cmd/cgo: wrong parse cgo overlay file

[ser-mk]

Go version

go1.22.0 linux/amd64

Output of go env in your module/workspace:

GO111MODULE='on'
GOARCH='amd64'
GOBIN=''
GOCACHE='/tmp/.cache/go-build'
GOENV='/tmp/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/tmp/go/pkg/mod'
GOOS='linux'
GOPATH='/tmp/go'
GOPROXY='direct'
GOROOT='/snap/go/10535'
GOSUMDB='off'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/snap/go/10535/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.22.0'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/tmp/GolandProjects/extt/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1187410756=/tmp/go-build -gno-record-gcc-switches'

What did you do?

Go code:
example.go

package go_issue

/*
void f(){}
*/
import "C"

func example() {
	C.f()
}

I run cgo:

# go tool cgo example.go 
# ls _obj/_cgo_gotypes.go 
_obj/_cgo_gotypes.go

next I build go file with -overlay option
overlay.json:

{
  "Replace":
  {
    "example_cgo.go": "_obj/_cgo_gotypes.go"
  }
}

go build -overlay=overlay.json example_cgo.go

What did you see happen?

errors:

# go build -overlay=overlay.json example_cgo.go
# command-line-arguments
./_obj/_cgo_gotypes.go:34:3: //go:cgo_import_static _cgo_2ae947966da8_Cfunc_f only allowed in cgo-generated code
./_obj/_cgo_gotypes.go:39:3: //go:cgo_unsafe_args only allowed in cgo-generated code

What did you expect to see?

nothing/no error, because
_obj/_cgo_gotypes.go is a cgo-generated file

[seankhliao]

are you sure those instructions reproduce the issue?
it seems to work fine for me

[ser-mk]

Yes i am sure

@seankhliao
What are u go version?

[ianlancetaylor]

For the record, the way that the compiler decides that it is looking at a cgo-generated file is that the file name starts with _cgo_. That is considered somewhat reliable because cmd/go will ignore files whose names start with an underscore. (Of course it's easy to trick the compiler by invoking it directly, but who cares? We want to make go build safe, we don't need to make direct invocations of the compiler safe.)

Presumably that test is somehow being confused by the use of -overlay. But at least it's being confused in a safe way.

So, with that background: what are you trying to do? Why is this an important use case that we need to address in cmd/go and cmd/compile?

[ser-mk]

I attempted to export C symbols without the -std flag, as discussed here
https://groups.google.com/g/golang-nuts/c/mvOWQxNkMfs/m/J5yAXkeJAAAJ
However, I decided to try the -overlay option.

Interestingly, when I use both the -overlay and -trimpath options, the compilation succeeds, but the behavior seems strange.

$ go build -trimpath -overlay=overlay.json example_cgo.go
$ echo $?
0

[mknyszek]

CC @golang/compiler

[mknyszek]

In triage:

It seems like you're trying to use -overlay to override a cgo-generated file, but I don't think we, in general, want to allow overriding cgo-generated files because that has security implications. I think we're also still unclear on what your end-goal is here. Thanks.

[ser-mk]

I'm looking to utilize cgo pragmas such as //go:cgo_unsafe_args and //go:cgo_static_export in my code. However, if allowing the use of -overlay has security implications, I'm prepared to avoid using it.

Regarding the compilation of cgo files with the -trimpath option, could you please clarify if this also has security implications?

$ go build -trimpath -overlay=overlay.json example_cgo.go
$ echo $?
0

[cherrymui]

//go:cgo_unsafe_args and //go:cgo_static_export

These directives are intended for internal use of the Go implementation itself. They are not supposed to be used in user code. Please use cgo as documented in https://go.dev/cmd/cgo , instead of trying to bypass the restrictions with -overlay. Thanks.