# Security Policy

## Supported Versions

We support the past two Go releases (for example, Go 1.17.x and Go 1.18.x when Go 1.18.x is the latest stable release).

See https://go.dev/wiki/Go-Release-Cycle and in particular the
[Release Maintenance](https://go.dev/wiki/Go-Release-Cycle#release-maintenance)
part of that page.

## Reporting a Vulnerability

    if (numericRE.test(t)) {
        if (t < 150000) {
            // We could use the golang.org/cl/ handler here, but
            // avoid some redirect latency and go right there, since
            // one is easy. (no server-side mapping)
            return "https://github.com/golang/go/issues/" + t;
        }
        return "https://golang.org/cl/" + t;
    }

    if (gerritChangeIdRE.test(t)) {
        return "https://golang.org/cl/" + t;

L1::: Copyright 2012 The Go Authors. All rights reserved.
L2::: Use of this source code is governed by a BSD-style
L3::: license that can be found in the LICENSE file.
L4:
L5:@echo off
L6:
L7:setlocal
L8:
L9:if not exist make.bat (
L10:    echo all.bat must be run from go\src
L11:    exit /b 1
L12:)
L13:
L14:call .\make.bat --no-banner || exit /b 1
L15:call .\run.bat --no-rebuild || exit /b 1
L16:..\bin\go tool dist banner
...

Notes If you have just untarred a binary Go distribution, you need to set the environment variable $GOROOT to the full path of the go directory (the one containing this README). You can omit the variable if you unpack it into /usr/local/go, or if you rebuild from sources by running all.bash (see doc/install.html). You should also add the Go binary directory $GOROOT/bin to your shell's path. For example, if you extracted the tar file into $HOME/go, you might put the following in your .profile: export...

go tool can find the go_android_$GOARCH_exec wrapper generated by
make.bash. For example, to run the go1 benchmarks

	export PATH=$GOROOT/bin:$PATH
	cd $GOROOT/test/bench/go1/

<form style='margin: 0' id='navform'><nobr><input id="inputbox" size=10 tabindex=1 /><input type="submit" value="go" /></nobr></form>
<small>Also: <a href="#" url="https://build.golang.org">buildbots</a>
<a href="#" url="https://github.com/golang/go">GitHub</a>
</small>
</body>

function _build() {
	local osarch=$1
	IFS=/ read -r -a arr <<<"$osarch"
	os="${arr[0]}"
	arch="${arr[1]}"
	package=$(go list -f '{{.ImportPath}}')
	printf -- "--> %15s:%s\n" "${osarch}" "${package}"

	# go build -trimpath to build the binary.
	export GOOS=$os
	export GOARCH=$arch
	export GO111MODULE=on
	go build -trimpath -tags kqueue -o /dev/null
}

function main() {
	echo "Testing builds for OS/Arch: ${SUPPORTED_OSARCH}"

	git clean -f -d
fi
echo
echo "#### Building $targ"
echo
cd src
./make.bash --no-banner $forceflag
gohostos="$(../bin/go env GOHOSTOS)"
gohostarch="$(../bin/go env GOHOSTARCH)"
goos="$(../bin/go env GOOS)"
goarch="$(../bin/go env GOARCH)"

# NOTE: Cannot invoke go command after this point.
# We're about to delete all but the cross-compiled binaries.
cd ..

- github.com/go-lintpack/lintpack: [v0.5.2](https://github.com/go-lintpack/lintpack/tree/v0.5.2)
- github.com/go-ole/go-ole: [v1.2.1](https://github.com/go-ole/go-ole/tree/v1.2.1)
- github.com/go-toolsmith/astcast: [v1.0.0](https://github.com/go-toolsmith/astcast/tree/v1.0.0)
- github.com/go-toolsmith/astcopy: [v1.0.0](https://github.com/go-toolsmith/astcopy/tree/v1.0.0)
- github.com/go-toolsmith/astequal: [v1.0.0](https://github.com/go-toolsmith/astequal/tree/v1.0.0)

pkg go/ast, func Preorder(Node) iter.Seq[Node] #66339
pkg go/types, method (*Alias) Origin() *Alias #67143
pkg go/types, method (*Alias) Rhs() Type #66559
pkg go/types, method (*Alias) SetTypeParams([]*TypeParam) #67143
pkg go/types, method (*Alias) TypeArgs() *TypeList #67143
pkg go/types, method (*Alias) TypeParams() *TypeParamList #67143
pkg go/types, method (*Func) Signature() *Signature #65772