated before
+the go command normalizes its environment, so a package cannot reliably set
+it for every invocation. Flip the gate to opt-in instead: Microsoft telemetry
+runs only when MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 is explicitly set.
+
+This does not affect the separate upstream Go telemetry, which defaults to
+"local" mode and uploads nothing unless the user runs `go telemetry on`.
+
+The cmd/go script test harness asserts that an App Insights request is
+recorded whenever `go build`/`install`/`run` is invoked, which assumed the
+upstream default-on behavior. Now that telemetry is opt-in, the harness sets
+MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1 for the go subprocesses it spawns so the
+telemetry plumbing is still exercised by the test suite.
+---
+--- a/src/cmd/internal/telemetry/counter/counter.go
++++ b/src/cmd/internal/telemetry/counter/counter.go
+@@ -41,6 +41,6 @@
+ func OpenMicrosoft() {
+-	if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") == "0" {
+-		// Telemetry disabled.
++	if os.Getenv("MS_GOTOOLCHAIN_TELEMETRY_ENABLED") != "1" {
++		// Azure Linux: Microsoft Go toolchain telemetry is off by default; opt in with MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1.
+ 		return
+ 	}
+ 	var logger *slog.Logger
+--- a/src/cmd/go/script_test.go
++++ b/src/cmd/go/script_test.go
+@@ -259,2 +259,3 @@
+ 		"MS_GOTOOLCHAIN_TELEMETRY_ALLOW_GO_DEVEL=1", // allow telemetry for Go development versions
++		"MS_GOTOOLCHAIN_TELEMETRY_ENABLED=1", // Azure Linux: telemetry is opt-in by default; enable it here so the test harness can exercise telemetry plumbing
+ 		"newline=\n",