encoding/gob: wrong type ([]x509.OID) for received field Certificate.Policies

[streamer45]

Go version

go1.23.6 amd64 and go1.22.7 amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/streamer45/.cache/go-build'
GOENV='/home/streamer45/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/streamer45/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/streamer45/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/home/streamer45/sdk/go1.23.6'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/home/streamer45/sdk/go1.23.6/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.23.6'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/streamer45/.config/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='clang'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/streamer45/code/go/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2107211832=/tmp/go-build -gno-record-gcc-switches'

What did you do?

Given the following sample programs:

enc.go

package main

import (
	"crypto/x509"
	"encoding/gob"
	"encoding/hex"
	"log"
	"os"
)

func main() {
	c := &x509.Certificate{}

	enc := gob.NewEncoder(hex.NewEncoder(os.Stdout))
	if err := enc.Encode(c); err != nil {
		log.Printf("Failed to gob encode enpty x.509 cert: %v", err)
		os.Exit(1)
	}
}

dec.go

package main

import (
	"crypto/x509"
	"encoding/gob"
	"encoding/hex"
	"log"
	"os"
)

func main() {
	c := &x509.Certificate{}

	dec := gob.NewDecoder(hex.NewDecoder(os.Stdin))
	if err := dec.Decode(c); err != nil {
		log.Printf("Failed to gob decode empty x.509 cert: %v", err)
	} else {
		log.Printf("Decoded empty x.509 cert")
	}
}

Running go1.23.6 run enc.go | go1.22.7 run dec.go surfaces some kind of compatibility issue.

What did you see happen?

code/go/gob » go1.23.6 run enc.go | go1.22.7 run dec.go
2025/02/26 16:07:31 Failed to gob decode empty x.509 cert: gob: wrong type ([]x509.OID) for received field Certificate.Policies

The "real world" issue is that this seems to be causing all of our pre-compiled plugins to fail when running on a go1.23 build of Mattermost server (we just bumped Golang version from 1.22.7 to 1.23.6).

What did you expect to see?

No backward compatibility decoding error.

2025/02/26 16:07:43 Decoded empty x.509 cert

[seankhliao]

see #66249

go1.22 is no longer a supported version

[streamer45]

@seankhliao Thanks for the quick response. I am noting that this issue could result in significant impact and disruption on our side (essentially what happened last time, see #66249 (comment)). As far as I understand it's effectively a breaking change that would require us to re-compile and re-release all of our supported plugins to avoid breakage.

Would you know if there's any recommended workaround other than recompiling?

[ianlancetaylor]

Unfortunately there is not.

In general you will get better and faster support from a forum rather than the bug tracker. See https://go.dev/wiki/Questions. Thanks.