sing-box｜科学之家 kexuezj.com
sing-box · 科学之家
tokenplsClash by Hako 创作者与 Hako 内核核心维护者
GitHub·2026.09.03 09:41:30（UTC+8）

TokenPLS：Go 1.26 iOS 仍缺 AES 加速修复，暂用构建期 workaround

TokenPLS 在 sing-box 相关讨论中说明：golang/go#80931 的修复目前只在 Go master，未回传到 release-branch.go1.26，因此 Go 1.26.x 的 GOOS=ios 构建仍走纯 Go 密码实现。在 Go 1.27 普及前，他暂时采用构建期 workaround。详情见下方原文。

作者原文@TokenPLS

Thanks — I had missed golang/go#80931; good to see it fixed at the source. Two notes for anyone landing here before Go 1.27:

  • The fix (golang/go@8058a577) is on master only. release-branch.go1.26 still carries the old cpu_arm64_other.go constraint and there is no backport issue, so every GOOS=ios build on Go 1.26.x keeps running AES-GCM/GHASH/SHA-256 in pure Go.
  • Until then we ship the build-time workaround from this issue. It is public in our kernel repo at v1.19.30-hako.2:
  • cmd/build_libbox/overlay/internal_cpu_arm64_ios.go.src — the -overlay replacement. It asserts only AES/PMULL/SHA1/SHA2; Go's fix additionally reads LSE/CRC32/SHA-512/SHA3/DIT through sysctl, which matter far less for tunnel traffic.
  • cmd/build_libbox/apple_cpu_overlay.go — writes the overlay against the toolchain the bind module actually builds with, refuses a GOROOT under GOMODCACHE, injects -overlay through a go shim first on PATH (because sagernet/gomobile overwrites GOFLAGS), and runs nm on every arm64 iOS-family slice for a marker symbol so a silently ignored overlay fails the build. It also refuses to apply itself once the replaced file no longer selects ios, so it retires by itself on Go 1.27.
  • Wiring in cmd/build_libbox/main.go (withAppleCPUOverlay); make lib_apple builds the xcframework with it.

Feel free to close; the upstream fix is the right long-term answer.