aquasecurity / aquasecurity/tracee
fix(build): disable -race on arm64 due to Go 1.26.2 linker bug
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Go 1.26.2 breaks -race on arm64 (golang/go#78573)
### Problem
Bumping the Go toolchain to 1.26.2 causes link failures on all arm64 test targets that use `-race`. The Go race detector embeds a pre-built TSAN runtime (`gotsan.cpp` compiled into `race_linux_arm64.syso`) that, starting with 1.26.2, references LSE outline-atomics symbols with `_sync` ordering:
```
__aarch64_ldadd8_sync
__aarch64_swp1_sync
__aarch64_cas4_sync
__aarch64_ldset8_sync
__aarch64_ldclr8_sync
... (many more)
```
These symbols are not resolved by the external linker (clang 19) used in our CI, even though GCC 11 is available on the runners. The Go linker invokes `/usr/bin/clang` as the external linker for CGO builds, and clang links against compiler-rt rather than libgcc. The compiler-rt version shipped with clang 19 does not provide the `_sync` variants of the outline-atomics helpers.
This affects the aarch64 kernel-test matrix (kernels 5.10, 5.15, and others) where `make test-compatibility` is called as the first step of the e2e test action.
### Upstream
This is tracked upstream as golang/go#78573. The same breakage is confirmed by multiple reporters on Go 1.26.2 and 1.25.9 across Amazon Linux 2, Rocky Linux 9, and Bazel hermetic toolchains.
### Workaround
Introduced `GO_TEST_RACE` variable in the Makefile, set to `-race` only when `GO_ARCH != arm64`. All six test targets (`test-unit`, `test-types`, `test-common`, `test-integration`, `test-compatibility`, `test-performance`) use `$(GO_TEST_RACE)` instead of a hardcoded `-race` flag.
Race detection can be forced on arm64 for testing with:
make test-compatibility GO_TEST_RACE=-race
### Re-enable
Once golang/go#78573 is fixed (expected in Go 1.26.3 or a revised 1.26.2), remove the `ifneq` guard in the Makefile and restore unconditional `-race`.
### Affected CI
- `.github/workflows/pr.yaml` -> `kernel-tests` job -> aarch64 matrix entries
- `.github/actions/run-e2e-tests/action.yaml` -> `make test-compatibility`
### Error (abbreviated)
```
gotsan.cpp:(.text+0x12ec): undefined reference to `__aarch64_ldadd8_sync'
gotsan.cpp:(.text+0x1324): undefined reference to `__aarch64_swp1_sync'
gotsan.cpp:(.text+0x2c00): undefined reference to `__aarch64_ldadd4_sync'
...
clang: error: linker command failed with exit code 1 (use -v to see invocation)
FAIL github.com/aquasecurity/tracee/tests/compatibility [build failed]
```
Contributor guide
Research direction
Start with the Makefile and inspect the six named test targets that use the race flag. Check the arm64 path alongside the kernel-tests matrix in .github/workflows/pr.yaml and the make test-compatibility entry in .github/actions/run-e2e-tests/action.yaml. Done means arm64 compatibility tests no longer hit the linker failure while other architectures retain race testing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- build-system, ci-cd
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100