Skip to content

openssl: delete cgo-less experiment and promote to default #2106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gdams merged 5 commits into from
Feb 10, 2026
+84 −152
Merged

openssl: delete cgo-less experiment and promote to default #2106

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
4207a50
openssl: delete CGO-less experiment and promote to default
gdams Feb 4, 2026
4a15d68
fix test succeed logic
gdams Feb 4, 2026
3e63753
review feedback
gdams Feb 5, 2026
1f6a850
dagood review
gdams Feb 9, 2026
1ab40b8
add linux build tag
gdams Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions eng/doc/MigrationGuide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,9 +146,17 @@ For more information, visit https://github.com/microsoft/go/blob/microsoft/main/
```

> [!NOTE]
> As of Go 1.26, there is a cgo-less experiment available for Linux: `ms_nocgo_opensslcrypto`.
> In Go 1.26, there is a cgo-less experiment available for Linux: `ms_nocgo_opensslcrypto`. For Go 1.27 this experiment will be removed and the cgo requirement for `systemcrypto` on Linux will be lifted by default.
> This allows the use of OpenSSL without requiring cgo.
> Currently this experiment is supported on the following architectures: `386`, `amd64`, `arm`, `arm64`, `ppc64le` and `riscv64`.
> Currently this experiment is supported on the following architectures: **386**, **amd64**, **arm**, **arm64**, **ppc64le** and **riscv64**.
>
> **How the backend is selected:** If cgo is enabled (e.g., `CGO_ENABLED=1`), the cgo-based OpenSSL backend is always used.
> The cgo-less backend is only used when cgo is disabled AND you're on a supported architecture.
> This means if you enable cgo for other reasons (e.g., your own C library or cross-compiling for a different platform), the crypto backend will use the cgo-based implementation.
>
> The set of supported architectures is limited because each architecture requires a unique assembly implementation to call OpenSSL.
> Architectures are added based on demand and available resources.
> To see existing requests or request support for additional architectures, search for issues with the [`Area-Nocgo`](https://github.com/microsoft/go/labels/Area-Nocgo) label.
>
> While `systemcrypto` is a fully supported `GOEXPERIMENT` value (it is not "experimental"), `ms_nocgo_opensslcrypto` **is** experimental as of Go 1.26 and may have limitations.

Expand Down
8 changes: 4 additions & 4 deletions eng/pipeline/stages/go-builder-matrix-stages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,13 +93,13 @@ stages:
- { experiment: nosystemcrypto, os: linux, arch: amd64, config: test, distro: azurelinux3 }
- { experiment: systemcrypto, os: linux, arch: amd64, config: test }
- { experiment: systemcrypto, os: linux, arch: amd64, config: test, fips: true }
- { experiment: 'systemcrypto,ms_nocgo_opensslcrypto', os: linux, arch: amd64, config: nocgo, fips: true }
- { experiment: systemcrypto, os: linux, arch: amd64, config: nocgo, fips: true }
- { experiment: systemcrypto, os: linux, arch: amd64, config: test, distro: ubuntu }
- { experiment: 'systemcrypto,ms_nocgo_opensslcrypto', os: linux, arch: amd64, config: nocgo, distro: ubuntu }
- { experiment: systemcrypto, os: linux, arch: amd64, config: nocgo, distro: ubuntu }
- { experiment: systemcrypto, os: linux, arch: amd64, config: test, distro: azurelinux3 }
- { experiment: 'systemcrypto,ms_nocgo_opensslcrypto', os: linux, arch: amd64, config: nocgo, distro: azurelinux3 }
- { experiment: systemcrypto, os: linux, arch: amd64, config: nocgo, distro: azurelinux3 }
- { experiment: systemcrypto, os: linux, arch: amd64, config: test, distro: azurelinux3, fips: true }
- { experiment: 'systemcrypto,ms_nocgo_opensslcrypto', os: linux, arch: amd64, config: nocgo, distro: azurelinux3, fips: true }
- { experiment: systemcrypto, os: linux, arch: amd64, config: nocgo, distro: azurelinux3, fips: true }
- { experiment: nosystemcrypto, os: windows, arch: amd64, config: devscript }
- { experiment: nosystemcrypto, os: windows, arch: amd64, config: test }
- { experiment: systemcrypto, os: windows, arch: amd64, config: test }
Expand Down
44 changes: 4 additions & 40 deletions patches/0002-Add-crypto-backend-GOEXPERIMENTs.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,14 +24,12 @@ maintain this feature. For more information, see the test files.
src/internal/goexperiment/exp_cngcrypto_on.go | 8 ++
.../goexperiment/exp_darwincrypto_off.go | 8 ++
.../goexperiment/exp_darwincrypto_on.go | 8 ++
.../exp_ms_nocgo_opensslcrypto_off.go | 8 ++
.../exp_ms_nocgo_opensslcrypto_on.go | 8 ++
.../goexperiment/exp_opensslcrypto_off.go | 8 ++
.../goexperiment/exp_opensslcrypto_on.go | 8 ++
.../goexperiment/exp_systemcrypto_off.go | 8 ++
.../goexperiment/exp_systemcrypto_on.go | 8 ++
src/internal/goexperiment/flags.go | 22 +++++
20 files changed, 421 insertions(+), 4 deletions(-)
src/internal/goexperiment/flags.go | 18 ++++
18 files changed, 401 insertions(+), 4 deletions(-)
create mode 100644 src/cmd/go/internal/modindex/build_test.go
create mode 100644 src/go/build/buildbackend_test.go
create mode 100644 src/go/build/testdata/backendtags_openssl/main.go
Expand All @@ -42,8 +40,6 @@ maintain this feature. For more information, see the test files.
create mode 100644 src/internal/goexperiment/exp_cngcrypto_on.go
create mode 100644 src/internal/goexperiment/exp_darwincrypto_off.go
create mode 100644 src/internal/goexperiment/exp_darwincrypto_on.go
create mode 100644 src/internal/goexperiment/exp_ms_nocgo_opensslcrypto_off.go
create mode 100644 src/internal/goexperiment/exp_ms_nocgo_opensslcrypto_on.go
create mode 100644 src/internal/goexperiment/exp_opensslcrypto_off.go
create mode 100644 src/internal/goexperiment/exp_opensslcrypto_on.go
create mode 100644 src/internal/goexperiment/exp_systemcrypto_off.go
Expand Down Expand Up @@ -541,34 +537,6 @@ index 00000000000000..4bf785b999ecce
+
+const DarwinCrypto = true
+const DarwinCryptoInt = 1
diff --git a/src/internal/goexperiment/exp_ms_nocgo_opensslcrypto_off.go b/src/internal/goexperiment/exp_ms_nocgo_opensslcrypto_off.go
new file mode 100644
index 00000000000000..d6448ed71cc83e
--- /dev/null
+++ b/src/internal/goexperiment/exp_ms_nocgo_opensslcrypto_off.go
@@ -0,0 +1,8 @@
+// Code generated by mkconsts.go. DO NOT EDIT.
+
+//go:build !goexperiment.ms_nocgo_opensslcrypto
+
+package goexperiment
+
+const MS_Nocgo_OpenSSLCrypto = false
+const MS_Nocgo_OpenSSLCryptoInt = 0
diff --git a/src/internal/goexperiment/exp_ms_nocgo_opensslcrypto_on.go b/src/internal/goexperiment/exp_ms_nocgo_opensslcrypto_on.go
new file mode 100644
index 00000000000000..b2faba81e67362
--- /dev/null
+++ b/src/internal/goexperiment/exp_ms_nocgo_opensslcrypto_on.go
@@ -0,0 +1,8 @@
+// Code generated by mkconsts.go. DO NOT EDIT.
+
+//go:build goexperiment.ms_nocgo_opensslcrypto
+
+package goexperiment
+
+const MS_Nocgo_OpenSSLCrypto = true
+const MS_Nocgo_OpenSSLCryptoInt = 1
diff --git a/src/internal/goexperiment/exp_opensslcrypto_off.go b/src/internal/goexperiment/exp_opensslcrypto_off.go
new file mode 100644
index 00000000000000..b28c0976a94cb0
Expand Down Expand Up @@ -626,10 +594,10 @@ index 00000000000000..fcd4cb9da0d162
+const SystemCrypto = true
+const SystemCryptoInt = 1
diff --git a/src/internal/goexperiment/flags.go b/src/internal/goexperiment/flags.go
index 2cfb71578b421b..be2104e8f5a437 100644
index 2cfb71578b421b..759af57214e7f4 100644
--- a/src/internal/goexperiment/flags.go
+++ b/src/internal/goexperiment/flags.go
@@ -59,6 +59,28 @@ type Flags struct {
@@ -59,6 +59,24 @@ type Flags struct {
PreemptibleLoops bool
StaticLockRanking bool
BoringCrypto bool
Expand All @@ -651,10 +619,6 @@ index 2cfb71578b421b..be2104e8f5a437 100644
+ // "any crypto backend is enabled", even if GOEXPERIMENT=systemcrypto is not
+ // being used to build the Go program.
+ SystemCrypto bool
+
+ // MS_Nocgo_OpenSSLCrypto enables the OpenSSL crypto backend
+ // to be used in builds that do not use cgo.
+ MS_Nocgo_OpenSSLCrypto bool

// Regabi is split into several sub-experiments that can be
// enabled individually. Not all combinations work.
Loading
Loading