The OpenBSD ports tree generally tracks current, but sometimes backports (and stable packages) are made for more serious issues. As was the case for git 2.50.1. However, the go port has not seen a backport in quite some time. The OpenBSD release schedule aligns with the go schedule such that we always get the latest release, but not minor revisions.

For instance, OpenBSD 7.7 shipped with go 1.24.1, but there’s a few minor revisions after that. We maybe don’t care about many of these backports, but issue 73570 is a backported fix for a bug specific to OpenBSD, so let’s say we want that.

I always forget the procedures for building ports from scratch and waste a bunch of time running and cancelling and rerunning commands. So here’s a recipe that worked.

If we don’t have the ports tree, we need to get that.

cvs -z3 -d anoncvs@server co -P ports

If we don’t have bash, we need to install that. (There’s a magic formula to have ports install packages, but this is simpler.)

pkg_add bash

We need to update the go port to a suitable revision. The port is currently on 1.25, but I’d rather stick with 1.24, so we go back a little ways. The OpenBSD port was never updated for 1.24.7, but those changes don’t look very exciting. Maybe next time I’ll try a custom update to a new version.

cd ports/lang/go
cvs up -D"2025-08-08"

We build the port. The bootstrap flavor is important, or we’ll end up building it twice.

env FLAVOR=native_bootstrap make

Tick, tock, ding, ding. Running make install will build and install a package.

env FLAVOR=native_bootstrap make install

Check.

go version
go version go1.24.6 openbsd/amd64

Looks good.

redux

What if we want a version that’s not in ports? I figured this post would be pretty boring, but go just released 1.24.8, which includes security fixes I’d like, so now we definitely need to try building a new version.

Let’s edit the Makefile.

-VERSION =              1.24.6
+VERSION =              1.24.8

Now tell the ports system to download the new version and update the checksum.

env FLAVOR=native_bootstrap make makesum

This downloads the new version and prints it’s checksum.

-SHA256 (go1.24.6.src.tar.gz) = 4ctVgqq1iGaLwEwH3hhogHD2uMmyqvNh+CHhm9R8/b0=
+SHA256 (go1.24.8.src.tar.gz) = sf8yxcSlDd+hoct4tg3Vo2KushhLt48Ai0JbYglXVfs=

Okay? Well, the go downloads page shows checksums in hex, but we can redo it to check.

sha256 /home/tedu/ports/distfiles/go1.24.8.src.tar.gz                                                                                                     
SHA256 (/home/tedu/ports/distfiles/go1.24.8.src.tar.gz) = b1ff32c5c4a50ddfa1a1cb78b60dd5a362aeb2184bb78f008b425b62095755fb

Looks good.

Now run make and make install again.

Error: /home/tedu/ports/pobj/go-1.24.8-native_bootstrap/fake-amd64-native_bootstrap/usr/local/go/lib/fips140/v1.0.0.zip does not exist

Uh oh. Fucking FIPS, every fucking time. I don’t want to think too much about what this is doing, but the file has been renamed, so we need to update the pkg/PLIST file.

-go/lib/fips140/v1.0.0.zip
+go/lib/fips140/v1.0.0-c2097c7c.zip

Hopefully this is an aberration, as the go team is usually conservative about backporting changes, but one never knows what to expect.

Now the package builds and installs correctly. And then rebuild everything that uses go.