cmd/compile: reproducible builds with cgo

[StaticRocket]

Go version

go version go1.25.5 X:nodwarf5 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/res/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/res/.config/go/env'
GOEXE=''
GOEXPERIMENT='nodwarf5'
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1033279940=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/home/res/.local/share/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/res/.local/share/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/lib/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/res/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/lib/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.25.5 X:nodwarf5'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

Using the same example code listed on #75253 on both linux/386 and linux/amd64

1. Build a single shared library
2. Build a cgo application that links against that library
3. Remove the cache directory (~/.cache/go-build/)
4. Build the same cgo application again using the same shared library

What did you see happen?

The .note.go.buildid and subsequently the .note.gnu.build-id sections of the ELF file will be different.

What did you expect to see?

Given the same library, source files, build path, and build arguments that the output binary should be the same.

[StaticRocket]

Only related issue I could find was this, but it was platform specific. This seems to be a platform agnostic issue now.

#56896

[StaticRocket]

Hm. Apparently this issue is conditional on some external factor? I tested this with go version go1.25.5 X:nodwarf5 linux/amd64 on another machine and the binary was reproducible.

The only difference between the two go env outputs is the GOGCCFLAGS, where one is -ffile-prefix-map=/tmp/go-build2479072616=/tmp/go-build and the other is -ffile-prefix-map=/tmp/go-build1033279940=/tmp/go-build. I don't think that should have any bearing on build ID thought.

[StaticRocket]

Alright. I zeroed in on the 386 version of this issue, using Yocto's reproducible build selftest to make sure I'm not going crazy. Dumping the hashes for every stage and forcing the build to be single threaded I can see that the first hash to change is:

HASH[build runtime]: "import internal/runtime/exithook 38VdSwyw4Qo-dD2DZs4y\n"

Followed almost immediately by:

HASH[build runtime]: "import internal/runtime/maps GMkAmA5xNl7exoJga5Hs\n"

This causes the runtime hash to change and from there I assume it cascades.

---

A few lines of context around these changes

A:

HASH[build runtime]: "import internal/godebugs Dughwb6LvwzyWNJz_7WF\n"
HASH[build runtime]: "import internal/goexperiment aZIwP_oyTVFE53F-YnNk\n"
HASH[build runtime]: "import internal/goos vscG6LflSKG1IvTURTeV\n"
HASH[build runtime]: "import internal/profilerecord -koKbLljZg0hE0lnN6U-\n"
HASH[build runtime]: "import internal/runtime/atomic FsOgqq93ZTUv1n_IrSVu\n"
HASH[build runtime]: "import internal/runtime/cgroup Csv6EaAkN_YyKhP6bsVX\n"
HASH[build runtime]: "import internal/runtime/exithook 38VdSwyw4Qo-dD2DZs4y\n"
HASH[build runtime]: "import internal/runtime/gc FAN3Sk1SywFXbg0vBaxk\n"
HASH[build runtime]: "import internal/runtime/maps GMkAmA5xNl7exoJga5Hs\n"
HASH[build runtime]: "import internal/runtime/math 4pi-50JzjDw9b6jT8qB-\n"
HASH[build runtime]: "import internal/runtime/strconv HyNTbHGv4XjYvdxiRtDI\n"
HASH[build runtime]: "import internal/runtime/sys 35u_MCd9QP9E6KYMubQf\n"
HASH[build runtime]: "import internal/runtime/syscall JyIFPmp3UqLhePowsYFx\n"
HASH[build runtime]: "import internal/stringslite _cMuPXxNlRRkDXV_eS9c\n"
HASH[build runtime]: "import internal/trace/tracev2 1rtyeEe-is-6rRHcKXLy\n"
HASH[build runtime]: "import unsafe \n"
HASH[build runtime]: 35adb64699dcd50e6895fc9986a9f85be7386243d8f64b105f92b46f1bf5e945
runtime
HASH subkey 35adb64699dcd50e6895fc9986a9f85be7386243d8f64b105f92b46f1bf5e945 "srcfiles" = c64a4bcbf5f66d652e76dcbfe75b6a57c18f11f3b08b65758f7d85b855d5d076
HASH subkey 35adb64699dcd50e6895fc9986a9f85be7386243d8f64b105f92b46f1bf5e945 "stdout" = 1c02f2c7f6449e56f185626d873a670bdaf7286c1cc76ccc924991f1aa1ce2be

B:

HASH[build runtime]: "import internal/godebugs Dughwb6LvwzyWNJz_7WF\n"
HASH[build runtime]: "import internal/goexperiment aZIwP_oyTVFE53F-YnNk\n"
HASH[build runtime]: "import internal/goos vscG6LflSKG1IvTURTeV\n"
HASH[build runtime]: "import internal/profilerecord -koKbLljZg0hE0lnN6U-\n"
HASH[build runtime]: "import internal/runtime/atomic FsOgqq93ZTUv1n_IrSVu\n"
HASH[build runtime]: "import internal/runtime/cgroup Csv6EaAkN_YyKhP6bsVX\n"
HASH[build runtime]: "import internal/runtime/exithook qJh3mVJ5KJNelUwB_bDL\n"
HASH[build runtime]: "import internal/runtime/gc FAN3Sk1SywFXbg0vBaxk\n"
HASH[build runtime]: "import internal/runtime/maps xydvrs_565KTfnTyIU34\n"
HASH[build runtime]: "import internal/runtime/math 4pi-50JzjDw9b6jT8qB-\n"
HASH[build runtime]: "import internal/runtime/strconv HyNTbHGv4XjYvdxiRtDI\n"
HASH[build runtime]: "import internal/runtime/sys 35u_MCd9QP9E6KYMubQf\n"
HASH[build runtime]: "import internal/runtime/syscall JyIFPmp3UqLhePowsYFx\n"
HASH[build runtime]: "import internal/stringslite _cMuPXxNlRRkDXV_eS9c\n"
HASH[build runtime]: "import internal/trace/tracev2 1rtyeEe-is-6rRHcKXLy\n"
HASH[build runtime]: "import unsafe \n"
HASH[build runtime]: 7f82fa82de2d5e33875ffc39fa6ae1ced28e717f53399fdfd69a50a9722c74ff
runtime
HASH subkey 7f82fa82de2d5e33875ffc39fa6ae1ced28e717f53399fdfd69a50a9722c74ff "srcfiles" = 77b1bd77657f4cf001287703318bd870a57b20e50912360ba896e0105c2ce242
HASH subkey 7f82fa82de2d5e33875ffc39fa6ae1ced28e717f53399fdfd69a50a9722c74ff "stdout" = 467a2245dcfc6529a1ccde85fff96368d2478d33dd0dc5342b54ba1e79194b4a

[ianlancetaylor]

I wonder if those are the first packages in the build to import the unsafe package.

Not that I know why that would matter.

[StaticRocket]

Going to go ahead and attach the full compilation logs for both the A and B test for 386 for anyone who wants to poke around.

a.txt
b.txt

[StaticRocket]

On amd64 the build makes it much further before any discrepancies, but a late runtime/cgo import still has a different hash.

a-amd64.txt
b-amd64.txt