Change:
Using go + I am unable to build a simple Go program that makes use of C bindings. The program is a testcase from the Go compiler repository ( ) . The build fails with an error message like this: Another example is geth, the go ethereum client, in version 1.6.1: Switching to clang instead seems to be a workaround for the problem: This last command builds successfully. System: (Hummingbird) Nix version: nix-env (Nix) 1.11.9 Nixpkgs version: Sandboxing enabled: false
I think this has to do with how Go handles GOROOT. It expects to be able to write to $GOROOT even though it's a read-only path. Could you try the buildCommand in go-ethereum:
Aw, I was wondering how to get rid of that warning. The warning is gone, but it doesn't seem to have helped: I originally ran into this issue when I tried to upgrade that linked Nix expression. Version 1.4.7 of go-ethereum compiles just fine, but 1.6.1 doesn't, because now one of the dependencies makes use of some kind of C bindings. While playing around with it I also switched over to using in the Nix expression, but that also didn't help. Switching to clang helped in the end. That version can be found here: But that's just a workaround and I would assume that other Go packages will at some point also run into this problem when they just use or .
I ran into this problem adding seccomp support to the docker package. It's caused by the -O2 optimization flag which is being by the fortify hardening flag. A possible fix would be to add hardeningDisable = [ "fortify" ]; to the buildGoPackage.
I can't no longer reproduce this on my system so I guess the issue is fixed? I created a PR to get rid of the workarounds:
I can confirm that I also cannot reproduce this anymore on my system. I am closing this - thanks!

Discussion:
propagatedBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ libobjc IOKit ]; <del> # Fixes Cgo related build failures (see https://github.com/NixOS/nixpkgs/issues/25959 ) hardeningDisable = [ "fortify" ]; </del> src = fetchFromGitHub { owner = "ethereum"; repo = pname;

goPackagePath = "github.com/containerd/containerd"; outputs = [ "bin" "out" "man" ]; <del> hardeningDisable = [ "fortify" ]; </del> buildInputs = [ btrfs-progs go-md2man utillinux ]; buildFlags = "VERSION=v${version}";

rev = containerdRev; sha256 = containerdSha256; }; <del> hardeningDisable = [ "fortify" ]; </del> }); docker-tini = tini.overrideAttrs  (oldAttrs: {

sha256 = sha256; }; <del> # Optimizations break compilation of libseccomp c bindings hardeningDisable = [ "fortify" ]; </del> nativeBuildInputs = [ pkgconfig ]; buildInputs = [ makeWrapper removeReferencesTo go-md2man go libtool

outputs = [ "bin" "out" "man" ]; <del> # Optimizations break compilation of libseccomp c bindings hardeningDisable = [ "fortify" ]; </del> nativeBuildInputs = [ pkgconfig go-md2man ]; buildInputs = [ btrfs-progs libseccomp gpgme lvm2 systemd ];

buildInputs = [ pkgconfig ffmpeg ]; <del> # XXX This removes the -O2 flag, to avoid errors like: #   cgo-dwarf-inference:2:8: error: enumerator value for '__cgo_enum__0' is not an integer constant # This is a workaround for nixpkgs+golang BUG https://github.com/NixOS/nixpkgs/issues/25959 hardeningDisable = [ "fortify" ]; </del> enableParallelBuilding = true; meta = with stdenv.lib; {

pname = "trezord-go"; version = "2.0.27"; <del> # Fixes Cgo related build failures (see https://github.com/NixOS/nixpkgs/issues/25959 ) hardeningDisable = [ "fortify" ]; </del> goPackagePath = "github.com/trezor/trezord-go"; src = fetchFromGitHub {

goPackagePath = "github.com/coreos/flannel"; <del> hardeningDisable = [ "fortify" ]; </del> src = fetchFromGitHub { inherit rev; owner = "coreos";