Compiling go with --cross-compile-common breaks x509 certificates

[joeshaw]

This breaks validation of SSL certificates, and prevents the go get tool from working, since it uses SSL to fetch from code.google.com and GitHub, among others.

$ brew install go --cross-compile-common
$ go get code.google.com/p/goprotobuf/proto
package code.google.com/p/goprotobuf/proto: Get https://code.google.com/p/goprotobuf/source/checkout?repo=: x509: certificate signed by unknown authority
$

$ brew install go --fresh
$ go get code.google.com/p/goprotobuf/proto
$

Go cannot get any certificates from the OS X keychain when built with --cross-compile-common. This is because it uses cgo to compile some native C code to access the keychain. For whatever reason, cgo seems to be disabled when the toolchain is built, despite :cgo => true in the formula. I haven't yet debugged it futher.

[joeshaw]

Reordering the build order seems to fix it, although i am not sure why.

diff --git i/Library/Formula/go.rb w/Library/Formula/go.rb
index 3390fa9..0c6dd57 100644
--- i/Library/Formula/go.rb
+++ w/Library/Formula/go.rb
@@ -30,9 +30,9 @@ class Go < Formula
       ]
     elsif build.include? 'cross-compile-common'
       targets = [
-        ['darwin',  ['386', 'amd64'],        { :cgo => true  }],
         ['linux',   ['386', 'amd64', 'arm'], { :cgo => false }],
         ['windows', ['386', 'amd64'],        { :cgo => false }],
+        ['darwin',  ['386', 'amd64'],        { :cgo => true  }],
       ]
     else
       targets = [

[joeshaw]

Each cross-compile build also rebuilds the host platform. So since the code previously built windows/amd64 last, darwin/amd64 was built with ENABLE_CGO=0, which breaks x509 among probably others.

The solution (or workaround, unless this inefficiency is fixed upstream) is to always build darwin/amd64 last. Attached commit does that.

[MikeMcQuaid]

Can/have you filed this upstream?

[joeshaw]

Just did: https://code.google.com/p/go/issues/detail?id=4791

[MikeMcQuaid]

I suggest attaching a patch to it too.

[MikeMcQuaid]

(Thanks!)

[joeshaw]

Regardless of the outcome upstream, is there any reason not to merge the patch in homebrew? Build order is determined entirely by the formula.