* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
@ 2020-04-12 11:02 ` travankor
2020-04-12 19:03 ` ericonr
` (14 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: travankor @ 2020-04-12 11:02 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 540 bytes --]
New comment by travankor on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-612597574
Comment:
@ericonr
I don't think the problem has to do with cgo. Travis suggests the failure occurs during linking. In the Alpine APKBUILD, it says "Go expect host linker instead of the cross-compiler"
That said, I think `gcc-go` already has pie support. I wonder why `gcc-go` isn't the default for Void's build style considering it has better ppc (big endian) support (@q66), among other advantages?
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
2020-04-12 11:02 ` travankor
@ 2020-04-12 19:03 ` ericonr
2020-04-12 19:04 ` ericonr
` (13 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-12 19:03 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 592 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-612661516
Comment:
In hindsight, copying Arch's patch might have been the wrong solution, given that they only use a single arch.
Regarding gcc-go, it seems current support is at Go 1.12.2 (https://golang.org/doc/install/gccgo), while Go is at 1.14.2. If that's a big issue I can't say. We'd also have to make some changes to the build_style, I think. And it would require a lot of testing as well, being an even bigger change than simply enabling PIE for everything.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
2020-04-12 11:02 ` travankor
2020-04-12 19:03 ` ericonr
@ 2020-04-12 19:04 ` ericonr
2020-04-12 19:32 ` q66
` (12 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-12 19:04 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 600 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-612661516
Comment:
@travankor
In hindsight, copying Arch's patch might have been the wrong solution, given that they only use a single arch.
Regarding gcc-go, it seems current support is at Go 1.12.2 (https://golang.org/doc/install/gccgo), while Go is at 1.14.2. If that's a big issue I can't say. We'd also have to make some changes to the build_style, I think. And it would require a lot of testing as well, being an even bigger change than enabling PIE for everything.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (2 preceding siblings ...)
2020-04-12 19:04 ` ericonr
@ 2020-04-12 19:32 ` q66
2020-04-12 20:49 ` travankor
` (11 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: q66 @ 2020-04-12 19:32 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 278 bytes --]
New comment by q66 on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-612664955
Comment:
gccgo is buggy (since gcc9 it frequently hangs on large projects, can't even bootstrap the official compiler), it's not a drop-in replacement
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (3 preceding siblings ...)
2020-04-12 19:32 ` q66
@ 2020-04-12 20:49 ` travankor
2020-04-12 21:09 ` ericonr
` (10 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: travankor @ 2020-04-12 20:49 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 525 bytes --]
New comment by travankor on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-612674001
Comment:
@ericonr
Use [Alpine's patch](https://git.alpinelinux.org/aports/plain/community/go/default-buildmode-pie.patch) and carefully check their APKBUILD. Once cross works, I would check important packages to see if they work. The main issue, as pointed out in the last attempt, is broken packages. Alpine most likely has fewer go packages due to their more stringent security policy.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (4 preceding siblings ...)
2020-04-12 20:49 ` travankor
@ 2020-04-12 21:09 ` ericonr
2020-04-18 5:39 ` ericonr
` (9 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-12 21:09 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 369 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-612676337
Comment:
I have tested the fscrypt executable (not the pam_module) compiled with go-pie. It worked well. What other project do you think it would be interesting to test? I can try to bootstrap the compiler with itself, at the very least.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (5 preceding siblings ...)
2020-04-12 21:09 ` ericonr
@ 2020-04-18 5:39 ` ericonr
2020-04-19 6:09 ` [PR PATCH] [Updated] " ericonr
` (8 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-18 5:39 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 255 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-615573400
Comment:
Huh, Alpine folks have just changed a lot of their Go package. Will have to take a closer look at the whole thing.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PR PATCH] [Updated] go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (6 preceding siblings ...)
2020-04-18 5:39 ` ericonr
@ 2020-04-19 6:09 ` ericonr
2020-04-19 6:16 ` ericonr
` (7 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-19 6:09 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 1109 bytes --]
There is an updated pull request by ericonr against master on the void-packages repository
https://github.com/ericonr/void-packages go-default-pie
https://github.com/void-linux/void-packages/pull/20854
go: enable PIE builds for Go executables
Fixed up version of #20450
Both Arch Linux and Alpine already implement this feature. Arch has a package called go-pie that's used for most of their PKGBUILDs, while the only version of Go on Alpine is one capable of producing PIE binaries.
On Arch: https://www.archlinux.org/packages/community/x86_64/go-pie/
On Alpine: https://pkgs.alpinelinux.org/package/edge/community/x86_64/go
The patch used here is actually adapted from the one used by Arch, and if adopted can allow us to remove the nostrip flag from the go build_style.
I'm getting some weird build output, where it says
loadinternal: cannot find runtime/cgo
so I'm not completely certain that it's 100% complete. Building a program that uses cgo does work cleanly, so I'm not sure what it means.
A patch file from https://github.com/void-linux/void-packages/pull/20854.patch is attached
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-go-default-pie-20854.patch --]
[-- Type: text/x-diff, Size: 1198 bytes --]
From 19b05766856fd8c1d5f334651051218ec0e7315e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89rico=20Rolim?= <erico.erc@gmail.com>
Date: Fri, 10 Apr 2020 17:54:35 -0300
Subject: [PATCH] go: enable PIE builds for Go executables
Enabling PIE builds for Go executables created by gc enables us to
remove the nostrip and nopie variables from those builds. nostrip was
moved to the gccgo cases only.
---
common/environment/build-style/go.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/common/environment/build-style/go.sh b/common/environment/build-style/go.sh
index 3f83013d4f7..fd23421fa6e 100644
--- a/common/environment/build-style/go.sh
+++ b/common/environment/build-style/go.sh
@@ -4,15 +4,15 @@ if [ -z "$hostmakedepends" -o "${hostmakedepends##*gcc-go-tools*}" ]; then
archs="aarch64* armv[567]* i686* x86_64* ppc64le*"
fi
hostmakedepends+=" go"
- nopie=yes
+ export GOFLAGS="-buildmode=pie"
else
# gccgo compiler
if [ "$CROSS_BUILD" ]; then
# target compiler to use; otherwise it'll just call gccgo
export GCCGO="${XBPS_CROSS_TRIPLET}-gccgo"
fi
+ nostrip=yes
fi
-nostrip=yes
case "$XBPS_TARGET_MACHINE" in
aarch64*) export GOARCH=arm64;;
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (7 preceding siblings ...)
2020-04-19 6:09 ` [PR PATCH] [Updated] " ericonr
@ 2020-04-19 6:16 ` ericonr
2020-04-19 6:22 ` ericonr
` (6 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-19 6:16 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 1078 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-616050062
Comment:
https://github.com/alpinelinux/aports/commits/master/community/go will give some idea of the apparent fight it is to get Go working properly.
That said, simply setting `GOFLAGS` to the appropriate value made it possible to build Go executables with pie, which can be stripped and checked by the build hooks (no more nostrip/nopie, yay). I have built executables for armv6l and x86_64, and preliminary testing shows them working well on x64, while I still have to test arm. It seems getting the compiler itself to be built with PIE will be harder.
Due to not having any idea about how to test arches that use gccgo (@q66 I imagine you have some experience with this, given your void-ppc project), I tried to keep the environment for that build system as close as possible to the original. If you orient me on testing, we can see if some or any of these changes can be moved to it as well.
@travankor if you want to take a look :)
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (8 preceding siblings ...)
2020-04-19 6:16 ` ericonr
@ 2020-04-19 6:22 ` ericonr
2020-04-20 3:37 ` the-maldridge
` (5 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-19 6:22 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 221 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-616051450
Comment:
Tested micro on armv6l-musl, cross compiled from x86_64-glibc. Worked perfectly.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (9 preceding siblings ...)
2020-04-19 6:22 ` ericonr
@ 2020-04-20 3:37 ` the-maldridge
2020-04-21 4:49 ` ericonr
` (4 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: the-maldridge @ 2020-04-20 3:37 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 267 bytes --]
New comment by the-maldridge on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-616290367
Comment:
There's a good reason that upstream has this turned off by default. Until we know why that is, this must not be merged.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (10 preceding siblings ...)
2020-04-20 3:37 ` the-maldridge
@ 2020-04-21 4:49 ` ericonr
2020-04-21 4:49 ` [PR PATCH] [Closed]: " ericonr
` (3 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-21 4:49 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 564 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-616949995
Comment:
Broken Go packages when building locally:
```
chronograf
dht-node
dnote-cli
etcd
goproxy
grafana
gucci
gx-go
gx
k3s
kubernetes -> linking issue, worked without the patch
kurly
lxd-lts
madonctl
spreed-webrtc -> worked cleanly the second time
vault
```
All broken packages besides `kubernetes` were due to misc errors (I will try to update their templates, for those that aren't yet explicitly broken).
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PR PATCH] [Closed]: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (11 preceding siblings ...)
2020-04-21 4:49 ` ericonr
@ 2020-04-21 4:49 ` ericonr
2020-04-21 4:51 ` ericonr
` (2 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-21 4:49 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 946 bytes --]
There's a closed pull request on the void-packages repository
go: enable PIE builds for Go executables
https://github.com/void-linux/void-packages/pull/20854
Description:
Fixed up version of #20450
Both Arch Linux and Alpine already implement this feature. Arch has a package called go-pie that's used for most of their PKGBUILDs, while the only version of Go on Alpine is one capable of producing PIE binaries.
On Arch: https://www.archlinux.org/packages/community/x86_64/go-pie/
On Alpine: https://pkgs.alpinelinux.org/package/edge/community/x86_64/go
The patch used here is actually adapted from the one used by Arch, and if adopted can allow us to remove the nostrip flag from the go build_style.
I'm getting some weird build output, where it says
loadinternal: cannot find runtime/cgo
so I'm not completely certain that it's 100% complete. Building a program that uses cgo does work cleanly, so I'm not sure what it means.
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (12 preceding siblings ...)
2020-04-21 4:49 ` [PR PATCH] [Closed]: " ericonr
@ 2020-04-21 4:51 ` ericonr
2020-09-29 1:50 ` [TRACKING-upstream] " ericonr
2020-09-29 1:50 ` [PR PATCH] [Closed]: " ericonr
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-04-21 4:51 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 473 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-616950772
Comment:
Sorry, misclicked.
Given that it can probably still use some polish, we shouldn't change the build_style yet. Furthermore, as pointed out, PIE doesn't make such a difference for safer languages, like Go. However, I would like to make this a TRACKING issue to keep up with advancements in the toolchain. Do you think that'd be ok?
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [TRACKING-upstream] go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (13 preceding siblings ...)
2020-04-21 4:51 ` ericonr
@ 2020-09-29 1:50 ` ericonr
2020-09-29 1:50 ` [PR PATCH] [Closed]: " ericonr
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-09-29 1:50 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 161 bytes --]
New comment by ericonr on void-packages repository
https://github.com/void-linux/void-packages/pull/20854#issuecomment-700376559
Comment:
Superseded by #24841
^ permalink raw reply [flat|nested] 17+ messages in thread* Re: [PR PATCH] [Closed]: [TRACKING-upstream] go: enable PIE builds for Go executables
2020-04-10 20:57 [PR PATCH] go: enable PIE builds for Go executables ericonr
` (14 preceding siblings ...)
2020-09-29 1:50 ` [TRACKING-upstream] " ericonr
@ 2020-09-29 1:50 ` ericonr
15 siblings, 0 replies; 17+ messages in thread
From: ericonr @ 2020-09-29 1:50 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 966 bytes --]
There's a closed pull request on the void-packages repository
[TRACKING-upstream] go: enable PIE builds for Go executables
https://github.com/void-linux/void-packages/pull/20854
Description:
Fixed up version of #20450
Both Arch Linux and Alpine already implement this feature. Arch has a package called go-pie that's used for most of their PKGBUILDs, while the only version of Go on Alpine is one capable of producing PIE binaries.
On Arch: https://www.archlinux.org/packages/community/x86_64/go-pie/
On Alpine: https://pkgs.alpinelinux.org/package/edge/community/x86_64/go
The patch used here is actually adapted from the one used by Arch, and if adopted can allow us to remove the nostrip flag from the go build_style.
I'm getting some weird build output, where it says
loadinternal: cannot find runtime/cgo
so I'm not completely certain that it's 100% complete. Building a program that uses cgo does work cleanly, so I'm not sure what it means.
^ permalink raw reply [flat|nested] 17+ messages in thread