Am 12.07.26 um 08:53 schrieb Nilesh Patra: > Lintian maintainer here. > > I don't understand clearly what "audit" means here, and what lintian needs > to do here. Do you want lintian to emit a classification hint with module > name or so? Could someone explain the requirement?
Hi Nilesh, that's great, thanks for asking. Andrew did write a shell script in his proof-of-concept, which can analyze a go binary and detect the settings which were used during compilation. At the MiniDebconf Hamburg, we've implemented that logic in a perl script for dh_golang. You can see the script in this repository: https://salsa.debian.org/toddy/dh-golang/-/blob/go-work/script/dh_golang_check_debug The essential check (the "audit") can be found in line 79. Basically, all the script does is to run "go version -m $BINARY" for each binary in the $BUILDDIR/usr/bin directory and emit a warning if the variable "DefaultGODBUG" is found. This is an example output on testing for hugo: $ go version -m /usr/bin/hugo /usr/bin/hugo: go1.26.2 path github.com/gohugoio/hugo build -buildmode=exe build -compiler=gc build -tags=dev,extended build -trimpath=true build DefaultGODEBUG=asynctimerchan=1,[...] build CGO_ENABLED=1 build GOARCH=amd64 build GOOS=linux build GOAMD64=v1 I've trimmed the DefaultGODEBUG line, it's really long. For lintian, I think we don't want to add a new dependency on golang, so the detection needs to use another program than the go compiler to extract the DefaultGODEBUG settings. Lintian already depends on binutils, so we can use readelf or objdump or objcopy without adding more dependencies. The go compiler is just a convenient way to extract a section from the built binary, we can get the same result with some manual tweaking. The output from above is contained in a section called ".go.buildinfo". I've had success using this commandline: $ objcopy -O binary --only-section=.go.buildinfo /usr/bin/hugo output.bin $ strings output.bin | grep DefaultGODEBUG If the grep call returns a match, lintian could show the used settings. If it doesn't match, then there were no settings used during the build (which would be our goal for the golang ecosystem). My personal feeling is that lintian should emit a warning if DefaultGODEBUG is detected in a binary. This should probably be repeated for each affected binary. Regards, Tobias
OpenPGP_signature.asc
Description: OpenPGP digital signature
