Reverts default PIE patch for go.
Does not reintroduce usages of removed "pie" hardening flag.
I've made a right mess 😿; we have to back go default PIE out late.
building with -race was just reported broken, there isn't time to investigate.
fixing is a mass rebuild.
People are using nixpkgs' go outside of nix derivations to produce
executables to copy into containers. buildGoModule currently sets
buildmode=exe when CGO_ENABLED=0 but this does nothing to maintain the
existing interface for external users.
We are fortunate that backing out the go PIE change in this manner
does not reintroduce breakage of pkgsMusl.rclone etc
that previously occurred when buildmode=pie *wasn't* set.
The gcc `--enable-default-pie` approach turns out to not cause problems
when mixed with a non-PIE go externally linked build. Historical issues
were due to our linker wrapper being less smart about enabling PIE.
Default PIE for go should be revisited post branch off.
Fixes: #456953Fixes: #461539
This fixes the GCC 15.2.0 build on aarch64-darwin by addressing two issues
in the libgcc build process:
1. Update libgcc-darwin-detection.patch:
- Catch arm64-apple-darwin (which lacks a version number)
- Add t-darwin-libgccs1 to enable libgcc_s.1.dylib compatibility build
2. Added libgcc-darwin-fix-reexport.patch:
- Remove reexport of darwin-unwind.ver symbols in libgcc_s.1.dylib
- These symbols (___register_frame_info, etc.) don't exist in libgcc
on modern macOS as they come from libSystem
The original build failed with:
Undefined symbols for architecture arm64:
"___deregister_frame_info", referenced from:
-reexported_symbols_list command line option
...
This occurred because darwin-unwind.ver lists unwinder symbols that are
excluded from libgcc (via libgcc-libsystem.ver) on macOS 11+ where they
are provided by the system's libSystem.
On Darwin, it is apparently Oracle's intention to be hostile towards
builds of Clang which are not by Apple.
see https://github.com/oracle/graal/issues/12041
If you want native-image to both work on Darwin and use the nix-provided CC
then you must pass it the flags to disable toolchain checking entirely.
Since the flags are mandatory for functionality,
they should be part of the wrapper.
