Reverts default PIE patch for go.
Does not reintroduce usages of removed "pie" hardening flag.
I've made a right mess 😿; we have to back go default PIE out late.
building with -race was just reported broken, there isn't time to investigate.
fixing is a mass rebuild.
People are using nixpkgs' go outside of nix derivations to produce
executables to copy into containers. buildGoModule currently sets
buildmode=exe when CGO_ENABLED=0 but this does nothing to maintain the
existing interface for external users.
We are fortunate that backing out the go PIE change in this manner
does not reintroduce breakage of pkgsMusl.rclone etc
that previously occurred when buildmode=pie *wasn't* set.
The gcc `--enable-default-pie` approach turns out to not cause problems
when mixed with a non-PIE go externally linked build. Historical issues
were due to our linker wrapper being less smart about enabling PIE.
Default PIE for go should be revisited post branch off.
Fixes: #456953Fixes: #461539
To avoid breaking previous documented[^1] behavior of CGO_ENABLED=0
producing fully static binaries we set buildmode=exe. Sadly go
does not support static-pie binaries so this means these packages
lose ASLR.
This is likely to be revisited after branch-off, as
go packages in the main package set with CGO_ENABLED=0 not having
ASLR is not good security posture in the long term and makes
go packages inconsistent with other languages.
[1]: See #var-go-CGO_ENABLED
Fixes: #456953
Fixes: 08aadbf8d4
Blanket application of the patch was insufficiently pessimistic.
The original plan from discussion in matrix
was that BuildModeSupported("gc", "pie", goos, goarch)
should let us know if default pie would work, however
it seems that in some cases BuildModeSupported can return
true but pie will fail anyway.
Let's make an allowlist of GOARCH values so we aren't
breaking any value that has not been tested.
Co-authored-by: Philip Taron <philip.taron@gmail.com>
We rely on teaching go to use the correct ELF interpreter
for PIE in a way that can't work for packages that
go off and do their own GOARCH=something cross builds
without touching nixpkgs cross machinery,
so update the default pie patch to bake targetPlatform's
GOARCH and only activate for it.
tailscale works as a testcase for this as it cross compiles
many arches in tstest/archtest/qemu_test.go
Teaches go's internal linker to use the GO_LDSO env var as the path for the dynamic linker, instead of defaulting to an FHS /lib path.
GO_LDSO is automatically set to the appropriate value by checking $NIX_CC/nix-support/dynamic-linker
External linking is set as the default for cross compile situations
where CGO is supported.
Teaching go to correctly handle cross
in the internal linker is hard, and our system linker already knows
how to find the right ELF interpreter.
For cross situations where CGO is not supported we assume either non-ELF
binaries or static binaries will be produced.
