From 4d1d61c75c703c1c0cd03de5cad69e63f4c563b0 Mon Sep 17 00:00:00 2001
From: Luna Nova <git@lunnova.dev>
Date: Wed, 5 Nov 2025 07:30:38 -0800
Subject: [PATCH] go: set buildmode=exe when CGO_ENABLED=0

To avoid breaking previous documented[^1] behavior of CGO_ENABLED=0
producing fully static binaries we set buildmode=exe. Sadly go
does not support static-pie binaries so this means these packages
lose ASLR.

This is likely to be revisited after branch-off, as
go packages in the main package set with CGO_ENABLED=0 not having
ASLR is not good security posture in the long term and makes
go packages inconsistent with other languages.

[1]: See #var-go-CGO_ENABLED

Fixes: #456953
Fixes: 08aadbf8d4dbdab061b455e3181b16046445b48b
---
 pkgs/build-support/go/module.nix        | 3 +++
 pkgs/development/compilers/go/tests.nix | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/go/module.nix b/pkgs/build-support/go/module.nix
index 30542b1d16c6..ce699c213454 100644
--- a/pkgs/build-support/go/module.nix
+++ b/pkgs/build-support/go/module.nix
@@ -253,6 +253,9 @@ lib.extendMkDerivation {
             if [ -f "$NIX_CC_FOR_TARGET/nix-support/dynamic-linker" ]; then
               export GO_LDSO=$(cat $NIX_CC_FOR_TARGET/nix-support/dynamic-linker)
             fi
+            if [ "$CGO_ENABLED" = "0" ]; then
+              export GOFLAGS="-buildmode=exe $GOFLAGS"
+            fi
             cd "$modRoot"
           ''
           + lib.optionalString (finalAttrs.vendorHash != null) ''
diff --git a/pkgs/development/compilers/go/tests.nix b/pkgs/development/compilers/go/tests.nix
index e8756419fcfb..3eeaa8b53262 100644
--- a/pkgs/development/compilers/go/tests.nix
+++ b/pkgs/development/compilers/go/tests.nix
@@ -15,7 +15,7 @@ let
   skopeo' = skopeo.override { buildGoModule = buildGoModule; };
   athens' = athens.override { buildGoModule = buildGoModule; };
   expectedCgoEnabledType = "DYN";
-  expectedCgoDisabledType = "DYN";
+  expectedCgoDisabledType = "EXE";
 in
 {
   skopeo = testers.testVersion { package = skopeo'; };