cmd/go: Regression in Go 1.26 due to new pkg-config flag validation from #77387 banning safe `--define-variable` values

[maxb]

Go version

go version go1.26.3 linux/amd64

Output of go env in your module/workspace:

n/a

What did you do?

Upgrade from Go 1.25 to Go 1.26

What did you see happen?

An existing build started failing with:

foobar/core/foobar/protocol/foobar/common: invalid flag in pkg-config: --define-variable=srcdir=/home/tcagent3/opt/teamcity/work/tech-build/foobar/tech/core/foobar/protocol/foobar/common (see https://go.dev/s/invalidflag)

Upon investigation, it seems that the fix for #77387 has resulted in banning safe flag values in pkg-config files, namely those that define variables with values containing dash characters, amongst others.

I am guessing that the regex at

go/src/cmd/go/internal/work/security.go

Line 262 in 2403e59

re(`--define-variable=[A-Za-z_][A-Za-z0-9_]*=[^@\-]*`),

was intended to be something slightly different.

The outcome is that I am no longer able to build this (internal) software without ensuring there is no dash character anywhere in the absolute pathname containing the build environment, though other users may be impacted in other ways depending on the purpose for which they were using variables.

What did you expect to see?

No regression.

[gabyhelp]

Related Issues

• cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to 1.25.6 due to --define-variable flag in pkg-config #77387 (closed)
• cmd/go: PKG_CONFIG var misparsed when containing spaces #46228
• cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to 1.25.6 due to --define-variable flag in pkg-config [1.26 backport] #77474 (closed)
• cmd/go: flag validation fails when `pkg-config --libs` reports a path containing spaces #35262 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[seankhliao]

I think you'll have to show the actual value being rejected for us to determine if the regex should be adjusted.

[jwebb]

Based on the example of --with-path it seems clear the intended regex was --define-variable=[A-Za-z_][A-Za-z0-9_]*=[^@\-].* (note extra .).

[seankhliao]

cc @rolandshoemaker

[maxb]

I think you'll have to show the actual value being rejected for us to determine if the regex should be adjusted.

Simply, any value containing a dash/hyphen character, such as (by way of a minimal example) --define-variable=A=b-c

Based on the example of --with-path it seems clear the intended regex was --define-variable=[A-Za-z_][A-Za-z0-9_]*=[^@\-].* (note extra .).

That does seem likely, though I wonder at the reason for the given restrictions - AFAICS, the characters @ and - don't seem to have special meaning in this context.

[ianlancetaylor]

The pattern [^@\-]* is used for a bunch of linker flags. There we need to be careful about response files and options. But I don't know of any reason why we should worry about them in the argument to pkg-config --define-variable.