Repository navigation
crypto/tls: hosted TLS handshake returns success without negotiating TLS #5696
Description
My CLI needs HTTPS with certificate checks. On hosted Linux and Darwin, the selected crypto/tls stub can report a successful handshake without negotiating TLS.
On 2 September 2026, the handshake test from #5635 printed negotiated an unexpected version: 0 with official TinyGo v0.42.0 on both arm64 hosts. Run it with tinygo run testdata/hostcryptotls.go. It should negotiate TLS, exchange data, and reject an untrusted certificate.
Source checked on 18 September 2026. dev at 93940cb6 still selects the stub. This runtime failure is separate from the missing API symbols in #5204 and Darwin system trust roots in #3592. #4273 is a broader network package replacement.
#5635 closed on 17 September with a request for this issue. It depends on the weak pointer hook in #5693 (PR #5633). #5645 closed on 5 September in favor of that work.
Replacement draft PR #5700.
Activity
0pcom commentedon Oct 19, 2026
I can confirm this on linux/amd64 with dev. A program that runs a TLS listener and dials it on loopback does not build against the stub, which has no tls.Listen. Linking Go's crypto/tls on the host, keyed off needsSyscallPackage, negotiates TLS 1.3, round trips data and rejects an untrusted certificate, the same as Go. The weak hook it needed is now on dev, so the change is only the loader part: 0magnet@3b9c3cc