v0.42.0-net.1

A test build of the TinyGo 0.42 development tree with working host networking over real TLS on hosted linux and macOS. It exists so a downstream project can build and run a program whose release paths are all HTTPS. It is not an official TinyGo release and it is not built from tinygo-org/tinygo.

What is different from upstream dev

• crypto/tls is the real one. TinyGo replaces crypto/tls with a stub whose handshake does nothing, so https:// produced a plaintext connection wearing the TLS API. On hosted linux and darwin the standard library's own crypto/tls is used instead; the stub stays in place for baremetal, wasm and Windows targets.
• The host netdev works on macOS. src/net's raw-socket netdev was linux-only, so a darwin binary reported Netdev not set for every dial. It now builds on darwin too, with SO_NOSIGPIPE on every socket.
• HTTPS on macOS has trust roots. crypto/x509's macOS verifier is a stub in TinyGo, so net/http supplies a root pool of its own, read from $SSL_CERT_FILE or from /etc/ssl/cert.pem.
• weak.runtime_makeStrongFromWeak is implemented, which crypto/tls's certificate cache needs to link.
• The darwin libSystem stub declares the BSD socket API, which the minimal macOS SDK omits.

Verified

tests/netprobe — TCP, TLS, plain HTTP, HTTPS and DNS asked one layer at a time — reports every layer working on linux/amd64, linux/arm64, linux/arm, darwin/arm64 and darwin/amd64: TLS 1.3 handshakes against api.github.com with real certificate verification, 200 OK from https://api.github.com/, /etc/hosts honoured, and DNSError.IsNotFound set for a name that does not exist.

Windows is unchanged and still gets the stub. A Windows binary built with this toolchain compiles crypto/tls to the no-op handshake, so https:// there is plaintext wearing the TLS API, exactly as before. Only hosted linux and macOS were switched over.

Install

Each tinygo<version>.<os>-<arch>.tar.gz unpacks to a single tinygo/ directory holding bin/, lib/, src/ and targets/.

curl -L -O https://github.com/yohimik/tinygo/releases/download/v0.42.0-net.1/tinygo0.42.0-net.1.linux-amd64.tar.gz
tar xzf tinygo0.42.0-net.1.linux-amd64.tar.gz -C /usr/local/lib
export TINYGOROOT=/usr/local/lib/tinygo
export PATH=$PATH:$TINYGOROOT/bin
tinygo version

TINYGOROOT must point at that directory whenever bin/tinygo is not run from inside it.

A host Go toolchain is required. TinyGo runs go list and reads the standard library from $(go env GOROOT), so a Go toolchain must be installed on the machine that runs tinygo — including when cross-compiling. This build accepts Go 1.25 through 1.27 and was tested with all three; crypto/tls itself comes from that toolchain's GOROOT, which is why the version matters more than usual here.

.deb packages are also attached; they install to /usr/local/lib/tinygo with a symlink at /usr/local/bin/tinygo.

Using it in a Dockerfile instead of the tinygo/tinygo image

Replace the toolchain, not the base image: start from golang:1.27, unpack the tarball, and point TINYGOROOT at it.

FROM golang:1.27
ARG TINYGO_VERSION=0.42.0-net.1
ARG TARGETARCH
RUN curl -fsSL -o /tmp/tinygo.tar.gz \
      "https://github.com/yohimik/tinygo/releases/download/v${TINYGO_VERSION}/tinygo${TINYGO_VERSION}.linux-${TARGETARCH}.tar.gz" \
 && tar xzf /tmp/tinygo.tar.gz -C /usr/local/lib \
 && rm /tmp/tinygo.tar.gz
ENV TINYGOROOT=/usr/local/lib/tinygo
ENV PATH="/usr/local/lib/tinygo/bin:${PATH}"

Cross-compiling to macOS works from that image with GOOS=darwin GOARCH=arm64 tinygo build ….

macOS caveats

• A raw tls.Dial(…, nil) still fails. crypto/x509's platform verifier is a stub on darwin, and a nil RootCAs sends verification straight to it. net/http supplies roots for itself, so http.Client over https:// is fine; code that dials TLS directly must pass its own pool:

  pem, _ := os.ReadFile("/etc/ssl/cert.pem")
  pool := x509.NewCertPool()
  pool.AppendCertsFromPEM(pem)
  conn, err := tls.Dial("tcp", host, &tls.Config{ServerName: name, RootCAs: pool})

• SSL_CERT_FILE overrides the bundle that net/http loads, for a container image or a host without /etc/ssl/cert.pem.

• The resolver is a stub resolver. It reads /etc/hosts and the nameserver lines of /etc/resolv.conf, and queries them over UDP. It does not use the macOS system resolver, so scoped and split-horizon DNS, mDNS .local names, and IPv6 nameservers are not supported. It returns one address per name, preferring A over AAAA.

Source

• Compiler: yohimik/tinygo branch release/net
• src/net submodule: yohimik/net branch host-netdev-darwin

Verifying downloads

GitHub records a SHA-256 digest for every asset below. To print them:

gh release view v0.42.0-net.1 --repo yohimik/tinygo --json assets --jq '.assets[] | "\(.digest)  \(.name)"'