)]}'
{
  "commit": "fa0292d252c762ff3de92b87d13417c50704f3a0",
  "tree": "ff08b81d9cd1f11edb0dc753a83c3ad8335e550d",
  "parents": [
    "947e43e3711948aa3f4d2bbb55ae51ccf54e7638"
  ],
  "author": {
    "name": "Roland Shoemaker",
    "email": "bracewell@google.com",
    "time": "Thu Apr 25 13:09:54 2024 -0700"
  },
  "committer": {
    "name": "Cherry Mui",
    "email": "cherryyz@google.com",
    "time": "Tue May 07 15:28:49 2024 +0000"
  },
  "message": "[release-branch.go1.22] cmd/go: disallow -lto_library in LDFLAGS\n\nThe darwin linker allows setting the LTO library with the -lto_library\nflag. This wasn\u0027t caught by our \"safe linker flags\" check because it\nwas covered by the -lx flag used for linking libraries. This change\nadds a specific check for excluded flags which otherwise satisfy our\nexisting checks.\n\nLoading a mallicious LTO library would allow an attacker to cause the\nlinker to execute abritrary code when \"go build\" was called.\n\nThanks to Juho Forsén of Mattermost for reporting this issue.\n\nFixes #67119\nFixes #67122\nFixes CVE-2024-24787\n\nChange-Id: I77ac8585efbdbdfd5f39c39ed623b9408a0f9eaf\nReviewed-on: https://go-internal-review.googlesource.com/c/go/+/1380\nReviewed-by: Russ Cox \u003crsc@google.com\u003e\nReviewed-by: Damien Neil \u003cdneil@google.com\u003e\n(cherry picked from commit 9a79141fbbca1105e5c786f15e38741ca7843290)\nReviewed-on: https://go-internal-review.googlesource.com/c/go/+/1420\nReviewed-by: Tatiana Bradley \u003ctatianabradley@google.com\u003e\nReviewed-on: https://go-review.googlesource.com/c/go/+/583796\nReviewed-by: David Chase \u003cdrchase@google.com\u003e\nLUCI-TryBot-Result: Go LUCI \u003cgolang-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "88504be6cd6b4123a04c8f34381ff53b95afd56c",
      "old_mode": 33188,
      "old_path": "src/cmd/go/internal/work/security.go",
      "new_id": "568eecd325bb7fc9739e1261711143cd35d2954e",
      "new_mode": 33188,
      "new_path": "src/cmd/go/internal/work/security.go"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "d7acefdbad63864c7628a7812dd520b405675dab",
      "new_mode": 33188,
      "new_path": "src/cmd/go/testdata/script/darwin_lto_library_ldflag.txt"
    }
  ]
}