crypto: use and test purego tag consistently

Fixes #58636
Updates #23172

Change-Id: I578a5597f467be45a7d6fb7582b24855b2e6512b
Reviewed-on: https://go-review.googlesource.com/c/go/+/561935
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

81 files changed, 194 insertions, 38 deletions

diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
index 80a134becd..aed59db9d5 100644
--- a/src/cmd/dist/test.go
+++ b/src/cmd/dist/test.go
@@ -691,6 +691,14 @@ func (t *tester) registerTests() {
 			})
 	}
 
+	// Check that all crypto packages compile with the purego build tag.
+	t.registerTest("crypto with tag purego", &goTest{
+		variant:  "purego",
+		tags:     []string{"purego"},
+		pkg:      "crypto/...",
+		runTests: "^$", // only ensure they compile
+	})
+
 	// Test ios/amd64 for the iOS simulator.
 	if goos == "darwin" && goarch == "amd64" && t.cgoEnabled {
 		t.registerTest("GOOS=ios on darwin/amd64",
diff --git a/src/crypto/aes/aes_gcm.go b/src/crypto/aes/aes_gcm.go
index 036705feca..b95796970c 100644
--- a/src/crypto/aes/aes_gcm.go
+++ b/src/crypto/aes/aes_gcm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build amd64 || arm64
+//go:build (amd64 || arm64) && !purego
 
 package aes
 
diff --git a/src/crypto/aes/asm_amd64.s b/src/crypto/aes/asm_amd64.s
index ed831bf47f..d5e17401ea 100644
--- a/src/crypto/aes/asm_amd64.s
+++ b/src/crypto/aes/asm_amd64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // func encryptBlockAsm(nr int, xk *uint32, dst, src *byte)
diff --git a/src/crypto/aes/asm_arm64.s b/src/crypto/aes/asm_arm64.s
index 4a02e943ce..2bf5bee2b5 100644
--- a/src/crypto/aes/asm_arm64.s
+++ b/src/crypto/aes/asm_arm64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 DATA rotInvSRows<>+0x00(SB)/8, $0x080f0205040b0e01
 DATA rotInvSRows<>+0x08(SB)/8, $0x00070a0d0c030609
diff --git a/src/crypto/aes/asm_ppc64x.s b/src/crypto/aes/asm_ppc64x.s
index 288f7256c7..859cffa3ee 100644
--- a/src/crypto/aes/asm_ppc64x.s
+++ b/src/crypto/aes/asm_ppc64x.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build ppc64 || ppc64le
+//go:build (ppc64 || ppc64le) && !purego
 
 // Based on CRYPTOGAMS code with the following comment:
 // # ====================================================================
diff --git a/src/crypto/aes/asm_s390x.s b/src/crypto/aes/asm_s390x.s
index a233714fb8..5da0d8bf9c 100644
--- a/src/crypto/aes/asm_s390x.s
+++ b/src/crypto/aes/asm_s390x.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // func cryptBlocks(c code, key, dst, src *byte, length int)
diff --git a/src/crypto/aes/cbc_ppc64x.go b/src/crypto/aes/cbc_ppc64x.go
index c23c37156e..2cb9606e58 100644
--- a/src/crypto/aes/cbc_ppc64x.go
+++ b/src/crypto/aes/cbc_ppc64x.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build ppc64 || ppc64le
+//go:build (ppc64 || ppc64le) && !purego
 
 package aes
 
diff --git a/src/crypto/aes/cbc_s390x.go b/src/crypto/aes/cbc_s390x.go
index eaa21f8a65..09c19ff394 100644
--- a/src/crypto/aes/cbc_s390x.go
+++ b/src/crypto/aes/cbc_s390x.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package aes
 
 import (
diff --git a/src/crypto/aes/cipher_asm.go b/src/crypto/aes/cipher_asm.go
index 90031c5e2c..5451fa60d3 100644
--- a/src/crypto/aes/cipher_asm.go
+++ b/src/crypto/aes/cipher_asm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build amd64 || arm64 || ppc64 || ppc64le
+//go:build (amd64 || arm64 || ppc64 || ppc64le) && !purego
 
 package aes
 
diff --git a/src/crypto/aes/cipher_generic.go b/src/crypto/aes/cipher_generic.go
index 8a8a3fff38..7c7d89aa87 100644
--- a/src/crypto/aes/cipher_generic.go
+++ b/src/crypto/aes/cipher_generic.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 && !s390x && !ppc64 && !ppc64le && !arm64
+//go:build (!amd64 && !s390x && !ppc64 && !ppc64le && !arm64) || purego
 
 package aes
 
diff --git a/src/crypto/aes/cipher_s390x.go b/src/crypto/aes/cipher_s390x.go
index 8dd3d8f053..1541890dea 100644
--- a/src/crypto/aes/cipher_s390x.go
+++ b/src/crypto/aes/cipher_s390x.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package aes
 
 import (
diff --git a/src/crypto/aes/ctr_s390x.go b/src/crypto/aes/ctr_s390x.go
index 921421533a..e5249d1842 100644
--- a/src/crypto/aes/ctr_s390x.go
+++ b/src/crypto/aes/ctr_s390x.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package aes
 
 import (
diff --git a/src/crypto/aes/gcm_amd64.s b/src/crypto/aes/gcm_amd64.s
index e6eedf3264..f787e6fd6b 100644
--- a/src/crypto/aes/gcm_amd64.s
+++ b/src/crypto/aes/gcm_amd64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 // This is an optimized implementation of AES-GCM using AES-NI and CLMUL-NI
 // The implementation uses some optimization as described in:
 // [1] Gueron, S., Kounavis, M.E.: Intel® Carry-Less Multiplication
diff --git a/src/crypto/aes/gcm_arm64.s b/src/crypto/aes/gcm_arm64.s
index c3501024c9..23ce1890e4 100644
--- a/src/crypto/aes/gcm_arm64.s
+++ b/src/crypto/aes/gcm_arm64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 #define B0 V0
diff --git a/src/crypto/aes/gcm_ppc64x.go b/src/crypto/aes/gcm_ppc64x.go
index 2a7f898dc4..04fac72459 100644
--- a/src/crypto/aes/gcm_ppc64x.go
+++ b/src/crypto/aes/gcm_ppc64x.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build ppc64le || ppc64
+//go:build (ppc64le || ppc64) && !purego
 
 package aes
 
diff --git a/src/crypto/aes/gcm_ppc64x.s b/src/crypto/aes/gcm_ppc64x.s
index f661b27642..987f4e718e 100644
--- a/src/crypto/aes/gcm_ppc64x.s
+++ b/src/crypto/aes/gcm_ppc64x.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build ppc64 || ppc64le
+//go:build (ppc64 || ppc64le) && !purego
 
 // Portions based on CRYPTOGAMS code with the following comment:
 // # ====================================================================
diff --git a/src/crypto/aes/gcm_s390x.go b/src/crypto/aes/gcm_s390x.go
index cf0e28af69..01504e1815 100644
--- a/src/crypto/aes/gcm_s390x.go
+++ b/src/crypto/aes/gcm_s390x.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package aes
 
 import (
diff --git a/src/crypto/ecdsa/ecdsa_noasm.go b/src/crypto/ecdsa/ecdsa_noasm.go
index a72aa4b04e..e2fa8082f6 100644
--- a/src/crypto/ecdsa/ecdsa_noasm.go
+++ b/src/crypto/ecdsa/ecdsa_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !s390x
+//go:build !s390x || purego
 
 package ecdsa
 
diff --git a/src/crypto/ecdsa/ecdsa_s390x.go b/src/crypto/ecdsa/ecdsa_s390x.go
index 49f645a489..8ebf15a525 100644
--- a/src/crypto/ecdsa/ecdsa_s390x.go
+++ b/src/crypto/ecdsa/ecdsa_s390x.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package ecdsa
 
 import (
diff --git a/src/crypto/ecdsa/ecdsa_s390x.s b/src/crypto/ecdsa/ecdsa_s390x.s
index ea1f4469e9..2aae59c291 100644
--- a/src/crypto/ecdsa/ecdsa_s390x.s
+++ b/src/crypto/ecdsa/ecdsa_s390x.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // func kdsa(fc uint64, params *[4096]byte) (errn uint64)
diff --git a/src/crypto/ecdsa/ecdsa_s390x_test.go b/src/crypto/ecdsa/ecdsa_s390x_test.go
index fd1dc7c060..ba8f810fab 100644
--- a/src/crypto/ecdsa/ecdsa_s390x_test.go
+++ b/src/crypto/ecdsa/ecdsa_s390x_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build s390x
+//go:build s390x && !purego
 
 package ecdsa
 
diff --git a/src/crypto/internal/edwards25519/field/_asm/fe_amd64_asm.go b/src/crypto/internal/edwards25519/field/_asm/fe_amd64_asm.go
index 411399cb1e..6765a688f4 100644
--- a/src/crypto/internal/edwards25519/field/_asm/fe_amd64_asm.go
+++ b/src/crypto/internal/edwards25519/field/_asm/fe_amd64_asm.go
@@ -17,7 +17,7 @@ import (
 
 func main() {
 	Package("crypto/internal/edwards25519/field")
-	ConstraintExpr("amd64,gc,!purego")
+	ConstraintExpr("!purego")
 	feMul()
 	feSquare()
 	Generate()
diff --git a/src/crypto/internal/edwards25519/field/fe_amd64.go b/src/crypto/internal/edwards25519/field/fe_amd64.go
index 70c541692c..00bf8f4479 100644
--- a/src/crypto/internal/edwards25519/field/fe_amd64.go
+++ b/src/crypto/internal/edwards25519/field/fe_amd64.go
@@ -1,6 +1,6 @@
 // Code generated by command: go run fe_amd64_asm.go -out ../fe_amd64.s -stubs ../fe_amd64.go -pkg field. DO NOT EDIT.
 
-//go:build amd64 && gc && !purego
+//go:build !purego
 
 package field
 
diff --git a/src/crypto/internal/edwards25519/field/fe_amd64.s b/src/crypto/internal/edwards25519/field/fe_amd64.s
index 60817acc41..657851c85e 100644
--- a/src/crypto/internal/edwards25519/field/fe_amd64.s
+++ b/src/crypto/internal/edwards25519/field/fe_amd64.s
@@ -1,6 +1,6 @@
 // Code generated by command: go run fe_amd64_asm.go -out ../fe_amd64.s -stubs ../fe_amd64.go -pkg field. DO NOT EDIT.
 
-//go:build amd64 && gc && !purego
+//go:build !purego
 
 #include "textflag.h"
 
diff --git a/src/crypto/internal/edwards25519/field/fe_amd64_noasm.go b/src/crypto/internal/edwards25519/field/fe_amd64_noasm.go
index 9da280d1d8..4b81f25d1d 100644
--- a/src/crypto/internal/edwards25519/field/fe_amd64_noasm.go
+++ b/src/crypto/internal/edwards25519/field/fe_amd64_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 || !gc || purego
+//go:build !amd64 || purego
 
 package field
 
diff --git a/src/crypto/internal/edwards25519/field/fe_arm64.go b/src/crypto/internal/edwards25519/field/fe_arm64.go
index 075fe9b925..05c7cedd4e 100644
--- a/src/crypto/internal/edwards25519/field/fe_arm64.go
+++ b/src/crypto/internal/edwards25519/field/fe_arm64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build arm64 && gc && !purego
+//go:build !purego
 
 package field
 
diff --git a/src/crypto/internal/edwards25519/field/fe_arm64.s b/src/crypto/internal/edwards25519/field/fe_arm64.s
index 3126a43419..ae207dae43 100644
--- a/src/crypto/internal/edwards25519/field/fe_arm64.s
+++ b/src/crypto/internal/edwards25519/field/fe_arm64.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build arm64 && gc && !purego
+//go:build !purego
 
 #include "textflag.h"
 
diff --git a/src/crypto/internal/edwards25519/field/fe_arm64_noasm.go b/src/crypto/internal/edwards25519/field/fe_arm64_noasm.go
index fc029ac12d..6b9e06a6e8 100644
--- a/src/crypto/internal/edwards25519/field/fe_arm64_noasm.go
+++ b/src/crypto/internal/edwards25519/field/fe_arm64_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !arm64 || !gc || purego
+//go:build !arm64 || purego
 
 package field
 
diff --git a/src/crypto/internal/nistec/generate.go b/src/crypto/internal/nistec/generate.go
index 0e84cefb36..27e8d13943 100644
--- a/src/crypto/internal/nistec/generate.go
+++ b/src/crypto/internal/nistec/generate.go
@@ -40,7 +40,7 @@ var curves = []struct {
 		P:         "P256",
 		Element:   "fiat.P256Element",
 		Params:    elliptic.P256().Params(),
-		BuildTags: "!amd64 && !arm64 && !ppc64le && !s390x",
+		BuildTags: "(!amd64 && !arm64 && !ppc64le && !s390x) || purego",
 	},
 	{
 		P:       "P384",
diff --git a/src/crypto/internal/nistec/p256.go b/src/crypto/internal/nistec/p256.go
index 3cfa5fb371..f2dfbbb1ee 100644
--- a/src/crypto/internal/nistec/p256.go
+++ b/src/crypto/internal/nistec/p256.go
@@ -4,7 +4,7 @@
 
 // Code generated by generate.go. DO NOT EDIT.
 
-//go:build !amd64 && !arm64 && !ppc64le && !s390x
+//go:build (!amd64 && !arm64 && !ppc64le && !s390x) || purego
 
 package nistec
 
diff --git a/src/crypto/internal/nistec/p256_asm.go b/src/crypto/internal/nistec/p256_asm.go
index 99a22b833f..1a523cc13c 100644
--- a/src/crypto/internal/nistec/p256_asm.go
+++ b/src/crypto/internal/nistec/p256_asm.go
@@ -10,7 +10,7 @@
 // https://link.springer.com/article/10.1007%2Fs13389-014-0090-x
 // https://eprint.iacr.org/2013/816.pdf
 
-//go:build amd64 || arm64 || ppc64le || s390x
+//go:build (amd64 || arm64 || ppc64le || s390x) && !purego
 
 package nistec
 
diff --git a/src/crypto/internal/nistec/p256_asm_amd64.s b/src/crypto/internal/nistec/p256_asm_amd64.s
index 84e4cee903..f5c008319b 100644
--- a/src/crypto/internal/nistec/p256_asm_amd64.s
+++ b/src/crypto/internal/nistec/p256_asm_amd64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 // This file contains constant-time, 64-bit assembly implementation of
 // P256. The optimizations performed here are described in detail in:
 // S.Gueron and V.Krasnov, "Fast prime field elliptic-curve cryptography with
diff --git a/src/crypto/internal/nistec/p256_asm_arm64.s b/src/crypto/internal/nistec/p256_asm_arm64.s
index 1ba5df381b..d00a54db1a 100644
--- a/src/crypto/internal/nistec/p256_asm_arm64.s
+++ b/src/crypto/internal/nistec/p256_asm_arm64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 // This file contains constant-time, 64-bit assembly implementation of
 // P256. The optimizations performed here are described in detail in:
 // S.Gueron and V.Krasnov, "Fast prime field elliptic-curve cryptography with
diff --git a/src/crypto/internal/nistec/p256_asm_ppc64le.s b/src/crypto/internal/nistec/p256_asm_ppc64le.s
index 6b787609b9..1475dfb1d9 100644
--- a/src/crypto/internal/nistec/p256_asm_ppc64le.s
+++ b/src/crypto/internal/nistec/p256_asm_ppc64le.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // This is a port of the s390x asm implementation.
diff --git a/src/crypto/internal/nistec/p256_asm_s390x.s b/src/crypto/internal/nistec/p256_asm_s390x.s
index 8da4f3f5b8..77c9f63349 100644
--- a/src/crypto/internal/nistec/p256_asm_s390x.s
+++ b/src/crypto/internal/nistec/p256_asm_s390x.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 #include "go_asm.h"
 
diff --git a/src/crypto/internal/nistec/p256_asm_table_test.go b/src/crypto/internal/nistec/p256_asm_table_test.go
index 5b7246ba12..cba455d32d 100644
--- a/src/crypto/internal/nistec/p256_asm_table_test.go
+++ b/src/crypto/internal/nistec/p256_asm_table_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build amd64 || arm64 || ppc64le || s390x
+//go:build !purego && (amd64 || arm64 || ppc64le || s390x)
 
 package nistec
 
diff --git a/src/crypto/internal/nistec/p256_ordinv.go b/src/crypto/internal/nistec/p256_ordinv.go
index 1274fb7fd3..156a873188 100644
--- a/src/crypto/internal/nistec/p256_ordinv.go
+++ b/src/crypto/internal/nistec/p256_ordinv.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build amd64 || arm64
+//go:build (amd64 || arm64) && !purego
 
 package nistec
 
diff --git a/src/crypto/internal/nistec/p256_ordinv_noasm.go b/src/crypto/internal/nistec/p256_ordinv_noasm.go
index 213875ce76..9cbb1a89db 100644
--- a/src/crypto/internal/nistec/p256_ordinv_noasm.go
+++ b/src/crypto/internal/nistec/p256_ordinv_noasm.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 && !arm64
+//go:build (!amd64 && !arm64) || purego
 
 package nistec
 
diff --git a/src/crypto/internal/nistec/p256_ordinv_test.go b/src/crypto/internal/nistec/p256_ordinv_test.go
index 72de6bd487..ca323a3ae2 100644
--- a/src/crypto/internal/nistec/p256_ordinv_test.go
+++ b/src/crypto/internal/nistec/p256_ordinv_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build amd64 || arm64
+//go:build (amd64 || arm64) && !purego
 
 package nistec_test
 
diff --git a/src/crypto/md5/md5block_386.s b/src/crypto/md5/md5block_386.s
index 30d4209a62..b6c6509d3b 100644
--- a/src/crypto/md5/md5block_386.s
+++ b/src/crypto/md5/md5block_386.s
@@ -6,6 +6,8 @@
 // #defines generating 8a assembly, and adjusted for 386,
 // by the Go Authors.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // MD5 optimized for AMD64.
diff --git a/src/crypto/md5/md5block_amd64.s b/src/crypto/md5/md5block_amd64.s
index 75c8074b37..652506ae27 100644
--- a/src/crypto/md5/md5block_amd64.s
+++ b/src/crypto/md5/md5block_amd64.s
@@ -5,6 +5,8 @@
 // Translated from Perl generating GNU assembly into
 // #defines generating 6a assembly by the Go Authors.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // MD5 optimized for AMD64.
diff --git a/src/crypto/md5/md5block_arm.s b/src/crypto/md5/md5block_arm.s
index 54d02b743a..13fdc5c3be 100644
--- a/src/crypto/md5/md5block_arm.s
+++ b/src/crypto/md5/md5block_arm.s
@@ -4,6 +4,8 @@
 //
 // ARM version of md5block.go
 
+//go:build !purego
+
 #include "textflag.h"
 
 // Register definitions
diff --git a/src/crypto/md5/md5block_arm64.s b/src/crypto/md5/md5block_arm64.s
index 39b9851d1f..5942218f76 100644
--- a/src/crypto/md5/md5block_arm64.s
+++ b/src/crypto/md5/md5block_arm64.s
@@ -5,6 +5,8 @@
 // ARM64 version of md5block.go
 // derived from crypto/md5/md5block_amd64.s
 
+//go:build !purego
+
 #include "textflag.h"
 
 TEXT	·block(SB),NOSPLIT,$0-32
diff --git a/src/crypto/md5/md5block_decl.go b/src/crypto/md5/md5block_decl.go
index f1fb34c3d7..3664542fb9 100644
--- a/src/crypto/md5/md5block_decl.go
+++ b/src/crypto/md5/md5block_decl.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build amd64 || 386 || arm || ppc64le || ppc64 || s390x || arm64
+//go:build (amd64 || 386 || arm || ppc64le || ppc64 || s390x || arm64) && !purego
 
 package md5
 
diff --git a/src/crypto/md5/md5block_generic.go b/src/crypto/md5/md5block_generic.go
index c929c2b84a..43cfebd38a 100644
--- a/src/crypto/md5/md5block_generic.go
+++ b/src/crypto/md5/md5block_generic.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 && !386 && !arm && !ppc64le && !ppc64 && !s390x && !arm64
+//go:build (!amd64 && !386 && !arm && !ppc64le && !ppc64 && !s390x && !arm64) || purego
 
 package md5
 
diff --git a/src/crypto/md5/md5block_ppc64x.s b/src/crypto/md5/md5block_ppc64x.s
index 69a20e7cad..f607040d02 100644
--- a/src/crypto/md5/md5block_ppc64x.s
+++ b/src/crypto/md5/md5block_ppc64x.s
@@ -10,7 +10,7 @@
 // Licence: I hereby disclaim the copyright on this code and place it
 // in the public domain.
 
-//go:build ppc64 || ppc64le
+//go:build (ppc64 || ppc64le) && !purego
 
 #include "textflag.h"
 
diff --git a/src/crypto/md5/md5block_s390x.s b/src/crypto/md5/md5block_s390x.s
index 68f501cfea..2d18d28f25 100644
--- a/src/crypto/md5/md5block_s390x.s
+++ b/src/crypto/md5/md5block_s390x.s
@@ -10,6 +10,8 @@
 // Licence: I hereby disclaim the copyright on this code and place it
 // in the public domain.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // func block(dig *digest, p []byte)
diff --git a/src/crypto/purego_test.go b/src/crypto/purego_test.go
new file mode 100644
index 0000000000..62be347e0c
--- /dev/null
+++ b/src/crypto/purego_test.go
@@ -0,0 +1,67 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package crypto_test
+
+import (
+	"go/build"
+	"internal/testenv"
+	"log"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+// TestPureGoTag checks that when built with the purego build tag, crypto
+// packages don't require any assembly. This is used by alternative compilers
+// such as TinyGo. See also the "crypto/...:purego" test in cmd/dist, which
+// ensures the packages build correctly.
+func TestPureGoTag(t *testing.T) {
+	cmd := exec.Command(testenv.GoToolPath(t), "list", "-e", "crypto/...", "math/big")
+	cmd.Env = append(cmd.Env, "GOOS=linux")
+	cmd.Stderr = os.Stderr
+	out, err := cmd.Output()
+	if err != nil {
+		log.Fatalf("loading package list: %v\n%s", err, out)
+	}
+	pkgs := strings.Split(strings.TrimSpace(string(out)), "\n")
+
+	cmd = exec.Command(testenv.GoToolPath(t), "tool", "dist", "list")
+	cmd.Stderr = os.Stderr
+	out, err = cmd.Output()
+	if err != nil {
+		log.Fatalf("loading architecture list: %v\n%s", err, out)
+	}
+	allGOARCH := make(map[string]bool)
+	for _, pair := range strings.Split(strings.TrimSpace(string(out)), "\n") {
+		GOARCH := strings.Split(pair, "/")[1]
+		allGOARCH[GOARCH] = true
+	}
+
+	for _, pkgName := range pkgs {
+		if strings.Contains(pkgName, "/boring") {
+			continue
+		}
+
+		for GOARCH := range allGOARCH {
+			context := build.Context{
+				GOOS:      "linux", // darwin has custom assembly
+				GOARCH:    GOARCH,
+				GOROOT:    testenv.GOROOT(t),
+				Compiler:  build.Default.Compiler,
+				BuildTags: []string{"purego", "math_big_pure_go"},
+			}
+
+			pkg, err := context.Import(pkgName, "", 0)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(pkg.SFiles) == 0 {
+				continue
+			}
+			t.Errorf("package %s has purego assembly files on %s: %v", pkgName, GOARCH, pkg.SFiles)
+		}
+	}
+}
diff --git a/src/crypto/sha1/fallback_test.go b/src/crypto/sha1/fallback_test.go
index aa1d413f2f..b869a939f6 100644
--- a/src/crypto/sha1/fallback_test.go
+++ b/src/crypto/sha1/fallback_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build s390x
+//go:build s390x && !purego
 
 package sha1
 
diff --git a/src/crypto/sha1/sha1block_386.s b/src/crypto/sha1/sha1block_386.s
index 34d023d424..33d3f1e997 100644
--- a/src/crypto/sha1/sha1block_386.s
+++ b/src/crypto/sha1/sha1block_386.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // SHA-1 block routine. See sha1block.go for Go equivalent.
diff --git a/src/crypto/sha1/sha1block_amd64.go b/src/crypto/sha1/sha1block_amd64.go
index 039813d7dc..92fa7a6fbc 100644
--- a/src/crypto/sha1/sha1block_amd64.go
+++ b/src/crypto/sha1/sha1block_amd64.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package sha1
 
 import "internal/cpu"
diff --git a/src/crypto/sha1/sha1block_amd64.s b/src/crypto/sha1/sha1block_amd64.s
index 9bdf24cf49..6508612d89 100644
--- a/src/crypto/sha1/sha1block_amd64.s
+++ b/src/crypto/sha1/sha1block_amd64.s
@@ -10,6 +10,7 @@
 // Ronen Zohar <ronen.zohar@intel.com>
 // Chandramouli Narayanan <mouli@linux.intel.com>
 
+//go:build !purego
 
 #include "textflag.h"
 
diff --git a/src/crypto/sha1/sha1block_arm.s b/src/crypto/sha1/sha1block_arm.s
index 2236533ab4..209b1d89ae 100644
--- a/src/crypto/sha1/sha1block_arm.s
+++ b/src/crypto/sha1/sha1block_arm.s
@@ -4,6 +4,8 @@
 //
 // ARM version of md5block.go
 
+//go:build !purego
+
 #include "textflag.h"
 
 // SHA-1 block routine. See sha1block.go for Go equivalent.
diff --git a/src/crypto/sha1/sha1block_arm64.go b/src/crypto/sha1/sha1block_arm64.go
index 08d3df0000..e6d96a9080 100644
--- a/src/crypto/sha1/sha1block_arm64.go
+++ b/src/crypto/sha1/sha1block_arm64.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package sha1
 
 import "internal/cpu"
diff --git a/src/crypto/sha1/sha1block_arm64.s b/src/crypto/sha1/sha1block_arm64.s
index d56838464d..d0ff0986b8 100644
--- a/src/crypto/sha1/sha1block_arm64.s
+++ b/src/crypto/sha1/sha1block_arm64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 #define HASHUPDATECHOOSE \
diff --git a/src/crypto/sha1/sha1block_decl.go b/src/crypto/sha1/sha1block_decl.go
index 8e20401c14..3edf5a4360 100644
--- a/src/crypto/sha1/sha1block_decl.go
+++ b/src/crypto/sha1/sha1block_decl.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build arm || 386 || s390x
+//go:build (arm || 386 || s390x) && !purego
 
 package sha1
 
diff --git a/src/crypto/sha1/sha1block_generic.go b/src/crypto/sha1/sha1block_generic.go
index ba35155d0b..4c6f74d99d 100644
--- a/src/crypto/sha1/sha1block_generic.go
+++ b/src/crypto/sha1/sha1block_generic.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 && !386 && !arm && !s390x && !arm64
+//go:build (!amd64 && !386 && !arm && !s390x && !arm64) || purego
 
 package sha1
 
diff --git a/src/crypto/sha1/sha1block_s390x.go b/src/crypto/sha1/sha1block_s390x.go
index 446bf5d36e..f8b0d8ba31 100644
--- a/src/crypto/sha1/sha1block_s390x.go
+++ b/src/crypto/sha1/sha1block_s390x.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package sha1
 
 import "internal/cpu"
diff --git a/src/crypto/sha1/sha1block_s390x.s b/src/crypto/sha1/sha1block_s390x.s
index 0fb7aef283..7a2f4e39c4 100644
--- a/src/crypto/sha1/sha1block_s390x.s
+++ b/src/crypto/sha1/sha1block_s390x.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // func block(dig *digest, p []byte)
diff --git a/src/crypto/sha256/fallback_test.go b/src/crypto/sha256/fallback_test.go
index 3f561aadd6..ceef3cc922 100644
--- a/src/crypto/sha256/fallback_test.go
+++ b/src/crypto/sha256/fallback_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build s390x
+//go:build s390x && !purego
 
 package sha256
 
diff --git a/src/crypto/sha256/sha256block_386.s b/src/crypto/sha256/sha256block_386.s
index 086a0ab25c..0e27fa02d7 100644
--- a/src/crypto/sha256/sha256block_386.s
+++ b/src/crypto/sha256/sha256block_386.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 // SHA256 block routine. See sha256block.go for Go equivalent.
 //
 // The algorithm is detailed in FIPS 180-4:
diff --git a/src/crypto/sha256/sha256block_amd64.go b/src/crypto/sha256/sha256block_amd64.go
index b5d2c9b574..fdd75a3f3e 100644
--- a/src/crypto/sha256/sha256block_amd64.go
+++ b/src/crypto/sha256/sha256block_amd64.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package sha256
 
 import "internal/cpu"
diff --git a/src/crypto/sha256/sha256block_amd64.s b/src/crypto/sha256/sha256block_amd64.s
index bbde6285d1..2559f659a2 100644
--- a/src/crypto/sha256/sha256block_amd64.s
+++ b/src/crypto/sha256/sha256block_amd64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // SHA256 block routine. See sha256block.go for Go equivalent.
diff --git a/src/crypto/sha256/sha256block_arm64.go b/src/crypto/sha256/sha256block_arm64.go
index e5da566363..434b6f253d 100644
--- a/src/crypto/sha256/sha256block_arm64.go
+++ b/src/crypto/sha256/sha256block_arm64.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package sha256
 
 import "internal/cpu"
diff --git a/src/crypto/sha256/sha256block_arm64.s b/src/crypto/sha256/sha256block_arm64.s
index d5c1eb0b2e..6757310c34 100644
--- a/src/crypto/sha256/sha256block_arm64.s
+++ b/src/crypto/sha256/sha256block_arm64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 #define HASHUPDATE \
diff --git a/src/crypto/sha256/sha256block_decl.go b/src/crypto/sha256/sha256block_decl.go
index 7d68cd95fe..85374cbdbb 100644
--- a/src/crypto/sha256/sha256block_decl.go
+++ b/src/crypto/sha256/sha256block_decl.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build 386 || amd64 || s390x || ppc64le || ppc64
+//go:build (386 || amd64 || s390x || ppc64le || ppc64) && !purego
 
 package sha256
 
diff --git a/src/crypto/sha256/sha256block_generic.go b/src/crypto/sha256/sha256block_generic.go
index fd098bec89..2964255f99 100644
--- a/src/crypto/sha256/sha256block_generic.go
+++ b/src/crypto/sha256/sha256block_generic.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 && !386 && !s390x && !ppc64le && !ppc64 && !arm64
+//go:build (!amd64 && !386 && !s390x && !ppc64le && !ppc64 && !arm64) || purego
 
 package sha256
 
diff --git a/src/crypto/sha256/sha256block_ppc64x.s b/src/crypto/sha256/sha256block_ppc64x.s
index b229ef619a..ba8fa623c1 100644
--- a/src/crypto/sha256/sha256block_ppc64x.s
+++ b/src/crypto/sha256/sha256block_ppc64x.s
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build ppc64 || ppc64le
+//go:build (ppc64 || ppc64le) && !purego
 
 // Based on CRYPTOGAMS code with the following comment:
 // # ====================================================================
diff --git a/src/crypto/sha256/sha256block_s390x.go b/src/crypto/sha256/sha256block_s390x.go
index 1a376c5f93..0a1dc5785d 100644
--- a/src/crypto/sha256/sha256block_s390x.go
+++ b/src/crypto/sha256/sha256block_s390x.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package sha256
 
 import "internal/cpu"
diff --git a/src/crypto/sha256/sha256block_s390x.s b/src/crypto/sha256/sha256block_s390x.s
index 9c30136b31..757d62f512 100644
--- a/src/crypto/sha256/sha256block_s390x.s
+++ b/src/crypto/sha256/sha256block_s390x.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // func block(dig *digest, p []byte)
diff --git a/src/crypto/sha512/fallback_test.go b/src/crypto/sha512/fallback_test.go
index ac0c2c3c76..b55a4a56fa 100644
--- a/src/crypto/sha512/fallback_test.go
+++ b/src/crypto/sha512/fallback_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build s390x
+//go:build s390x && !purego
 
 package sha512
 
diff --git a/src/crypto/sha512/sha512block_amd64.go b/src/crypto/sha512/sha512block_amd64.go
index 8da3e1473f..fd1baecb32 100644
--- a/src/crypto/sha512/sha512block_amd64.go
+++ b/src/crypto/sha512/sha512block_amd64.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build amd64
+//go:build !purego
 
 package sha512
 
diff --git a/src/crypto/sha512/sha512block_amd64.s b/src/crypto/sha512/sha512block_amd64.s
index 0fa0df2f60..bd4e3e6669 100644
--- a/src/crypto/sha512/sha512block_amd64.s
+++ b/src/crypto/sha512/sha512block_amd64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // SHA512 block routine. See sha512block.go for Go equivalent.
diff --git a/src/crypto/sha512/sha512block_arm64.go b/src/crypto/sha512/sha512block_arm64.go
index 243eb5c1d6..4e2793100a 100644
--- a/src/crypto/sha512/sha512block_arm64.go
+++ b/src/crypto/sha512/sha512block_arm64.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package sha512
 
 import "internal/cpu"
diff --git a/src/crypto/sha512/sha512block_arm64.s b/src/crypto/sha512/sha512block_arm64.s
index dfc35d69c3..25f3dbfe43 100644
--- a/src/crypto/sha512/sha512block_arm64.s
+++ b/src/crypto/sha512/sha512block_arm64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 // Based on the Linux Kernel with the following comment:
 // Algorithm based on https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fb87127bcefc17efab757606e1b1e333fd614dd0
 // Originally written by Ard Biesheuvel <ard.biesheuvel@linaro.org>
diff --git a/src/crypto/sha512/sha512block_decl.go b/src/crypto/sha512/sha512block_decl.go
index d5d03d0f3c..324659e62c 100644
--- a/src/crypto/sha512/sha512block_decl.go
+++ b/src/crypto/sha512/sha512block_decl.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build ppc64le || ppc64 || riscv64 || s390x
+//go:build (ppc64le || ppc64 || riscv64 || s390x) && !purego
 
 package sha512
 
diff --git a/src/crypto/sha512/sha512block_generic.go b/src/crypto/sha512/sha512block_generic.go
index f11c0980bd..9177722be1 100644
--- a/src/crypto/sha512/sha512block_generic.go
+++ b/src/crypto/sha512/sha512block_generic.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !amd64 && !arm64 && !ppc64 && !ppc64le && !riscv64 && !s390x
+//go:build (!amd64 && !arm64 && !ppc64 && !ppc64le && !riscv64 && !s390x) || purego
 
 package sha512
 
diff --git a/src/crypto/sha512/sha512block_ppc64x.s b/src/crypto/sha512/sha512block_ppc64x.s
index 90dbf0f02b..87aab80903 100644
--- a/src/crypto/sha512/sha512block_ppc64x.s
+++ b/src/crypto/sha512/sha512block_ppc64x.s
@@ -10,7 +10,7 @@
 // # details see http://www.openssl.org/~appro/cryptogams/.
 // # ====================================================================
 
-//go:build ppc64 || ppc64le
+//go:build (ppc64 || ppc64le) && !purego
 
 #include "textflag.h"
 
diff --git a/src/crypto/sha512/sha512block_riscv64.s b/src/crypto/sha512/sha512block_riscv64.s
index 361aafe49d..6fbd524a31 100644
--- a/src/crypto/sha512/sha512block_riscv64.s
+++ b/src/crypto/sha512/sha512block_riscv64.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // SHA512 block routine. See sha512block.go for Go equivalent.
diff --git a/src/crypto/sha512/sha512block_s390x.go b/src/crypto/sha512/sha512block_s390x.go
index 7df29fd298..d0f09ea9ed 100644
--- a/src/crypto/sha512/sha512block_s390x.go
+++ b/src/crypto/sha512/sha512block_s390x.go
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 package sha512
 
 import "internal/cpu"
diff --git a/src/crypto/sha512/sha512block_s390x.s b/src/crypto/sha512/sha512block_s390x.s
index 9fdf343900..230bd414d3 100644
--- a/src/crypto/sha512/sha512block_s390x.s
+++ b/src/crypto/sha512/sha512block_s390x.s
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !purego
+
 #include "textflag.h"
 
 // func block(dig *digest, p []byte)