go: set buildmode=exe when CGO_ENABLED=0

To avoid breaking previous documented[^1] behavior of CGO_ENABLED=0
producing fully static binaries we set buildmode=exe. Sadly go
does not support static-pie binaries so this means these packages
lose ASLR.

This is likely to be revisited after branch-off, as
go packages in the main package set with CGO_ENABLED=0 not having
ASLR is not good security posture in the long term and makes
go packages inconsistent with other languages.

[1]: See #var-go-CGO_ENABLED

Fixes: #456953
Fixes: 08aadbf8d4

pkgs/build-support/go/module.nix

@@ -253,6 +253,9 @@ lib.extendMkDerivation {
             if [ -f "$NIX_CC_FOR_TARGET/nix-support/dynamic-linker" ]; then
               export GO_LDSO=$(cat $NIX_CC_FOR_TARGET/nix-support/dynamic-linker)
             fi
+            if [ "$CGO_ENABLED" = "0" ]; then
+              export GOFLAGS="-buildmode=exe $GOFLAGS"
+            fi
             cd "$modRoot"
           ''
           + lib.optionalString (finalAttrs.vendorHash != null) ''

pkgs/development/compilers/go/tests.nix

@@ -15,7 +15,7 @@ let
   skopeo' = skopeo.override { buildGoModule = buildGoModule; };
   athens' = athens.override { buildGoModule = buildGoModule; };
   expectedCgoEnabledType = "DYN";
-  expectedCgoDisabledType = "DYN";
+  expectedCgoDisabledType = "EXE";
 in
 {
   skopeo = testers.testVersion { package = skopeo'; };