mirror of https://github.com/docker/compose.git
Remove "-s" from LDFLAGS
While this stripping does decrease the binary size by some amount, it also removes the ability for `govulncheck` (https://go.dev/blog/vuln) to scan the binary for actual uses of vulnerable functions, requiring the user to clone the code locally and hope they're testing against the same version of the stdlib, etc that the binary was built with. If we stop passing `-s`, then we can then run `govulncheck` on the binary directly (making it easier to flag both false positives in CVE scans _and_ actual issues worth looking into). Here's an example of the output on a freshly built binary with this change: ```console $ govulncheck ./bin/build/docker-compose govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback. Using govulncheck@v0.0.0 with vulnerability data from https://vuln.go.dev (last modified 27 Feb 23 16:29 UTC). Scanning your binary for known vulnerabilities... No vulnerabilities found. ``` Compared to the 1.16.0 release binary: ```console $ govulncheck ./docker-compose go: downloading golang.org/x/vuln v0.0.0-20230224180816-edec1fb0a9c7 govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback. Using govulncheck@v0.0.0 with vulnerability data from https://vuln.go.dev (last modified 27 Feb 23 16:29 UTC). Scanning your binary for known vulnerabilities... govulncheck: vulncheck.Binary: reading go:func.*: no symbol "go:func.*" ``` It's not 100% apples-to-apples, but the size difference between these binaries is ~46MiB for the 1.16.0 release and ~52MiB for the binary I built from this commit. Signed-off-by: Tianon Gravi <admwiggin@gmail.com>
This commit is contained in:
parent
85ddfde5d6
commit
fc4d2dfdd8
2
Makefile
2
Makefile
|
@ -15,7 +15,7 @@
|
|||
PKG := github.com/docker/compose/v2
|
||||
VERSION ?= $(shell git describe --match 'v[0-9]*' --dirty='.m' --always --tags)
|
||||
|
||||
GO_LDFLAGS ?= -s -w -X ${PKG}/internal.Version=${VERSION}
|
||||
GO_LDFLAGS ?= -w -X ${PKG}/internal.Version=${VERSION}
|
||||
GO_BUILDTAGS ?= e2e
|
||||
|
||||
ifeq ($(OS),Windows_NT)
|
||||
|
|
Loading…
Reference in New Issue