Missing build id, Generating build-id links failed

[seemethere]

Overview

I'm experiencing a consistent issue with the latest rpm version 4.14.0 with the output:

error: Missing build-id in /root/rpmbuild/BUILDROOT/docker-ce-17.12.0.ce-0.1.rc1.fc27.x86_64/usr/bin/docker-containerd-shim
error: Generating build-id links failed
    Missing build-id in /root/rpmbuild/BUILDROOT/docker-ce-17.12.0.ce-0.1.rc1.fc27.x86_64/usr/bin/docker-containerd-shim
    Generating build-id links failed

This is not experienced in rpm version 4.13.0.2.

I believe it may have something to do with either of these commits:

• 5e82c7e
• e6bdf7a#diff-66129620d72b018f8ed267094e2d49c5

Steps to reproduce:

git clone -b 17.12 git@github.com:docker/docker-ce
make -C components/packaging/rpm VERSION=$(cat VERSION) fedora-27

Link to spec file: https://github.com/docker/docker-ce/blob/17.12/components/packaging/rpm/fedora-27/docker-ce.spec

[rpm-maint]

Hi Eli,

On Thu, Dec 07, 2017 at 03:20:01PM -0800, Eli Uriegas wrote: ``` error: Missing build-id in /root/rpmbuild/BUILDROOT/docker-ce-17.12.0.ce-0.1.rc1.fc27.x86_64/usr/bin/docker-containerd-shim error: Generating build-id links failed Missing build-id in /root/rpmbuild/BUILDROOT/docker-ce-17.12.0.ce-0.1.rc1.fc27.x86_64/usr/bin/docker-containerd-shim Generating build-id links failed ```

That probably means the compiler/linker of that binary didn't generate a proper build-id for that binary. The golang toolchain didn't in the past.

I believe it may have something to do with this commit: 5e82c7e

Why do you believe that? That commit should only fix issues for noarch packages. Real binaries must have build-ids. At least the Fedora go toolchain should be able to generate proper build-ids these days. If not, see these (old) notes: https://fedoraproject.org/wiki/PackagingDrafts/Go#Build_ID Cheers, Mark

[seemethere]

@mark it's the only reference I could find to the error message, and it was included in 14.4.0 which is where we first experienced the issue.

So I think the problem lies with docker-containerd-shim being compiled with CGO_ENABLED=0.

When compiled without CGO the binary does not have a build-id but is still considered an executable.

Our current workaround is to set:

%global _missing_build_ids_terminate_build 0

[kolyshkin]

Here is a simple reproducer for the case, on a clean fresh Fedora 27 install:

# Name this gotst.spec
Name:		gotst
Version:	1.0
Release:	1%{?dist}
Summary:	Go binary to demonstrate build-id problem

Group:		Applications
License:	GPL

BuildRequires:	golang

%description
Lalala.


%prep
%setup -Tc

cat > gotst.go << EOF
package main
import "fmt"

func main() {
	fmt.Println("Hello, world!")
}
EOF

%build
go build -v -o gotst .

%install
install -d %{buildroot}/%{_bindir}
install gotst %{buildroot}/%{_bindir}

%files
%{_bindir}/gotst

%changelog
* Fri Dec  8 2017 Kir Kolyshkin <kolyshkin@gmail.com> - 1.0-1
- created

Save the above file to gotst.spec and run the following:

dnf -y install golang rpm-build
rpmbuild -bb gotst.spec

The error you'll see is
*** ERROR: No build ID note found in /root/rpmbuild/BUILDROOT/gotst-1.0-1.fc27.x86_64/usr/bin/gotst

Can you please suggest how to use go build to build a binary which can be packaged for Fedora 27?

Some analysis:

• go build adds its own build-id into the binary, named .note.go.build-id.
• Fedora 27 rpm wants to have .note.gnu.build-id which is not created as no GNU tools are used to create the binary

Here's how I checked the resulting binary:

# cat > gotst.go << EOF
package main
import "fmt"

func main() {
fmt.Println("Hello, world!")
}
EOF

# go build -o gotst gotst.go

# eu-readelf -n gotst

Note section [20] '.note.go.buildid' of 56 bytes at offset 0xfc8:
  Owner          Data size  Type
  Go                    40  BUILDID

[kolyshkin]

OK one way is to use gccgo instead of go build, and the other way is to add -ldflags=-linkmode=external flag to go build.

Still, by default (i.e. using go build) it doesn't do that and it's a problem.

[pmatilai]

I looked a bit into this yesterday, just to see what sort of effort we'd be talking about to have rpm understand the buildid from go (as opposed to gnu):

• The go-buildid appears to be ASCII SHA1(based on its length), this would require modifications to debugedit and librpmbuild side as both assume the digest is stored in binary format
• There's partial support for the Go buildid in elfutils, added via https://bugzilla.redhat.com/show_bug.cgi?id=1295951 (which is what you see with eu-readelf) but as noted in the bug, more is needed. For example dwelf_elf_gnu_build_id() only knows about GNU buildid as the name implies and there's no Go buildid counterpart.

For now I think we just need to state that only GNU toolchain buildids are supported, for others there's the simple workaround of disabling buildid requirement in the package that you're already using.
If/when elfutils adds full support for other variants we can reconsider it in rpm, but I'll leave that up to Mark who's the maintainer of both elfutils and debugedit/buildid stuff in rpm.

[pprindeville]

Running into this issue on my fork of containerd-packaging