<p dir="auto">In Go 1.5, the CA root certificate store search order was changed for BSD systems:</p>
<ul dir="auto">
<li>Go 1.4 programs would look for <code class="notranslate">/etc/ssl/cert.pem</code> before trying <code class="notranslate">/usr/local/share/certs/ca-root-nss.crt</code>. (<a href="https://github.com/golang/go/blob/release-branch.go1.4/src/crypto/x509/root_unix.go#L16">source</a>)</li>
<li>Go 1.5 programs will try <code class="notranslate">/usr/local/share/certs/ca-root-nss.crt</code> first, before looking for <code class="notranslate">/etc/ssl/cert.pem</code>. (<a href="https://github.com/golang/go/blob/release-branch.go1.5/src/crypto/x509/root_bsd.go#L11">source</a>)</li>
</ul>
<p dir="auto">Looking at FreeBSD itself, libfetch (used by FreeBSD core) appears to try the SSL_CA_CERT_FILE environment variable first, then <code class="notranslate">/usr/local/etc/ssl/cert.pem</code>, then <code class="notranslate">/etc/ssl/cert.pem</code>. (<a href="https://svnweb.freebsd.org/base/head/lib/libfetch/common.c?view=markup&amp;pathrev=294326#l691" rel="nofollow">source</a>) This might be considered the canonical way to determine the location for the trust store on FreeBSD.</p>
<p dir="auto">In FreeBSD, the location <code class="notranslate">/usr/local/share/certs/ca-root-nss.crt</code> is not special or blessed, but it's an implementation detail of the ca_root_nss package (Root certificate bundle from the Mozilla Project). Almost all users will have this package installed, and due to the ca_root_nss package's ETCSYMLINK option, their <code class="notranslate">/etc/ssl/cert.pem</code> will be symlinked, in which case the lookup order does not matter.</p>
<p dir="auto">My issue with Go 1.5 happens because I deploy my own trust store to <code class="notranslate">/etc/ssl/cert.pem</code>.</p>
<p dir="auto">If the ca_root_nss package happens to be installed, Go 1.5 picks up the ca_root_nss package's file <code class="notranslate">/usr/local/share/certs/ca-root-nss.crt</code> and no longer looks at the global <code class="notranslate">/etc/ssl/cert.pem</code>.</p>
<p dir="auto">My build boxes have the Mozilla roots ca_root_nss package installed (to incorporate a modified version of it in our own trust store). On these machines, Go 1.5 programs prefer <code class="notranslate">ca-root-nss.crt</code> and use only the Mozilla roots, failing to verify servers using the global roots.</p>
<p dir="auto">Due to fate, the search order in Go 1.4 (<a href="https://github.com/golang/go/blob/release-branch.go1.4/src/crypto/x509/root_unix.go#L16">source</a>) seems to have been more correct, as <code class="notranslate">/etc/ssl/cert.pem</code> was tried first, even if it was marked only as for OpenBSD.</p>
<p dir="auto">However, since most people will just plainly use the Mozilla CA roots as their global roots file, this issue is probably rare.</p>
<p dir="auto">I would recommend to duplicate the search order of FreeBSD's libfetch (<a href="https://svnweb.freebsd.org/base/head/lib/libfetch/common.c?view=markup&amp;pathrev=294326#l691" rel="nofollow">source</a>) in /src/crypto/x509/root_bsd.go.</p>
<p dir="auto">The current list is:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="var certFiles = []string{
    &quot;/usr/local/share/certs/ca-root-nss.crt&quot;, // FreeBSD/DragonFly
    &quot;/etc/ssl/cert.pem&quot;,                      // OpenBSD
    &quot;/etc/openssl/certs/ca-certificates.crt&quot;, // NetBSD
}"><pre class="notranslate"><code class="notranslate">var certFiles = []string{
    "/usr/local/share/certs/ca-root-nss.crt", // FreeBSD/DragonFly
    "/etc/ssl/cert.pem",                      // OpenBSD
    "/etc/openssl/certs/ca-certificates.crt", // NetBSD
}
</code></pre></div>
<p dir="auto">To prefer the system roots and mimic the behavior of libfetch, while keeping compatibility with the other OSes, the entries could become:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="var certFiles = []string{
    &quot;/usr/local/etc/ssl/cert.pem&quot;,            // FreeBSD
    &quot;/etc/ssl/cert.pem&quot;,                      // FreeBSD/OpenBSD
    &quot;/usr/local/share/certs/ca-root-nss.crt&quot;, // DragonFly
    &quot;/etc/openssl/certs/ca-certificates.crt&quot;, // NetBSD
}"><pre class="notranslate"><code class="notranslate">var certFiles = []string{
    "/usr/local/etc/ssl/cert.pem",            // FreeBSD
    "/etc/ssl/cert.pem",                      // FreeBSD/OpenBSD
    "/usr/local/share/certs/ca-root-nss.crt", // DragonFly
    "/etc/openssl/certs/ca-certificates.crt", // NetBSD
}
</code></pre></div>
<p dir="auto">Go version: <code class="notranslate">go version go1.5.3 freebsd/amd64</code></p>
<p dir="auto">by <strong>atctex</strong>:</p>
<pre class="notranslate">Reproducing the problem:

Compile and execute main.go (example.html in same directory):
main.go:
package main
import (
  "fmt"
  "os"
  "html"
  "io"
)
func main() {
file, _ := os.Open("example.html")
tokenizer := html.NewTokenizer(file)
  for {
    tt := tokenizer.Next()
    tn, _ := tokenizer.TagName()
    switch tt {
      case html.ErrorToken:
        return
      case html.StartTagToken:
        fmt.Printf("%s - ", tn)
      case html.EndTagToken:
        fmt.Printf("%s\n", tn)
    }
  }
}

What is the expected output?
html - head - meta - script - script
head
body - body
html

What do you see instead?
html - head - meta - script - 

Which compiler are you using (5g, 6g, 8g, gccgo)?
8g

Which operating system are you using?
linux mint

Which revision are you using?  (hg identify)
775543b0795c tip

Please provide any additional information below.

Apparently parser is confused by "&lt;" (less than) inside javascript code.</pre>
<p dir="auto">Attachments:</p>
<ol dir="auto">
<li><a href="https://storage.googleapis.com/go-attachment/2229/0/example.html" rel="nofollow">example.html</a> (313 bytes)</li>
</ol>