'invalid flag' when building with Go 1.15.5

[reivilibre]

Hello,

Being inexperienced with Go, I didn't know any better and downloaded Go 1.15.5. Compiling maddy with ./build.sh package gave me this error message:

                                _|        _|
_|_|_|  _|_|      _|_|_|    _|_|_|    _|_|_|  _|    _|
_|    _|    _|  _|    _|  _|    _|  _|    _|  _|    _|
_|    _|    _|  _|    _|  _|    _|  _|    _|  _|    _|
_|    _|    _|    _|_|_|    _|_|_|    _|_|_|    _|_|_|
                                                    _|
 All-in-one composable mail server.             _|_|

--- Using system Go toolchain (1.15.5, /home/scone/go/go/bin/go).
--- maddy 0.4.2+gbf982eb
--- Downloading dependencies...
--- Building main executable...
go build runtime/cgo: invalid flag in go:cgo_ldflag: -Wl,-z,relro,-z,now

I seem able to build Maddy with Go 1.14.3.

Not sure if this is something I did wrong or whether this is an incompatibility...

[foxcpp]

I am definitely able to compile maddy with Go 1.15.5, gcc 10.2.0 and GNU/binutils 2.35.1.

The issue seems to be related to build.sh forcing the use of certain linker flags for toolchain-based hardening:

export CGO_CFLAGS="-g -O2 -D_FORTIFY_SOURCE=2 $CFLAGS"
export CGO_CXXFLAGS="-g -O2 -D_FORTIFY_SOURCE=2 $CXXFLAGS"
export LDFLAGS="-Wl,-z,relro,-z,now $LDFLAGS"
export CGO_LDFLAGS=$LDFLAGS

These LDFLAGS enable read-only relocations and force immediate resolution of dynamic symbols.

Can you provide more details on the build environment? Linux distro? C compiler used and its version? GNU/binutils version?

[reivilibre]

Hi, the following things describe the build environment

Distro: Ubuntu 20.04 LTS (focal)
gcc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0
binutils 2.34-6ubuntu1

[foxcpp]

This is the toolchain regression affecting Go 1.15.5 and Go 1.14.13.
Older versions should not be affected. Go 1.15.6 will include a fix.

Workaround is to whitelist hardening flags used by builds.sh via CGO_LDFLAGS_ALLOW before running it:

export CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now'

More information here: golang/go#42565