…ng CPU features lamcas and lam_bh on loong64

Fixes #76378

Change-Id: I5019f4e32243911f735f775bcb3c0dba5adb4162
Reviewed-on: https://go-review.googlesource.com/c/go/+/655395
Reviewed-by: David Chase <[email protected]>
Reviewed-by: Junyang Shao <[email protected]>
Reviewed-by: Meidan Li <[email protected]>
Reviewed-by: sophie zhao <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
(cherry picked from commit bcd0ebb)
Reviewed-on: https://go-review.googlesource.com/c/go/+/722400
Reviewed-by: abner chenc <[email protected]>
Reviewed-by: Mark Freeman <[email protected]>

…reclude wildcard SANs

When evaluating name constraints in a certificate chain, the presence of
an excluded subdomain constraint (e.g., excluding "test.example.com")
should preclude the use of a wildcard SAN (e.g., "*.example.com").

Fixes #76442
Fixes #76463
Fixes CVE-2025-61727

Change-Id: I42a0da010cb36d2ec9d1239ae3f61cf25eb78bba
Reviewed-on: https://go-review.googlesource.com/c/go/+/724401
Reviewed-by: Nicholas Husin <[email protected]>
Reviewed-by: Daniel McCarney <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Nicholas Husin <[email protected]>
Reviewed-by: Neal Patel <[email protected]>

…om consuming excessive resource

Constructing HostnameError.Error() takes O(N^2) runtime due to using a
string concatenation in a loop. Additionally, there is no limit on how
many names are included in the error message. As a result, a malicious
attacker could craft a certificate with an infinite amount of names to
unfairly consume resource.

To remediate this, we will now use strings.Builder to construct the
error message, preventing O(N^2) runtime. When a certificate has 100 or
more names, we will also not print each name individually.

Thanks to Philippe Antoine (Catena cyber) for reporting this issue.

Updates #76445
Fixes #76460
Fixes CVE-2025-61729

Change-Id: I6343776ec3289577abc76dad71766c491c1a7c81
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3000
Reviewed-by: Neal Patel <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3220
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/725820
Reviewed-by: Dmitri Shuralyov <[email protected]>
TryBot-Bypass: Dmitri Shuralyov <[email protected]>
Auto-Submit: Dmitri Shuralyov <[email protected]>
Reviewed-by: Mark Freeman <[email protected]>

Change-Id: Iae7d7cf17bf31ac6aaf145993d0b857a3ddbcacb
Reviewed-on: https://go-review.googlesource.com/c/go/+/725841
TryBot-Bypass: Gopher Robot <[email protected]>
Reviewed-by: Mark Freeman <[email protected]>
Auto-Submit: Gopher Robot <[email protected]>
Reviewed-by: Dmitri Shuralyov <[email protected]>