Make windows-amd64 Go binaries work with BinSkim SDL tool (expects PDB)

Currently, there are no PDB files for Go. Debug information is in DWARF format:

• https://groups.google.com/g/golang-nuts/c/AUtqPvoKPNM

BinSkim requires a PDB for each library, and has no way to turn this off:

• https://github.com/microsoft/binskim/issues/299

Someone tried to extract a PDB file from a binary built on windows with MinGW, but that didn't work:

• https://github.com/microsoft/binskim/issues/318

Running BinSkim on our windows-amd64 build gets this bunch of errors for each exe file:

error ERR997.ExceptionLoadingPdb : BA2002 : 'go.exe' was not evaluated for check 'DoNotIncorporateVulnerableDependencies' because its PDB could not be loaded.
error ERR997.ExceptionLoadingPdb : BA2006 : 'go.exe' was not evaluated for check 'BuildWithSecureTools' because its PDB could not be loaded.
error ERR997.ExceptionLoadingPdb : BA2007 : 'go.exe' was not evaluated for check 'EnableCriticalCompilerWarnings' because its PDB could not be loaded.
error ERR997.ExceptionLoadingPdb : BA2011 : 'go.exe' was not evaluated for check 'EnableStackProtection' because its PDB could not be loaded.
error ERR997.ExceptionLoadingPdb : BA2013 : 'go.exe' was not evaluated for check 'InitializeStackProtection' because its PDB could not be loaded.
error ERR997.ExceptionLoadingPdb : BA2014 : 'go.exe' was not evaluated for check 'DoNotDisableStackProtectionForFunctions' because its PDB could not be loaded.
error ERR997.ExceptionLoadingPdb : BA2024 : 'go.exe' was not evaluated for check 'EnableSpectreMitigations' because its PDB could not be loaded.

That happens even when I use a --config file to configure all those rules (BA*) to not run. It seems that you can turn off rules, but this is an "error" with no way to ignore.

  <Properties Key="BA2002.DoNotIncorporateVulnerableDependencies.Options" Type="PropertiesDictionary">
    <Property Key="RuleEnabled" Value="Disabled" Type="Driver.RuleEnabledState" />
  </Properties>
  <Properties Key="BA2006.BuildWithSecureTools.Options" Type="PropertiesDictionary">
    <Property Key="RuleEnabled" Value="Disabled" Type="Driver.RuleEnabledState" />
  </Properties>
  <Properties Key="BA2007.EnableCriticalCompilerWarnings.Options" Type="PropertiesDictionary">
    <Property Key="RuleEnabled" Value="Disabled" Type="Driver.RuleEnabledState" />
  </Properties>
  <Properties Key="BA2011.EnableStackProtection.Options" Type="PropertiesDictionary">
    <Property Key="RuleEnabled" Value="Disabled" Type="Driver.RuleEnabledState" />
  </Properties>
  <Properties Key="BA2013.InitializeStackProtection.Options" Type="PropertiesDictionary">
    <Property Key="RuleEnabled" Value="Disabled" Type="Driver.RuleEnabledState" />
  </Properties>
  <Properties Key="BA2014.DoNotDisableStackProtectionForFunctions.Options" Type="PropertiesDictionary">
    <Property Key="RuleEnabled" Value="Disabled" Type="Driver.RuleEnabledState" />
  </Properties>
  <Properties Key="BA2024.EnableSpectreMitigations.Options" Type="PropertiesDictionary">
    <Property Key="RuleEnabled" Value="Disabled" Type="Driver.RuleEnabledState" />
  </Properties>

I think I can entirely disable scanning the exe files with BinSkim to get around it temporarily, but this is obviously not acceptable in the long run.

Options that come to mind:

• Fix BinSkim--pick any one of:
  • Make these rules compatible with GCC/MinGW symbols. (Do not require PDBs for these checks with Go binaries.)
  • Make ERR997 ignorable.
  • Make it so ignoring BA2002, BA2006, ... BA2024 stops BinSkim from trying and failing to load the PDB.
  • Figure out how to baseline the results. According to https://github.com/microsoft/binskim/issues/299, this requires some work on the BinSkim side.
• Make Go produce PDBs. (May not be an option: I think we'd probably want to release before figuring it out, and if we want to ship both modified and unmodified versions of Go, we can't satisfy SDL with the unmodified non-PDB Go.)

Start by reproducing the BinSkim errors against the windows-amd64 build's exe files and review the referenced BinSkim issues and XML configuration. Determine whether the accepted resolution is a BinSkim change or Go PDB generation; done means the selected approach allows the binaries to pass the required SDL scan without the reported ERR997 failures.