Go compiler DEBUG `DefaultGODEBUG` defaults when packaging Go software

[François Kooman]

Hi all,

While trying to package a Go web application that uses the new Go HTTP 
Mux patterns, available in Go >= 1.22, I'm having trouble "enabling" 
this when building the application using the %gobuild macro.

It looks like this functionality is explicitly disabled, and I don't 
know how to override this. A lot of searching through existing spec 
files and the go build RPM macros did not really lead anywhere. It can't 
find it! :-)

$ go version -m /usr/sbin/app | grep GODEBUG
    build 
DefaultGODEBUG=asynctimerchan=1,gotypesalias=0,httplaxcontentlength=1,httpmuxgo121=1,httpservecontentkeepheaders=1,netedns0=0,panicnil=1,tls10server=1,tls3des=1,tlskyber=0,tlsrsakex=1,tlsunsafeekm=1,winreadlinkvolume=0,winsymlink=0,x509keypairleaf=0,x509negativeserial=1

It seems no matter what I try, I can't seem to be able to override the 
`httpmuxgo121=1` flag. Looking through this list, it seems it also 
wouldn't hurt to modify `tls10server=1` and `tls3des=1` to a safer value ;-)

Is there an (official) way to override this in a sustainable way? Is 
there a path to "modernizing" these flags to have e.g. TLSv1.0 and DES3 
disabled? Am I missing something? Is the output of `go version -m` a red 
herring and am I doing something else wrong?

Thanks in advance!

Regards,
François

[François Kooman]

On 30.03.25 09:58, François Kooman via golang wrote:
> Is there an (official) way to override this in a sustainable way? Is 
> there a path to "modernizing" these flags to have e.g. TLSv1.0 and DES3 
> disabled? Am I missing something? Is the output of `go version -m` a red 
> herring and am I doing something else wrong?

I figured it out! Maybe it is super trivial to everyone here, but just 
in case ;-)

As Go modules are disabled when building packages, the Go version is not 
picked up from go.mod and therefore the compiler doesn't opt-in to any 
of the "flags", e.g. the Go 1.22 HTTP Mux patterns. The output of `go 
version -m` was a bit confusing as it seemed someone was explicitly 
setting some kind of default, BUT these are just the values of the flags 
if you never opted in to *any* of them.

The "fix" is to patch the main.go file and add this to the top:

//go:debug default=go1.23

Then things start working as expected! :)

I don't know how to do this using GODEBUG, it seems export 
`GODEBUG=default=go1.23` in the spec file does NOT work, but probably 
patching it in the source code is not the worst approach.

Regards,
François