build.bash: don't enable -buildmode=pie for static builds

Causes warnings:

  $ ./build-without-openssl.bash
  # github.com/rfjakob/gocryptfs
  loadinternal: cannot find runtime/cgo
  # github.com/rfjakob/gocryptfs/gocryptfs-xray
  loadinternal: cannot find runtime/cgo
  # github.com/rfjakob/gocryptfs/contrib/statfs
  loadinternal: cannot find runtime/cgo
  gocryptfs v1.7.1-48-gf6b1c68 without_openssl; go-fuse v1.0.1-0.20190319092520-161a16484456; 2020-04-18 go1.13.6 linux/amd64

https://github.com/golang/go/issues/30986

2 files changed, 24 insertions, 10 deletions

diff --git a/build-without-openssl.bash b/build-without-openssl.bash
index e965951..f450caf 100755
--- a/build-without-openssl.bash
+++ b/build-without-openssl.bash
@@ -3,3 +3,8 @@
 cd "$(dirname "$0")"
 
 CGO_ENABLED=0 source ./build.bash -tags without_openssl
+
+if ldd gocryptfs > /dev/null ; then
+	echo "build-without-openssl.bash: error: compiled binary is not static"
+	exit 1
+fi
diff --git a/build.bash b/build.bash
index afccb72..c19e789 100755
--- a/build.bash
+++ b/build.bash
@@ -63,16 +63,25 @@ if [[ -n ${SOURCE_DATE_EPOCH:-} ]] ; then
 	BUILDDATE=$(date --utc --date="@${SOURCE_DATE_EPOCH}" +%Y-%m-%d)
 fi
 
-# For reproducible builds, we get rid of $HOME references in the binary
-# using "-trimpath".
-# Also, Fedora and Arch want pie enabled, so enable it.
-# * https://fedoraproject.org/wiki/Changes/golang-buildmode-pie
-# * https://github.com/rfjakob/gocryptfs/pull/460
-# However, -trimpath needs Go 1.13+, and we support Go 1.11 and Go 1.12
-# too. So don't add it there.
-GV=$(go version)
-if [[ $GV != *"1.11"* && $GV != *"1.12"* ]] ; then
-    export GOFLAGS="${GOFLAGS:--trimpath -buildmode=pie}"
+# Only set GOFLAGS if it is not already set by the user
+if [[ -z ${GOFLAGS:-} ]] ; then
+	GOFLAGS=""
+	# For reproducible builds, we get rid of $HOME references in the
+	# binary using "-trimpath".
+	# However, -trimpath needs Go 1.13+, and we support Go 1.11 and Go 1.12
+	# too. So don't add it there.
+	GV=$(go version)
+	if [[ $GV != *"1.11"* && $GV != *"1.12"* ]] ; then
+		GOFLAGS="-trimpath"
+	fi
+	# Also, Fedora and Arch want pie enabled, so enable it.
+	# * https://fedoraproject.org/wiki/Changes/golang-buildmode-pie
+	# * https://github.com/rfjakob/gocryptfs/pull/460
+	# But not with CGO_ENABLED=0 (https://github.com/golang/go/issues/30986)!
+	if [[ ${CGO_ENABLED:-1} -ne 0 ]] ; then
+		GOFLAGS="$GOFLAGS -buildmode=pie"
+	fi
+	export GOFLAGS
 fi
 
 GO_LDFLAGS="-X main.GitVersion=$GITVERSION -X main.GitVersionFuse=$GITVERSIONFUSE -X main.BuildDate=$BUILDDATE"