cmd/go: cache confuses package with different build tags when using CGO with pkg-config

[secDre4mer]

Go version

go version go1.24.1 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='on'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/max/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/max/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3066765338=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/home/max/workspace/scratchpad/cacheissue/go.mod'
GOMODCACHE='/home/max/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/max/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/lib/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/max/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/lib/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.1'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

I encountered this issue while using https://github.com/hillu/go-yara/v4.

The setup for this is fairly complex and requires a Golang program using CGO with a #cgo pkg-config instruction to reference a C library, which refers to another C library as a private dependency in its pkg-config file. In go-yara's case, go-yara uses libyara which has libcrypto as a private dependency.

This can also be reproduced without libyara; a minimal example (which, due to the aforementioned complex setup, is not that small) is attached as a ZIP file.
minimalexample.zip

As a prerequisite for reproducing the issue, the contained C libraries in dependencies/c need to be built with gcc -c life.c earth.c && ar rcs liblife.a life.o && ar rcs libearth.a earth.o.

Now, the program can be built with:
go clean -cache go build -tags life_static .
Which should succeed.

A build without life_static tag should fail:
go clean -cache go build .

However, the issue arises when building first without life_static (which will fail) and then with life_static (which shouldn't fail):

go clean -cache go build . ; go build -tags life_static .

What did you see happen?

For the first go build invocation (without life_static tag), the build (expectedly) fails since the symbols of libearth are missing for the (statically built) liblife.

However, the second go build invocation (with life_static) also fails, with the same error message, despite the same invocation succeeding on a clean cache.

This seems to be related to to the build cache (since building on a clean cache succeeds); presumably, the cache reuses the already built packages from the previous build, despite the fact that they were built with different tags.

What did you expect to see?

go build -tags life_static should always return the same result.

[dmitshur]

CC @matloob, @samthanawalla.