openssl: delete cgo-less experiment and promote to default

[gdams]

This is for go 1.27 and onwards

[github-actions]

Patch Consistency Review - Issues Found

I've reviewed PR #2106 for patch consistency and found 3 consistency issues that need to be addressed:

Summary of Changes

The PR is removing the ms_nocgo_opensslcrypto experiment and making CGO-less OpenSSL the default behavior on Linux for supported architectures. The patches 0002 and 0003 have been correctly updated to remove this experiment.

Issues Found

1. Patch 0001 (Vendor dependencies): Line 723 still references ms_nocgo_opensslcrypto in the telemetry configuration string. This needs to be removed to maintain consistency.

2. Migration Guide Documentation (lines 143 & 153): The documentation still mentions the experimental flag and suggests users enable it explicitly, which contradicts the PR's goal of making it the default behavior.

Impact

These inconsistencies could lead to:

• Incorrect telemetry data being collected for a non-existent experiment
• User confusion from outdated documentation that references a removed feature
• Mixed messaging about whether users need to explicitly enable CGO-less support

Recommendation

Please update:

1. The telemetry configuration in patch 0001 to remove the ms_nocgo_opensslcrypto reference
2. The MigrationGuide.md to reflect that CGO-less OpenSSL is now the default on supported architectures and no longer requires explicit enablement

I've added specific inline comments on each location that needs attention. The core patch changes (0002 and 0003) look good and are internally consistent with each other.

AI generated by Patch Consistency Review Agent

[gdams]

The telemetry configuration in patch 0001 to remove the ms_nocgo_opensslcrypto reference

This is part of the go-infra package so we can't remove this here. I also don't think it makes sense to remove it from go-infra for now as we need it for Go 1.26.

The MigrationGuide.md to reflect that CGO-less OpenSSL is now the default on supported architectures and no longer requires explicit enablement

I've tried to get the balance right in the migration guide, considering that most users will be running Go 1.26 so mentioning the experiment still makes sense.

[dagood]

The telemetry configuration in patch 0001 to remove the ms_nocgo_opensslcrypto reference

This is part of the go-infra package so we can't remove this here. I also don't think it makes sense to remove it from go-infra for now as we need it for Go 1.26.

I think the agent needs to be taught that it shouldn't pay attention to vendored Go code in general.

[qmuntal]

I think the agent needs to be taught that it shouldn't pay attention to vendored Go code in general.

The comment from the agent was useful to me, it surfaced the need to update the telemetry configuration at some point in the future. The recommendation is wrong, that's true, we don't want to do it now.

[github-actions]

Patch Consistency Review Summary

I've reviewed the patch file changes in this PR, which promotes the cgo-less OpenSSL implementation from an experimental feature (ms_nocgo_opensslcrypto) to the default behavior on Linux.

Changes Overview

The PR makes consistent changes across:

• Patch 0002: Removes the ms_nocgo_opensslcrypto experiment definition files
• Patch 0003: Simplifies build tags from goexperiment.opensslcrypto && (cgo || goexperiment.ms_nocgo_opensslcrypto) to just goexperiment.opensslcrypto
• Documentation & Pipeline Config: Updates to reflect the new default behavior

Issue Found

There is one inconsistency that needs to be addressed:

Patch 0001 (Vendor patch) still contains a reference to ms_nocgo_opensslcrypto in the telemetry counter configuration. I've left an inline comment on the specific line that needs updating.

Recommendation

Please update the telemetry configuration in patch 0001 to remove the ms_nocgo_opensslcrypto reference to maintain consistency across all patches.

AI generated by Patch Consistency Review Agent

[github-actions]

Patch Consistency Review - Incomplete Cleanup

I've reviewed the patch changes in this PR and found inconsistencies that need to be addressed:

🔴 Issues Found

1. Outdated error message in MigrationGuide.md (Line 143)

The error message example still references the experiment being removed:

Consider using our cgo-less experiment by setting GOEXPERIMENT=ms_nocgo_opensslcrypto.
``````

This should be updated to reflect the new behavior in Go 1.27 where cgo-less OpenSSL is available by default on supported architectures.

#### 2. **Vendor patch still lists the experiment** (patches/0001-Vendor-external-dependencies.patch)

The vendor patch contains a reference to `ms_nocgo_opensslcrypto` in what appears to be a list of supported experiments:

``````
"Name": "go/goexperiment:{ms_tls_config_schannel,systemcrypto,nosystemcrypto,opensslcrypto,cngcrypto,darwincrypto,ms_nocgo_opensslcrypto}"

This should be removed to maintain consistency with the experiment deletion.

✅ What Was Done Well

• The patch file changes (0002 and 0003) correctly remove the experiment flag infrastructure
• Build tags have been properly simplified from goexperiment.opensslcrypto && (cgo || goexperiment.ms_nocgo_opensslcrypto) to just goexperiment.opensslcrypto
• Test configurations in the pipeline have been updated appropriately
• The new NocgoOpenSSL.md documentation is helpful and clearly explains the transition

📝 Recommended Actions

1. Update the error message in eng/doc/MigrationGuide.md line 143 to remove the outdated suggestion
2. Update the vendor patch to remove ms_nocgo_opensslcrypto from the experiment list
3. Consider whether the error message itself needs to be updated since cgo-less is now the default (the error only triggers on unsupported architectures)

AI generated by Patch Consistency Review Agent

[dagood]

Suggestions, some maybe for followup, otherwise LGTM.

[dagood]

These are still on the same line (rendered):

Suggested change

	> In Go 1.27, the experiment will be removed and the cgo requirement for `systemcrypto` on Linux will be lifted by default.
	>
	> In Go 1.27, the experiment will be removed and the cgo requirement for `systemcrypto` on Linux will be lifted by default.

Or, should we even mention it here rather than in the other doc? 1.27 doesn't affect anyone yet, so it might not make sense for a migration doc.

Suggested change

> In Go 1.27, the experiment will be removed and the cgo requirement for `systemcrypto` on Linux will be lifted by default.

[dagood]

Oh, automerge. I guess it's followup then. 😄