Reproducible builds with CGO

[Vivi A]

Hi All,

Does anybody have experience in how the use of CGO and dynamic linking may affect the reproducibility of a Go project?

Context

I am trying to reproduce a Linux amd64 binary release using the same source commit, os & dist, Go, C compiler, and linker version. It reproduces locally but not against the reference build. I can see that e.g. gnu.build-id is embedded, yet the diffs are much larger than this, for example seeing differences in the ELF .rodata (which may or may not have to do with the use of CGO). 

Regards,

Vivi

[Zxilly Chou]

golang will embed the path of the source file into the binary, also the .gopclntab will contains the path.

try use -trimpath and see if there's any change.