Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: Build information embedded by Go 1.18 impairs build reproducibility with cgo flags [1.18 backport] #53119

Closed
gopherbot opened this issue May 27, 2022 · 2 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge GoCommand cmd/go
Milestone

Comments

@gopherbot
Copy link

@bcmills requested issue #52372 to be considered for backport to the next 1.18 minor release.

@gopherbot, please backport to Go 1.18. This is an unexpected side-effect of a change in Go 1.18, and interferes with build reproducibility.

@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label May 27, 2022
@gopherbot gopherbot added this to the Go1.18.3 milestone May 27, 2022
@dmitshur dmitshur added the GoCommand cmd/go label Jun 1, 2022
@dmitshur dmitshur modified the milestones: Go1.18.3, Go1.18.4 Jun 1, 2022
@bcmills bcmills added the CherryPickApproved Used during the release process for point releases label Jun 28, 2022
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Jun 28, 2022
@gopherbot
Copy link
Author

Change https://go.dev/cl/414794 mentions this issue: [release-branch.go1.18] cmd/go: omit build metadata that may contain system paths when -trimpath is set

@gopherbot gopherbot modified the milestones: Go1.18.4, Go1.18.5 Jul 12, 2022
@gopherbot
Copy link
Author

Closed by merging d252fdd to release-branch.go1.18.

gopherbot pushed a commit that referenced this issue Jul 25, 2022
…system paths when -trimpath is set

CGO flag variables often include system paths for header files and
compiled libraries. The point of -trimpath is to avoid dependending on
system paths, so stamping these variables is counterproductive.

Moreover, the point of stamping build information is to improve
reproducibility. Since we don't also stamp the versions of C
compilers, headers, and libraries used in a cgo build, only the most
trivial cgo programs can be faithfully reproduced from the stamped
information.

Likewise, the -ldflags flag may include system-specific paths,
particularly if external linking is in use. For now, we omit -ldflags
entirely; however, in the future we may instead want to parse and
redact the individual flags.

Updates #52372.
Fixes #53119.

Change-Id: I73318a01cce4371d66955b3261fc7ee58d4b33dd
Reviewed-on: https://go-review.googlesource.com/c/go/+/409174
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Bryan Mills <bcmills@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Bryan Mills <bcmills@google.com>
(cherry picked from commit a6e5be0)
Reviewed-on: https://go-review.googlesource.com/c/go/+/414794
Reviewed-by: Nooras Saba‎ <saba@golang.org>
@golang golang locked and limited conversation to collaborators Jul 25, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge GoCommand cmd/go
Projects
None yet
Development

No branches or pull requests

3 participants