invalid LDFLAGS break build with go1.9.4 / go1.10rc2

[dmitris]

On Linux, I'm getting the following error when trying to build the master version with go1.9.4:

$ go install ./...
go build github.com/miekg/pkcs11: invalid flag in #cgo LDFLAGS: -Wl,--no-as-needed

On Mac OS, getting the error:

$ go install ./...
go build github.com/miekg/pkcs11: invalid flag in #cgo LDFLAGS: -I/usr/local/share/libtool

Same errors with go1.10rc2. This is likely be due to changes / security fixes in golang/go#23672

@miekg

[miekg]

:-(

Can you send a PR?

[dmitris]

#64

I think that -Wl,--no-as-needed is missing in Go from https://github.com/golang/go/blob/master/src/cmd/go/internal/work/security.go#L88-L89

Is --no-as-needed a must-have? You can install the package with CGO_LDFLAGS_ALLOW='-Wl,--no-as-needed' go install but it's somewhat inconvenient for users to be forced to do it...

[miekg]

[ Quoting <notifications@github.com> in "Re: [miekg/pkcs11] invalid LDFLAGS ..." ]

#64 I think that `-Wl,--no-as-needed` is missing in Go from https://github.com/golang/go/blob/master/src/cmd/go/internal/work/security.go#L88-L89 Is `--no-as-needed` a must-have? You can install the package with `CGO_LDFLAGS_ALLOW='-Wl,--no-as-needed' go install` but it's somewhat inconvenient for users to be forced to do it...

I don't know. This as all working, and now "they" broke it

[dmitris]

I suggest to start with merging this as is, for the sake of the Darwinists, and then figure out what to do for Unix (not sure about Windows).

[tocosonic]

Simply migrate to GO version 1.10. This erroneous behaviour has been fixed in the most recent version.

[ilfrich]

Seems to still be an issue with 1.10 if you use an older library.

There's a workaround in the #67 issue linked above using an environment variable to override the error: CGO_LDFLAGS_ALLOW="-I.*" <your-build-command>

[andlabs]

Why do you need -I in LDFLAGS? cgo separates the compiler and linker phases, and -I is only relevant in the former. Unless there's something I'm missing?

-Wl,-no-as-needed should be in the whitelists by now. (This is why I did not like instant, reactionary responses to the security whitelist; it leads to more work for devs later on. There should be a reason for every option in a #cgo directive.)

[ilfrich]

@andlabs I'm not an expert on this project nor do I have much knowledge in Golang. I posted this primarily, because it was a quick workaround to a compile problem with certain libraries in an unrelated project. It solved the problem for me, so apparently does the latest Go version (although it may also be related to some other library versions). But if anyone finds the problem, this can be a quick workaround to prevent that specific error.