From 8580b4c630ab20f701a69afda457158d00d066e4 Mon Sep 17 00:00:00 2001 From: Jindrich Novy Date: Aug 11 2020 06:37:03 +0000 Subject: Golang uses gcc to compile binaries but doesn't inherit CFLAGS. The CGO_CFLAGS variable needs to be used in order to do so. Not specifying CGO_CFLAGS would lead to not using %optflags and hence in unoptimized/unhardened code. Signed-off-by: Jindrich Novy --- diff --git a/guidelines/modules/ROOT/pages/index.adoc b/guidelines/modules/ROOT/pages/index.adoc index d7c3f29..1363c9e 100644 --- a/guidelines/modules/ROOT/pages/index.adoc +++ b/guidelines/modules/ROOT/pages/index.adoc @@ -702,7 +702,7 @@ Fedora uses gcc as the compiler (for all languages that gcc supports). Packages Compilers used to build packages must honor the applicable compiler flags set in the system rpm configuration. Honoring means that the contents of that variable is used as the basis of the flags actually used by the compiler during the package build. -For C, {cpp}, and Fortran code, the xref:RPMMacros.adoc#build-flags-macros-and-variables[%\{optflags} macro] contains these flags. +For C, {cpp}, Fortran and Golang code, the xref:RPMMacros.adoc#build-flags-macros-and-variables[%\{optflags} macro] contains these flags. For Golang it is required to specify a separate CGO_CFLAGS variable in spec file in order to take effect. Overriding these flags for performance optimizations (for instance, -O3 instead of -O2) is generally discouraged. If you can present benchmarks that show a significant speedup for this particular code, this could be revisited on a case-by-case basis. Adding to and overriding or filtering parts of these flags is permitted if there's a good reason to do so; the rationale for doing so must be documented in the specfile. There are certain, security related flags that are commonly allowed. These flags may degrade performance slightly but the increased security can be worthwhile for some programs.