Skip to content

Commit a6e5be0

Browse files
Bryan C. Millsgopherbot
Bryan C. Mills
authored andcommitted
cmd/go: omit build metadata that may contain system paths when -trimpath is set
CGO flag variables often include system paths for header files and compiled libraries. The point of -trimpath is to avoid dependending on system paths, so stamping these variables is counterproductive. Moreover, the point of stamping build information is to improve reproducibility. Since we don't also stamp the versions of C compilers, headers, and libraries used in a cgo build, only the most trivial cgo programs can be faithfully reproduced from the stamped information. Likewise, the -ldflags flag may include system-specific paths, particularly if external linking is in use. For now, we omit -ldflags entirely; however, in the future we may instead want to parse and redact the individual flags. Fixes #52372. Change-Id: I73318a01cce4371d66955b3261fc7ee58d4b33dd Reviewed-on: https://go-review.googlesource.com/c/go/+/409174 TryBot-Result: Gopher Robot <[email protected]> Auto-Submit: Bryan Mills <[email protected]> Reviewed-by: Ian Lance Taylor <[email protected]> Reviewed-by: Ian Lance Taylor <[email protected]> Run-TryBot: Bryan Mills <[email protected]>
1 parent d3ffff2 commit a6e5be0

File tree

2 files changed

+35
-3
lines changed

2 files changed

+35
-3
lines changed

src/cmd/go/internal/load/pkg.go

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2347,7 +2347,17 @@ func (p *Package) setBuildInfo(includeVCS bool) {
23472347
appendSetting("-gcflags", gcflags)
23482348
}
23492349
if ldflags := BuildLdflags.String(); ldflags != "" {
2350-
appendSetting("-ldflags", ldflags)
2350+
// https://go.dev/issue/52372: only include ldflags if -trimpath is not set,
2351+
// since it can include system paths through various linker flags (notably
2352+
// -extar, -extld, and -extldflags).
2353+
//
2354+
// TODO: since we control cmd/link, in theory we can parse ldflags to
2355+
// determine whether they may refer to system paths. If we do that, we can
2356+
// redact only those paths from the recorded -ldflags setting and still
2357+
// record the system-independent parts of the flags.
2358+
if !cfg.BuildTrimpath {
2359+
appendSetting("-ldflags", ldflags)
2360+
}
23512361
}
23522362
if cfg.BuildMSan {
23532363
appendSetting("-msan", "true")
@@ -2366,7 +2376,14 @@ func (p *Package) setBuildInfo(includeVCS bool) {
23662376
cgo = "1"
23672377
}
23682378
appendSetting("CGO_ENABLED", cgo)
2369-
if cfg.BuildContext.CgoEnabled {
2379+
// https://go.dev/issue/52372: only include CGO flags if -trimpath is not set.
2380+
// (If -trimpath is set, it is possible that these flags include system paths.)
2381+
// If cgo is involved, reproducibility is already pretty well ruined anyway,
2382+
// given that we aren't stamping header or library versions.
2383+
//
2384+
// TODO(bcmills): perhaps we could at least parse the flags and stamp the
2385+
// subset of flags that are known not to be paths?
2386+
if cfg.BuildContext.CgoEnabled && !cfg.BuildTrimpath {
23702387
for _, name := range []string{"CGO_CFLAGS", "CGO_CPPFLAGS", "CGO_CXXFLAGS", "CGO_LDFLAGS"} {
23712388
appendSetting(name, cfg.Getenv(name))
23722389
}

src/cmd/go/testdata/script/version_build_settings.txt

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,19 +51,34 @@ go build
5151
go version -m m$GOEXE
5252
stdout '^\tbuild\tCGO_ENABLED=0$'
5353
! stdout CGO_CPPFLAGS|CGO_CFLAGS|CGO_CXXFLAGS|CGO_LDFLAGS
54+
5455
[cgo] env CGO_ENABLED=1
5556
[cgo] env CGO_CPPFLAGS=-DFROM_CPPFLAGS=1
5657
[cgo] env CGO_CFLAGS=-DFROM_CFLAGS=1
5758
[cgo] env CGO_CXXFLAGS=-DFROM_CXXFLAGS=1
5859
[cgo] env CGO_LDFLAGS=-L/extra/dir/does/not/exist
59-
[cgo] go build
60+
[cgo] go build '-ldflags=all=-linkmode=external -extldflags=-L/bonus/dir/does/not/exist'
6061
[cgo] go version -m m$GOEXE
62+
[cgo] stdout '^\tbuild\t-ldflags="all=-linkmode=external -extldflags=-L/bonus/dir/does/not/exist"$'
6163
[cgo] stdout '^\tbuild\tCGO_ENABLED=1$'
6264
[cgo] stdout '^\tbuild\tCGO_CPPFLAGS=-DFROM_CPPFLAGS=1$'
6365
[cgo] stdout '^\tbuild\tCGO_CFLAGS=-DFROM_CFLAGS=1$'
6466
[cgo] stdout '^\tbuild\tCGO_CXXFLAGS=-DFROM_CXXFLAGS=1$'
6567
[cgo] stdout '^\tbuild\tCGO_LDFLAGS=-L/extra/dir/does/not/exist$'
6668

69+
# https://go.dev/issue/52372: a cgo-enabled binary should not be stamped with
70+
# CGO_ flags that contain paths.
71+
[cgo] env CGO_ENABLED=1
72+
[cgo] env CGO_CPPFLAGS=-DFROM_CPPFLAGS=1
73+
[cgo] env CGO_CFLAGS=-DFROM_CFLAGS=1
74+
[cgo] env CGO_CXXFLAGS=-DFROM_CXXFLAGS=1
75+
[cgo] env CGO_LDFLAGS=-L/extra/dir/does/not/exist
76+
[cgo] go build -trimpath '-ldflags=all=-linkmode=external -extldflags=-L/bonus/dir/does/not/exist'
77+
[cgo] go version -m m$GOEXE
78+
[cgo] ! stdout '/extra/dir/does/not/exist'
79+
[cgo] ! stdout '/bonus/dir/does/not/exist'
80+
[cgo] stdout '^\tbuild\tCGO_ENABLED=1$'
81+
6782
-- go.mod --
6883
module example.com/m
6984

0 commit comments

Comments
 (0)