cmd/go: trimpath does not clean some CGO C filepaths

[vivi365]

Go version

go version go1.21.6 linux/amd64

Output of go env in your module/workspace:

GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/root/.cache/go-build'
GOENV='/root/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/root/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/root/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.6'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1815251191=/tmp/go-build -gno-record-gcc-switches'

What did you do?

Compiled a go package containing C code dependencies using -trimpath flag.

go version -m geth

go-ethereum/build/bin/geth: go1.21.6
        ...
	build	-buildmode=exe
	build	-compiler=gc
	build	-tags=urfave_cli_no_docs,ckzg
	build	-trimpath=true
	build	DefaultGODEBUG=panicnil=1
	build	CGO_ENABLED=1
	build	GOARCH=amd64
	build	GOOS=linux
	build	GOAMD64=v1
	build	vcs=git
	build	vcs.revision=2bd6bd01d2e8561dd7fc21b631f4a34ac16627a1
	build	vcs.time=2024-02-27T11:51:11Z
	build	vcs.modified=false

What did you see happen?

Some C packages with full paths embedded in binaries.

/root/go/pkg/mod/github.com/karalabe/usb@v0.0.2/libusb/libusb/os/linux_netlink.c
/root/go/pkg/mod/github.com/karalabe/usb@v0.0.2/libusb/libusb/os/linux_usbfs.c
/root/go/pkg/mod/github.com/ethereum/c-kzg-4844@v0.4.0/bindings/go/../../src/c_kzg_4844.c

What did you expect to see?

Relative, trimmed, paths for all C libraries.

[Jorropo]

I was not able to reproduce doing cd cmd/geth && go build -trimpath . with 0d4c38865e9cda492e71221c4c429d9b1bec8ac5 and 9f9dd2b can you please post a reproduction ?

[vivi365]

Hi,

Running this docker file should show some path embeddings in the .rodata.

FROM ubuntu:bionic

RUN apt-get update && apt-get install gcc-multilib git ca-certificates wget -yq --no-install-recommends
RUN git clone --branch master https://github.com/ethereum/go-ethereum.git && cd go-ethereum && git fetch
RUN wget https://go.dev/dl/go1.21.6.linux-amd64.tar.gz && \
	rm -rf /usr/local/go && \
	tar -C /usr/local -xzf go1.21.6.linux-amd64.tar.gz && \
	export PATH=$PATH:/usr/local/go/bin

RUN cd go-ethereum && git fetch && git checkout 0d4c38865e9cda492e71221c4c429d9b1bec8ac5 && \
    cd cmd/geth && CGO_ENABLED=1 /usr/local/go/bin/go build -trimpath .

RUN mv /go-ethereum/cmd/geth/geth /geth && readelf -p .rodata geth | grep /root/go/pkg >> full-paths.txt

/# cat full-paths.txt 
  [9e5270]  /root/go/pkg/mod/github.com/karalabe/hid@v1.0.1-0.20240306101548-573246063e52/libusb/libusb/libusbi.h
  [9e52d8]  /root/go/pkg/mod/github.com/karalabe/hid@v1.0.1-0.20240306101548-573246063e52/libusb/libusb/os/events_posix.c
  [9e5348]  /root/go/pkg/mod/github.com/karalabe/hid@v1.0.1-0.20240306101548-573246063e52/libusb/libusb/os/linux_netlink.c
  [9e53b8]  /root/go/pkg/mod/github.com/karalabe/hid@v1.0.1-0.20240306101548-573246063e52/libusb/libusb/os/linux_usbfs.c
  [9e5428]  /root/go/pkg/mod/github.com/karalabe/hid@v1.0.1-0.20240306101548-573246063e52/libusb/libusb/core.c
  [9e54c0]  /root/go/pkg/mod/github.com/karalabe/hid@v1.0.1-0.20240306101548-573246063e52/libusb/libusb/hotplug.c
  [9e5528]  /root/go/pkg/mod/github.com/karalabe/hid@v1.0.1-0.20240306101548-573246063e52/libusb/libusb/io.c

[Jorropo]

It is indeed broken, but not natively on arch (even with go1.21.6), I need to go through your Dockerfile to make it not work.
Using go1.22.2 didn't fixed anything.
However using today's ubuntu:latest base image fixed it for both go1.22.2 and go1.21.6:

-FROM ubuntu:bionic
+FROM ubuntu

RUN apt-get update && apt-get install gcc-multilib git ca-certificates wget -yq --no-install-recommends
RUN git clone --branch master https://github.com/ethereum/go-ethereum.git && cd go-ethereum && git fetch
-RUN wget https://go.dev/dl/go1.21.6.linux-amd64.tar.gz && \
+RUN wget https://go.dev/dl/go1.22.2.linux-amd64.tar.gz && \
	rm -rf /usr/local/go && \
-	tar -C /usr/local -xzf go1.21.6.linux-amd64.tar.gz && \
+	tar -C /usr/local -xzf go1.22.2.linux-amd64.tar.gz && \
	export PATH=$PATH:/usr/local/go/bin

RUN cd go-ethereum && git fetch && git checkout 0d4c38865e9cda492e71221c4c429d9b1bec8ac5 && \
    cd cmd/geth && CGO_ENABLED=1 /usr/local/go/bin/go build -trimpath .

RUN mv /go-ethereum/cmd/geth/geth /geth && readelf -p .rodata geth | grep /root/go/pkg >> full-paths.txt

I guess some integration bug somewhere with older releases of GCC ¿ could be a million thing idk
That where I'm gonna stop looking into this.

[Jorropo]

cc cmd/cgo @golang/compiler

[Jorropo]

Btw thx for the effort into reproducing this, it's tricky given it depends on other factors on the system than go and the source you are building but you nailed it with the docker file. 👍 🙂

[seankhliao]

I suppose the answer is to use a recent version of gcc.
ubuntu bionic is past EOL anyway.