cmd/go: new cgo protections mix up CFLAGS and LDFLAGS from pkg-config

[jeddenlea]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

1.9.4

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

Linux

What did you do?

Tried to build with cgo, like

#cgo pkg-config: foo

Within our contrived environment, we'll see,

$ $PKG_CONFIG --cflags foo
-pthread -I... -I... -I... -I... -I...
$ $PKG_CONFIG --libs foo
-L... -L... -L... -lfoo -lbar -Wl,--export-dynamic ...

What did you expect to see?

The linker flag -Wl,--export-dynamic there is rightfully rejected. It ought to be allowed with the CGO_LDFLAGS_ALLOW environment variable.

What did you see instead?

go build returned an error,

go build ...: invalid flag in pkg-config --cflags: -Wl,--export-dynamic

And, it may be built, but using CGO_CFLAGS_ALLOW, not CGO_LDFLAGS_ALLOW

I'll have a fix pushed shortly.

[gopherbot]

Change https://golang.org/cl/92755 mentions this issue: cmd/go: fix CGO_LDFLAGS_ALLOW check

[dgryski]

/cc @rsc

[raff]

I get a similar error with a package (LuaJIT) that does the following in order to link a *.a file:
#cgo LDFLAGS: ${SRCDIR}/../../../LuaJIT/LuaJIT/src/libluajit.a -lm -ldl

I was able to "fix" it by doing this, but it would be good if it was at least documented (also, I am wondering if there are any other cases if trying to pass non-flag parameters in CFLAGS/LDFLAGS):
#cgo LDFLAGS: -lm -ldl -L${SRCDIR}/../../../LuaJIT/LuaJIT/src -lluajit

[FiloSottile]

@raff yours seems like a separate issue, where this line is missing support for .a files:

go/src/cmd/go/internal/work/security.go

Line 91 in 104445e

re(`[a-zA-Z0-9_].*\.(o|obj|dll|dylib|so)`), // direct linker inputs: x.o or libfoo.so (but not -foo.o or @foo.o)

I submitted a CL for that. https://golang.org/cl/92855

[gopherbot]

Change https://golang.org/cl/92855 mentions this issue: cmd/go: add .a files to allowed linker inputs

[ianlancetaylor]

Closing in favor of a general whitelist issue in #23749.