From 421acf1022541abcbc167c17a38b4cf2e9bd26e3 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Mon, 30 Jan 2023 10:25:06 +1000
Subject: [PATCH] buildGo{Module,Package}: respect nix hardening flags when
 setting buildmode

---
 pkgs/build-support/go/module.nix  | 6 ++++++
 pkgs/build-support/go/package.nix | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 448143f76908..469a8bd67295 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -188,6 +188,12 @@ let
       ''}
     '' + ''
 
+      # currently pie is only enabled by default in pkgsMusl
+      # this will respect the `hardening{Disable,Enable}` flags if set
+      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+        export GOFLAGS="-buildmode=pie $GOFLAGS"
+      fi
+
       runHook postConfigure
     '';
 
diff --git a/pkgs/build-support/go/package.nix b/pkgs/build-support/go/package.nix
index ba1ab37a0c0e..9106bf9796eb 100644
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@@ -134,6 +134,12 @@ let
       export GOPATH=$NIX_BUILD_TOP/go:$GOPATH
       export GOCACHE=$TMPDIR/go-cache
 
+      # currently pie is only enabled by default in pkgsMusl
+      # this will respect the `hardening{Disable,Enable}` flags if set
+      if [[ $NIX_HARDENING_ENABLE =~ "pie" ]]; then
+        export GOFLAGS="-buildmode=pie $GOFLAGS"
+      fi
+
       runHook postConfigure
     '';