fix: fingerprint mismatch when using -tags that affect injected packages
#429
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…kages In certain conditions, using `-tags` that affect injected packages, such as `-tags=appsec` when `CGO_ENABLED=0` results in a fingerprint mismatch at link time, due to the go build flags being incorrectly discovered. This is fixed by making several changes: - Changes how the "shared" build flags are set in the job server's `pkgs.Resolve` operation, so that they are resolved during execution, instead of when creating the request; ensuring the pre-set flags are used in cases where "driver mode" is used; - Actively parse `-a` and `-toolexec` from go process args, so we explicitly prevent them from being forwarded (`-a` in particular causes builds to be A LOT slower due to re-building many injected packages over and over again); - Adds trace logging here and there to make this type of issues a little easier to debug in the future (essentially persisted the debugging logs I've added when investigating this issue), - Set `GOTMPDIR` when building packages in `pkgs.Resolve` so that the downstream builds are easy to find, and are organized in a way that matches the original build's process hierarchy; - The build ID for the version now also gets the original build flags, as they may affect what files get compiled or not (which in turns will affect the content checksum).
eliottness
approved these changes
Nov 28, 2024
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #429 +/- ##
==========================================
+ Coverage 62.75% 63.96% +1.20%
==========================================
Files 181 181
Lines 12950 10989 -1961
==========================================
- Hits 8127 7029 -1098
+ Misses 4301 3433 -868
- Partials 522 527 +5
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In certain conditions, using
-tagsthat affect injected packages, such as-tags=appsecwhenCGO_ENABLED=0results in a fingerprint mismatch at link time, due to the go build flags being incorrectly discovered.This is fixed by making several changes:
pkgs.Resolveoperation, so that they are resolved during execution, instead of when creating the request; ensuring the pre-set flags are used in cases where "driver mode" is used;-aand-toolexecfrom go process args, so we explicitly prevent them from being forwarded (-ain particular causes builds to be A LOT slower due to re-building many injected packages over and over again);GOTMPDIRwhen building packages inpkgs.Resolveso that the downstream builds are easy to find, and are organized in a way that matches the original build's process hierarchy;