From 90ac9562e6b4d265ce84bd90d599f2426a848362 Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Mon, 6 Apr 2026 17:22:25 +0000
Subject: [PATCH] [tailscale] cmd/go: include tailscale.toolchain.rev in build
 cache salt

The Tailscale Go fork's VERSION file matches upstream (e.g. "go1.26.1"),
so Go's build cache, keyed by runtime.Version(), doesn't invalidate when
the fork is patched without a version bump. This can cause stale
binaries to be served from cache even after a toolchain fix.

Read the tailscale.toolchain.rev build setting (already populated by CI
and Nix via sed replacement of the placeholder in runtime/debug/mod.go)
and append it to the cache hash salt. When the placeholder hasn't been
replaced (local dev builds, upstream Go), the salt is unchanged.

Updates tailscale/go#166
Updates tailscale/corp#36589
Updates tailscale/tailscale#19263

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
---
 src/cmd/go/internal/cache/tailscale.go | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 src/cmd/go/internal/cache/tailscale.go

diff --git a/src/cmd/go/internal/cache/tailscale.go b/src/cmd/go/internal/cache/tailscale.go
new file mode 100644
index 00000000000000..e4dc5460907eec
--- /dev/null
+++ b/src/cmd/go/internal/cache/tailscale.go
@@ -0,0 +1,21 @@
+// Copyright 2026 Tailscale Inc. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package cache
+
+import "runtime/debug"
+
+func init() {
+	bi, ok := debug.ReadBuildInfo()
+	if !ok {
+		return
+	}
+	for _, s := range bi.Settings {
+		if s.Key == "tailscale.toolchain.rev" && s.Value != "" {
+			hashSalt = append(hashSalt, ' ')
+			hashSalt = append(hashSalt, s.Value...)
+			return
+		}
+	}
+}