Skip to content

fix: Don't static link agent binary (FIPS requirement) #738

Merged
svghadi merged 3 commits into
mainfrom
agent-0.7.0
Mar 5, 2026
Merged

fix: Don't static link agent binary (FIPS requirement) #738
svghadi merged 3 commits into
mainfrom
agent-0.7.0

Conversation

@svghadi
Copy link
Copy Markdown
Collaborator

@svghadi svghadi commented Mar 5, 2026

The static link flag in the Makefile is causing downstream build failures, as we cannot build static binaries for FIPS. In the agent Makefile, the -static flag is forced, which prevents it from being overridden when calling the make target from the Dockerfile.

We need to allow overriding LDFLAGS so that the -static flag can be removed or skipped. One way to achieve this is by dropping the override at https://github.com/argoproj-labs/argocd-agent/blob/840b84916eea783f3f0c9208ab31b770b55aaa84/Makefile#L64.
This would allow us to supply LDFLAGS from the CLI while still benefiting from the next override statement that adds the version information.

For now, I have reverted the change made in #620.

svghadi added 2 commits March 5, 2026 09:59
Signed-off-by: Siddhesh Ghadi <sghadi1203@gmail.com>
Signed-off-by: Siddhesh Ghadi <sghadi1203@gmail.com>
@svghadi svghadi changed the title fix: Don't static link agent binary fix: Don't static link agent binary (FIPS requirement) Mar 5, 2026
Signed-off-by: Siddhesh Ghadi <sghadi1203@gmail.com>
@svghadi
Copy link
Copy Markdown
Collaborator Author

svghadi commented Mar 5, 2026

Failure logs for a static build

    github.com/argoproj-labs/argocd-agent/principal/registration
  github.com/argoproj-labs/argocd-agent/principal/apis/eventstream
  github.com/argoproj-labs/argocd-agent/agent
  github.com/argoproj-labs/argocd-agent/principal/apis/auth
  github.com/argoproj-labs/argocd-agent/principal
  github.com/argoproj-labs/argocd-agent/cmd/argocd-agent
  # github.com/argoproj-labs/argocd-agent/cmd/argocd-agent
  /usr/lib/golang/pkg/tool/linux_amd64/link: running gcc failed: exit status 1
  /usr/bin/gcc -m64 -Wl,-z,now -Wl,-z,nocopyreloc -Wl,--build-id=0x10f70f367127f3ab3649cab44380b06a267f8c59 -o $WORK/b001/exe/a.out -static -Wl,--compress-debug-sections=zlib /tmp/go-link-4108206518/go.o /tmp/go-link-4108206518/000000.o /tmp/go-link-4108206518/000001.o /tmp/go-link-4108206518/000002.o /tmp/go-link-4108206518/000003.o /tmp/go-link-4108206518/000004.o /tmp/go-link-4108206518/000005.o /tmp/go-link-4108206518/000006.o /tmp/go-link-4108206518/000007.o /tmp/go-link-4108206518/000008.o /tmp/go-link-4108206518/000009.o /tmp/go-link-4108206518/000010.o /tmp/go-link-4108206518/000011.o /tmp/go-link-4108206518/000012.o /tmp/go-link-4108206518/000013.o /tmp/go-link-4108206518/000014.o /tmp/go-link-4108206518/000015.o /tmp/go-link-4108206518/000016.o /tmp/go-link-4108206518/000017.o /tmp/go-link-4108206518/000018.o /tmp/go-link-4108206518/000019.o /tmp/go-link-4108206518/000020.o /tmp/go-link-4108206518/000021.o /tmp/go-link-4108206518/000022.o /tmp/go-link-4108206518/000023.o /tmp/go-link-4108206518/000024.o /tmp/go-link-4108206518/000025.o /tmp/go-link-4108206518/000026.o /tmp/go-link-4108206518/000027.o /tmp/go-link-4108206518/000028.o /tmp/go-link-4108206518/000029.o /tmp/go-link-4108206518/000030.o /tmp/go-link-4108206518/000031.o /tmp/go-link-4108206518/000032.o /tmp/go-link-4108206518/000033.o /tmp/go-link-4108206518/000034.o /tmp/go-link-4108206518/000035.o /tmp/go-link-4108206518/000036.o /tmp/go-link-4108206518/000037.o /tmp/go-link-4108206518/000038.o /tmp/go-link-4108206518/000039.o /tmp/go-link-4108206518/000040.o /tmp/go-link-4108206518/000041.o /tmp/go-link-4108206518/000042.o /tmp/go-link-4108206518/000043.o /tmp/go-link-4108206518/000044.o /tmp/go-link-4108206518/000045.o /tmp/go-link-4108206518/000046.o /tmp/go-link-4108206518/000047.o /tmp/go-link-4108206518/000048.o /tmp/go-link-4108206518/000049.o /tmp/go-link-4108206518/000050.o /tmp/go-link-4108206518/000051.o -O2 -g -lresolv -O2 -g -lpthread -O2 -g -O2 -g -ldl -pthread -O2 -g -ldl -no-pie -static
  /usr/bin/ld: cannot find -lresolv
  /usr/bin/ld: have you installed the static version of the resolv library ?
  /usr/bin/ld: cannot find -lc
  /usr/bin/ld: have you installed the static version of the c library ?
  collect2: error: ld returned 1 exit status
  
  make: *** [Makefile:189: argocd-agent] Error 1
  subprocess exited with status 2
  subprocess exited with status 2
  Error: building at STEP "RUN . /cachi2/cachi2.env &&     CGO_ENABLED=1 GOEXPERIMENT=strictfipsruntime     GO_TAGS=strictfipsruntime GO_MOD=mod     make argocd-agent BIN_NAME_AGENT=argocd-agent": exit status 2
  

@svghadi svghadi merged commit 209dd58 into main Mar 5, 2026
5 checks passed
@svghadi svghadi deleted the agent-0.7.0 branch March 5, 2026 09:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants