TokenPLS：Go 修复目前仅在 master，暂时使用构建期 workaround
Thanks — I had missed golang/go#80931; good to see it fixed at the source. Two notes for anyone landing here before Go 1.27: - The fix (golang/go@8058a577) is on master only. `release-branch.go1.26` still carries the old `cpu_arm64_other.go` constraint and there is no backport issue, so every `GOOS=ios` build on Go 1.26.x keeps running AES-GCM/GHASH/SHA-256 in pure Go. - Until then we ship the build-time workaround from this issue. It is public in our kernel repo at [`v1.19.30-hako.2`](https://github.com/TokenPLS/Hako/tree/v1.19.30-hako.2):（节选）
作者原文@TokenPLSThanks — I had missed golang/go#80931; good to see it fixed at the source. Two notes for anyone landing here before Go 1.27:
- The fix (golang/go@8058a577) is on master only.
release-branch.go1.26still carries the oldcpu_arm64_other.goconstraint and there is no backport issue, so everyGOOS=iosbuild on Go 1.26.x keeps running AES-GCM/GHASH/SHA-256 in pure Go.- Until then we ship the build-time workaround from this issue. It is public in our kernel repo at
v1.19.30-hako.2:cmd/build_libbox/overlay/internal_cpu_arm64_ios.go.src— the-overlayreplacement. It asserts only AES/PMULL/SHA1/SHA2; Go's fix additionally reads LSE/CRC32/SHA-512/SHA3/DIT through sysctl, which matter far less for tunnel traffic.cmd/build_libbox/apple_cpu_overlay.go— writes the overlay against the toolchain the bind module actually builds with, refuses a GOROOT underGOMODCACHE, injects-overlaythrough agoshim first onPATH(becausesagernet/gomobileoverwritesGOFLAGS), and runsnmon every arm64 iOS-family slice for a marker symbol so a silently ignored overlay fails the build. It also refuses to apply itself once the replaced file no longer selectsios, so it retires by itself on Go 1.27.- Wiring in
cmd/build_libbox/main.go(withAppleCPUOverlay);make lib_applebuilds the xcframework with it.Feel free to close; the upstream fix is the right long-term answer.