From 989d3155132ef3baed60ee38ca3d7ab4cabc392b Mon Sep 17 00:00:00 2001
From: yohimik <yohimik@gmail.com>
Date: Sat, 5 Sep 2026 06:31:54 +0400
Subject: [PATCH 1/2] loader: include the standard HTTP cookie jar

---
 loader/goroot.go                |  7 ++++-
 loader/goroot_cookiejar_test.go | 51 +++++++++++++++++++++++++++++++++
 main_test.go                    |  1 +
 testdata/cookiejar.go           | 27 +++++++++++++++++
 testdata/cookiejar.txt          |  1 +
 5 files changed, 86 insertions(+), 1 deletion(-)
 create mode 100644 loader/goroot_cookiejar_test.go
 create mode 100644 testdata/cookiejar.go
 create mode 100644 testdata/cookiejar.txt

diff --git a/loader/goroot.go b/loader/goroot.go
index 0aab0a0e13..07e88604e4 100644
--- a/loader/goroot.go
+++ b/loader/goroot.go
@@ -253,7 +253,12 @@ func pathsToOverride(goMinor int, needsSyscallPackage bool) map[string]bool {
 		"internal/wasi/":              false,
 		"machine/":                    false,
 		"net/":                        true,
-		"net/http/":                   false,
+		"net/http/":                   true,
+		"net/http/httptest/":          false,
+		"net/http/httptrace/":         false,
+		"net/http/httputil/":          false,
+		"net/http/internal/":          false,
+		"net/http/pprof/":             false,
 		"os/":                         true,
 		"reflect/":                    false,
 		"runtime/":                    false,
diff --git a/loader/goroot_cookiejar_test.go b/loader/goroot_cookiejar_test.go
new file mode 100644
index 0000000000..5960badb6e
--- /dev/null
+++ b/loader/goroot_cookiejar_test.go
@@ -0,0 +1,51 @@
+package loader
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestHTTPSubpackageMerge(t *testing.T) {
+	goRoot := t.TempDir()
+	tinyRoot := t.TempDir()
+	files := map[string][]string{
+		goRoot:   {"client.go", "cookiejar/jar.go", "httptest/server.go", "internal/ascii/print.go"},
+		tinyRoot: {"client.go", "httptest/server.go", "internal/ascii/print.go"},
+	}
+	for root, names := range files {
+		for _, name := range names {
+			file := filepath.Join(root, "src/net/http", name)
+			if err := os.MkdirAll(filepath.Dir(file), 0755); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(file, []byte("package http\n"), 0644); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	paths := pathsToOverride(26, false)
+	overrides := make(map[string]bool)
+	for _, path := range []string{"net/http/", "net/http/httptest/", "net/http/internal/"} {
+		value, ok := paths[path]
+		if !ok {
+			t.Fatalf("missing override for %s", path)
+		}
+		overrides[path] = value
+	}
+	links, err := listGorootMergeLinks(goRoot, tinyRoot, overrides)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for path, root := range map[string]string{
+		"net/http/client.go": tinyRoot,
+		"net/http/cookiejar": goRoot,
+		"net/http/httptest":  tinyRoot,
+		"net/http/internal":  tinyRoot,
+	} {
+		key := filepath.Join("src", path)
+		if want := filepath.Join(root, key); links[key] != want {
+			t.Errorf("%s links to %q, want %q", path, links[key], want)
+		}
+	}
+}
diff --git a/main_test.go b/main_test.go
index 07c531a392..adc58744bb 100644
--- a/main_test.go
+++ b/main_test.go
@@ -122,6 +122,7 @@ func TestBuild(t *testing.T) {
 		t.Parallel()
 		hostOptions := optionsFromTarget("", sema)
 		runPlatTests(hostOptions, tests, t)
+		runPlatTests(hostOptions, []string{"cookiejar.go"}, t)
 
 		// scheduler.threads needs threadID, which exists only on Linux and Darwin.
 		// scheduler.none does not link on Windows.
diff --git a/testdata/cookiejar.go b/testdata/cookiejar.go
new file mode 100644
index 0000000000..4130c1bce9
--- /dev/null
+++ b/testdata/cookiejar.go
@@ -0,0 +1,27 @@
+package main
+
+import (
+	"net/http"
+	"net/http/cookiejar"
+	"net/url"
+)
+
+func main() {
+	jar, err := cookiejar.New(nil)
+	if err != nil {
+		panic(err)
+	}
+	u, err := url.Parse("https://example.com/account")
+	if err != nil {
+		panic(err)
+	}
+	jar.SetCookies(u, []*http.Cookie{{Name: "session", Value: "value", Secure: true, Path: "/"}})
+	if cookies := jar.Cookies(u); len(cookies) != 1 || cookies[0].Value != "value" {
+		panic("cookie not stored")
+	}
+	u.Scheme = "http"
+	if len(jar.Cookies(u)) != 0 {
+		panic("secure cookie sent over HTTP")
+	}
+	println("cookie stored; secure cookie refused over HTTP")
+}
diff --git a/testdata/cookiejar.txt b/testdata/cookiejar.txt
new file mode 100644
index 0000000000..7e72c2cbd6
--- /dev/null
+++ b/testdata/cookiejar.txt
@@ -0,0 +1 @@
+cookie stored; secure cookie refused over HTTP

From 99279a3165a20bae2cc045825bc5b2c7d5d8c5ac Mon Sep 17 00:00:00 2001
From: yohimik <yohimik@gmail.com>
Date: Sat, 5 Sep 2026 06:38:13 +0400
Subject: [PATCH 2/2] ci: include net in the Nix source checkout

---
 .github/workflows/nix.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index e5b3d3562b..3064fd4c74 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -22,9 +22,9 @@ jobs:
         run: sudo apt-get remove llvm-18
       - name: Checkout
         uses: actions/checkout@v6
-      - name: Pull musl, bdwgc
+      - name: Pull musl, bdwgc, and net
         run: |
-            git submodule update --init lib/musl lib/bdwgc
+            git submodule update --init lib/musl lib/bdwgc src/net
       - name: Restore LLVM source cache
         uses: actions/cache/restore@v5
         id: cache-llvm-source