cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to 1.25.6 due to --define-variable flag in pkg-config

[DmitriiDunaev]

Go version

go version go1.25.6 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/root/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/root/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS='-buildvcs=false'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build168762594=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/code/go.mod'
GOMODCACHE='/go/pkg/mod'
GONOPROXY='git.synesis.ru'
GONOSUMDB='git.synesis.ru'
GOOS='linux'
GOPATH='/go'
GOPRIVATE='git.synesis.ru'
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/root/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='local'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.25.6'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

Issue Description

After upgrading from Go 1.25.5 to Go 1.25.6, our CGO-based code that uses pkg-config with the --define-variable flag no longer compiles. The error occurs during the type checking phase.

Error Message

cmd/gochannel/va/audio/aa/event.go:1: : invalid flag in pkg-config --cflags: --define-variable=prefix=/usr/lib/va/audioanalytics (typecheck)

Affected Code

The issue occurs in a Go file that includes C library bindings:

package aa
// #cgo pkg-config: --define-variable=prefix=/usr/lib/va/audioanalytics audioanalytics
// #include "aa/AudioAnalytics.h"
// extern void audio_logger_go(char* message, void* user_data);
import "C"

Workaround

Setting the environment variable CGO_CFLAGS_ALLOW='.*define.variable.' resolves the compilation issue:

export CGO_CFLAGS_ALLOW='.*define.*variable.*'

pkg-config

The audioanalytics.pc file contains:

prefix=/code/src/AudioAnalytics/AudioAnalyticsClt/build/install
library_dir=libs
exec_prefix=${prefix}
includedir=${prefix}/include
libdir=${prefix}/${library_dir}
Name: AudioAnalytics
Description: The AudioAnalytics library
Version: 1.0.7
Libs: -L${libdir} -lAudioAnalyticsLib -ldl -lz -lm -lstdc++
Cflags: -I${includedir}

Questions?

• Has --define-variable become a disallowed flag in Go 1.25.6?

• Is this an intentional security restriction, or a regression in flag validation?

• If --define-variable is now prohibited, what is the recommended approach for overriding pkg-config variables in #cgo pkg-config: directives?

• Should we file this against the pkg-config tool instead, or is this a Go CGO validation issue?

What did you see happen?

Error Message

cmd/gochannel/va/audio/aa/event.go:1: : invalid flag in pkg-config --cflags: --define-variable=prefix=/usr/lib/va/audioanalytics (typecheck)

What did you expect to see?

Successful build

[gabyhelp]

Related Issues

• cmd/go: cgo whitelist is missing -include #39988 (closed)
• cmd/go: new cgo protections mix up CFLAGS and LDFLAGS from pkg-config #23737 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[ianlancetaylor]

I don't understand the change that caused this (https://go.dev/cl/736711). That change appears to be validating the list of flags passed to pkg-config against the list of flags that are permitted for the C compiler. That does not make sense. The set of flags that pkg-config accepts has nothing to do with the set of flags that the C compiler accepts. If we want to limit pkg-config to a safe set of flags, we need a list of flags for pkg-config. Using the list of flags for the C compiler isn't right.

That said, if we maintain a list of flags that are safe to use with pkg-config, --define-variable would not be on that list. --define-variable permits redirecting the flags from pkg-config to more or less anything. I can imagine that somebody could use that to collect information from surprising system directories. That information would then be compiled into the code, and perhaps used in some inappropriate way.

So even if I am right that CL 736711 needs correcting, I think your specific case is correctly rejected, and the environment variable override, either something like CGO_PKG_CONFIG_ALLOW or the existing PKG_CONFIG, is still going to be required. In general it's never going to be appropriate for Go code downloaded from the Internet to refer to arbitrary directories on the build system, which is exactly what your --define-variable option is doing.

CC @thatnealpatel @golang/security

[DmitriiDunaev]

Thank you for the explanation. The C library is our company's internal code, so we can definitely fix the .pc file to avoid --define-variable flag altogether. I understand the security concern and agree it shouldn't be on the safelist. I hope this bug report was still helpful in identifying the validation logic issue between pkg-config and C compiler flags.

[ianlancetaylor]

Actually in retrospect I think I went overboard. C code can already refer to any directory via #include. Probably --define-variable is safe as long as the argument doesn't include any whitespace, commas, and so forth. Actually I'm not sure which pkg-config flags are unsafe. I must be missing something.

[prattmic]

cc @golang/command-line

[rolandshoemaker]

Agreed there was a regression here. This change was looked at by the compiler folks, but it slipped through that checkCompilerFlags was indeed the incorrect thing to be using.

The attack we were addressing is relatively simple: the way pkg-config reports errors can be exploited in combination with --log-file to cause a semi-controlled arbitrary file write.

For example, // #cgo pkg-config: echo$IFShello; --log-file=${HOME}/.bashrc should result in echo hello; NOT FOUND being written to ~/.bashrc. This can be used to cause unexpected post-build command execution.

After re-reading the pkg-config flags, I believe --log-filename is the only unsafe flag that pkg-config has.

I think the two options are: (1) explicitly disallow --log-filename, and ignore everything else or (2) create a new safe list for pkg-config flags, containing everything except --log-filename, and a function to check the flags against it. (2) seems like the idiomatic way to go about this.

[gopherbot]

Change https://go.dev/cl/741042 mentions this issue: cmd/go: fix pkg-config flag santization

[rolandshoemaker]

@gopherbot please open backport issues

[gopherbot]

Backport issue(s) opened: #77437 (for 1.24), #77438 (for 1.25).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.