-trimpath build flag not working

[pjebs]

Google Search AI says tinygo supports it.
tinygo CLI says it doesn't.

[deadprogram]

Sorry does not exist. Never heard of it.

[pjebs]

What about a feature request?

[deadprogram]

What about a feature request?

Sure, please explain what it is and what you need!

[dkegel-fastly]

Google says:

In Go, the -trimpath flag is used during the build process to remove local file system paths from the resulting executable. It is primarily used to ensure reproducible builds and to protect developer privacy by hiding local directory structures.

Key Functions

• Path Sanitization: It replaces absolute file system paths (e.g., /home/user/project/main.go) with more generic identifiers.
• Standard Library: Paths in the standard library are reduced to just the package and file name, prefixed with go (e.g., runtime/map.go).
• Third-Party Modules: Dependency paths are replaced with module@version format (e.g., ://github.com).
• Main Module: Files in your own project are identified by their import path rather than their local location.

Why Use It?

• Reproducible Builds: By removing unique local paths, two different developers (or a CI/CD system) can compile the same source code and produce identical binary artifacts.
• Privacy & Security: It prevents sensitive information about your local machine’s file structure from being embedded in the binary.
• Clean Stack Traces: When a program panics, the stack trace will display these sanitized paths instead of long, local absolute paths.

Usage
You can apply it by adding the flag to your build or install commands:

go build -trimpath -o myapp
go install -trimpath ./...

Note for Debugging: Because -trimpath removes original file locations, debuggers like Delve may struggle to find your source code unless you configure path substitution rules in your IDE.

[pjebs]

https://go.dev/blog/rebuild

[dkegel-fastly]

I'll see your link and raise you one: https://reproducible-builds.org/

[pjebs]

I wonder if there is a way to actually edit the end-compiled binary directly to remove local path names. Maybe using a hex editor.

I wonder what effects it might have on the rest of the application and embedded resources etc that might rely on exactly location addresses.

[pjebs]

Just tested hex editing a go executable. It doesn't run. Even changing a single ascii (utf-8) character breaks the executable - including when I revert it back. Not sure if macos is causing the issue or if tinygo apps have a built in checksum included.

[pjebs]

sanity-labs/sanity-lint#34 (rust-wasm)
https://github.com/sanity-labs/sanity-lint/pull/34/changes