-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Set linkopts "-w" instead of "-w -s" when building go binaries #4181
Conversation
Signed-off-by: Inteon <42113979+inteon@users.noreply.github.com>
Hi @inteon. Thanks for your PR. I'm waiting for a jetstack or cert-manager member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
I'm confused, if the user having issues is already modifying cert-manager to link against some CGo stuff, why can't they patch their build config as well? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
that was an easy review 😂
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: inteon, SgtCoDFish The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/ok-to-test |
For context: the issue that Irbe was talking about is related to using the boringcrypto branch of Go, which uses a different crypto library so that cert-manager might be used in environments which require FIPS compliance. It's not really changing cert-manager itself - just building in a different environment. The issue arises afterwards, when we use https://pkg.go.dev/rsc.io/goversion to verify that we're using the FIPS-compliant crypto libs. That tool requires the symbol table to be intact to be able to detect the crypto libraries used, and there are definitely reasons that people might want to make those checks on the cert-manager binaries [1]. There's maybe a case to be made that for the cert-manager kubectl plugin specifically, we could use both I guess at the core of it, [1] Since FIPS is bit rubbish, it might be reasonable for a user to want to verify that their cert-manager install was not built with boringcrypto - which is hard to do without the symbol table 😄 |
Agree with Ashley that it may still be useful for folks to be able to inspect the binaries. /lgtm |
/kind cleanup |
What this PR does / why we need it:
In #4169, the "-w" and "-s" flags were introduced when building go binaries.
These options remove both the DWARF tables and the symbol tables from the binary. However, removing the symbols table from the binaries causes some issues #4169 (comment).
@SgtCoDFish noticed that the binary size reduction is mostly thanks to removing the DWARF tables.
Results for the kubectl plugin:
This PR removes the "-s" flag and only keeps the "-w" flag for building go binaries.
Release note: