cmd/go/internal/work/security.go: invalid flag in `#cgo LDFLAGS: -Wl,-rpath,.`

[t0rr3sp3dr0]

Go version

go version go1.23.3 darwin/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/Users/pedro/Library/Caches/go-build'
GOENV='/Users/pedro/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMODCACHE='/Users/pedro/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/pedro/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/Users/pedro/sdk/go1.23.3'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/Users/pedro/sdk/go1.23.3/pkg/tool/darwin_amd64'
GOVCS=''
GOVERSION='go1.23.3'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/pedro/Library/Application Support/go/telemetry'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='clang'
CXX='clang++'
CGO_ENABLED='1'
GOMOD='/Users/pedro/Documents/git/sapsigner/impl/emu/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/_3/sh8y1_5d07q_5xhk9k8mncs80000gn/T/go-build4238436678=/tmp/go-build -gno-record-gcc-switches -fno-common'

What did you do?

Run go build main.go in macOS with the following program.

• main.go

package main

// #cgo LDFLAGS: -Wl,-rpath,.
import "C"

func main() {}

### What did you see happen?

```console
% go build -v main.go
command-line-arguments
command-line-arguments: invalid flag in #cgo LDFLAGS: -Wl,-rpath,.

What did you expect to see?

% go build -v main.go
command-line-arguments

[t0rr3sp3dr0]

While looking for a workaround for #40559, I faced this problem. I don't see a reason why this shouldn't be allowed. This rpath instructs the loader for look for the libraries in the current working directory.

[t0rr3sp3dr0]

Actually, any value for rpath that contains a single character will be denied. I'm not sure if this was intentional or not. This is the regex: -Wl,-rpath(-link)?[=,]([^,@\-][^,]+).

[ianlancetaylor]

I don't see a problem with a path that is a single character. It would be fine to send a patch to change that. Thanks.

[gabyhelp]

Related Issues

• cmd/go/internal/work/security.go: invalid flag in `#cgo darwin LDFLAGS: -Wl,-rpath -Wl,@loader_path` #70923 (closed)
• go tool compile #55111 (closed)
• cmd/go: go tool rejects #cgo LDFLAGS: -Wl,-rpath,@executable_path/../Frameworks #40559
• cmd/go: allow invalid flag in #cgo LDFLAGS: CoreFoundation #43152 (closed)
• affected/package: cgo #63206 (closed)
• cmd/go: accept -Wl,-R,path #32167 (closed)
• cmd/go: allow flags in CGO_LDFLAGS environment variable not in security allowlist #42565 (closed)
• go build #52634 (closed)
• Test #67906 (closed)
• Documentation #35490 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[t0rr3sp3dr0]

@ianlancetaylor, should I extend the fix to other flags? -framework, -R, --just-symbols, -sectcreate, -syslibroot, and -undefined suffer from the same problem.

Proposed fixes:

- re(`-Wl,-framework,[^,@\-][^,]+`),
+ re(`-Wl,-framework,[^,@\-][^,]*`),

- re(`-Wl,-R,?([^@\-,][^,@]*$)`),
+ re(`-Wl,-R,?([^@\-,][^,@]*$)`),

- re(`-Wl,--just-symbols[=,]([^,@\-][^,@]+)`),
+ re(`-Wl,--just-symbols[=,]([^,@\-][^,@]*)`),

- re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]+)`),
+ re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]*)`),

- re(`-Wl,-sectcreate,([^,@\-][^,]+),([^,@\-][^,]+),([^,@\-][^,]+)`),
+ re(`-Wl,-sectcreate,([^,@\-][^,]*),([^,@\-][^,]*),([^,@\-][^,]*)`),

- re(`-Wl,-syslibroot[=,]([^,@\-][^,]+)`),
+ re(`-Wl,-syslibroot[=,]([^,@\-][^,]*)`),

- re(`-Wl,-undefined[=,]([^,@\-][^,]+)`),
+ re(`-Wl,-undefined[=,]([^,@\-][^,]*)`),

[ianlancetaylor]

Sure, but don't mix that change with any other changes. Thanks.

[gopherbot]

Change https://go.dev/cl/638035 mentions this issue: cmd/go/internal/work: allow single character values in -Wl, linker flags