tool/gocross: make gocross opt-in instead of opt-outnocross

gocross is not needed like it used to be, now that Go does
version stamping itself.

We keep it for the xcode and Windows builds for now.

This simplifies things in the build, especially with upcoming build
system updates.

Updates tailscale/corp#28679
Updates tailscale/corp#26717

Change-Id: Ib4bebe6f50f3b9c3d6cd27323fca603e3dfb43cc
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

4 files changed, 35 insertions, 5 deletions

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 11a851dc4..7ca7de4b6 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -161,7 +161,6 @@ jobs:
       if: matrix.buildflags == '' # skip on race builder
       working-directory: src
       run: |
-        export TS_USE_TOOLCHAIN=1
         ./build_dist.sh --extra-small ./cmd/tailscaled
         ./build_dist.sh --box ./cmd/tailscaled
         ./build_dist.sh --extra-small --box ./cmd/tailscaled
diff --git a/tool/gocross/gocross-wrapper.sh b/tool/gocross/gocross-wrapper.sh
index 366011fef..091028524 100755
--- a/tool/gocross/gocross-wrapper.sh
+++ b/tool/gocross/gocross-wrapper.sh
@@ -3,8 +3,11 @@
 # SPDX-License-Identifier: BSD-3-Clause
 #
 # gocross-wrapper.sh is a wrapper that can be aliased to 'go', which
-# transparently builds gocross using a "bootstrap" Go toolchain, and
-# then invokes gocross.
+# transparently runs the version of github.com/tailscale/go as specified repo's
+# go.toolchain.rev file.
+#
+# It also conditionally (if TS_USE_GOCROSS=1) builds gocross and uses it as a go
+# wrapper to inject certain go flags.
 
 set -euo pipefail
 
@@ -76,6 +79,14 @@ case "$REV" in
     ;;
 esac
 
+# gocross is opt-in as of 2025-06-16. See tailscale/corp#26717.
+# It's primarily used for xcode builds, and a bit still for Windows.
+# In the past we needed it for git version stamping on Linux etc, but
+# Go does that itself nowadays.
+if [ "${TS_USE_GOCROSS:-}" != "1" ]; then
+    exit 0 # out of subsehll
+fi
+
 if [[ -d "$toolchain" ]]; then
     # A toolchain exists, but is it recent enough to compile gocross? If not,
     # wipe it out so that the next if block fetches a usable one.
@@ -119,4 +130,23 @@ if [[ "$gocross_ok" == "0" ]]; then
 fi
 ) # End of the subshell execution.
 
-exec "${BASH_SOURCE%/*}/../../gocross" "$@"
+repo_root="${BASH_SOURCE%/*}/../.."
+
+# gocross is opt-in as of 2025-06-16. See tailscale/corp#26717
+# and comment above in this file.
+if [ "${TS_USE_GOCROSS:-}" != "1" ]; then
+    read -r REV <"${repo_root}/go.toolchain.rev"
+    case "$REV" in
+    /*)
+        toolchain="$REV"
+        ;;
+    *)
+        # If the prior subshell completed successfully, this toolchain location
+        # should be valid at this point.
+        toolchain="$HOME/.cache/tsgo/$REV"
+        ;;
+    esac
+    exec "$toolchain/bin/go" "$@"
+fi
+
+exec "${repo_root}/gocross" "$@"
diff --git a/tool/gocross/gocross_wrapper_test.go b/tool/gocross/gocross_wrapper_test.go
index 2b0f016a2..f4dcec429 100644
--- a/tool/gocross/gocross_wrapper_test.go
+++ b/tool/gocross/gocross_wrapper_test.go
@@ -15,7 +15,7 @@ import (
 func TestGocrossWrapper(t *testing.T) {
 	for i := range 2 { // once to build gocross; second to test it's cached
 		cmd := exec.Command("./gocross-wrapper.sh", "version")
-		cmd.Env = append(os.Environ(), "CI=true", "NOBASHDEBUG=false") // for "set -x" verbosity
+		cmd.Env = append(os.Environ(), "CI=true", "NOBASHDEBUG=false", "TS_USE_GOCROSS=1") // for "set -x" verbosity
 		out, err := cmd.CombinedOutput()
 		if err != nil {
 			t.Fatalf("gocross-wrapper.sh failed: %v\n%s", err, out)
diff --git a/version/print.go b/version/print.go
index be90432cc..43ee2b559 100644
--- a/version/print.go
+++ b/version/print.go
@@ -20,6 +20,7 @@ var stringLazy = sync.OnceValue(func() string {
 	if gitCommit() != "" {
 		fmt.Fprintf(&ret, "  tailscale commit: %s%s\n", gitCommit(), dirtyString())
 	}
+	fmt.Fprintf(&ret, "  long version: %s\n", Long())
 	if extraGitCommitStamp != "" {
 		fmt.Fprintf(&ret, "  other commit: %s\n", extraGitCommitStamp)
 	}