What version of Go are you using (go version)?

go version go1.11.2 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/john_mah/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/john_mah/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/hn/p6x1ph7n7d1_hw94vtd7blch2prvm6/T/go-build509899979=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Specifying the -sectcreate linker flags in cgo LDFLAGS fails due to options blacklisting. Sample code here: https://play.golang.org/p/rLGjmbfxTI7 (does not run due to constraints of the playground).

A workaround is to build with CGO_LDFLAGS_ALLOW exceptions:

CGO_LDFLAGS_ALLOW="-sectcreate|__TEXT|__info_plist|__launchd_plist|${SRCDIR}/Launchd.plist|${SRCDIR}/Info.plist" go build -ldflags "-linkmode external"

Specifying -linkmode external is required.

What did you expect to see?

No errors during the compile phase.

What did you see instead?

go build _/Users/john_mah/gitlab/lstp: invalid flag in #cgo LDFLAGS: -sectcreate

Notes

macOS developers use -sectcreate linker options to embed Info.plist and Launchd.plist property files into executables so that they can be used as daemons (or Privileged Helper Tools) on macOS. This can only be done at link time and needs to be done before codesigning takes place.

Specifying the -sectcreate options in global CGO_LDFLAGS environment has the unusual side effect of emitting multiple -sectcreate directives in the final linker statement which end up corrupting the embedded file. (Perhaps a separate bug should be filed for this)