Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modules information (runtime.modinfo) cannot be stripped from final binary #41895

Closed
YuvalAvra opened this issue Oct 9, 2020 · 1 comment
Closed

Comments

@YuvalAvra
Copy link

@YuvalAvra YuvalAvra commented Oct 9, 2020

What did you do?

Compiled a striped go binary.

$ go build -ldflags="-s -w" -trimpath

What did you expect to see?

Module information stripped from the binary.

What did you see instead?

Go includes module information in the binary in runtime.modinfo.

$ go version -m hello
hello: go1.14.2
	path	example.com/user/hello
	mod	example.com/user/hello	(devel)	
	dep	github.com/google/go-cmp	v0.5.2	h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=

In production environments, this kind of information can be used by attackers to target vulnerable dependencies. Consider allowing users to strip that information either through the current stripping flags or via a new flag.

@YuvalAvra
Copy link
Author

@YuvalAvra YuvalAvra commented Oct 9, 2020

Found a way to remove this information, use -linkshared. Closing.

@YuvalAvra YuvalAvra closed this Oct 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant
You can’t perform that action at this time.