fix: statically linked binary (CGO_ENABLED=0)

[troyanov]

Resolves: #233

[kian99]

I've taken a look at the dependencies and we don't rely on any libraries that require cgo so I expect this change is safe and is a good idea.

[SimoneDutto]

searching around how to find out if your packages use CGO, people were suggesting that just building successfully the package with CGO doesn't give the certainty it will not error out at runtime.
The command suggested to inspect the packages to look for cgo dependency is:

go list -f "{{if .CgoFiles}}{{.ImportPath}}{{end}}" $(go list -f "{{.ImportPath}}{{range .Deps}} {{.}}{{end}}")

The output of that is:

net
os/user
runtime/cgo

so it might be not-safe to do this, but i'm not an expert on CGO

[kian99]

searching around how to find out if your packages use CGO, people were suggesting that just building successfully the package with CGO doesn't give the certainty it will not error out at runtime. The command suggested to inspect the packages to look for cgo dependency is:

go list -f "{{if .CgoFiles}}{{.ImportPath}}{{end}}" $(go list -f "{{.ImportPath}}{{range .Deps}} {{.}}{{end}}")

The output of that is:

net
os/user
runtime/cgo

so it might be not-safe to do this, but i'm not an expert on CGO

Those packages are well-known ones in the standard library that can use cgo if it's enabled. The net one for example is mostly around the use of the DNS resolver. There are some niche use cases where the pure Go implementation might cause an issue over the glibc implementation but the uses of cgo in net and os/user are well understood (check the source or Google) and only effect niche scenarios.

[SimoneDutto]

searching around how to find out if your packages use CGO, people were suggesting that just building successfully the package with CGO doesn't give the certainty it will not error out at runtime. The command suggested to inspect the packages to look for cgo dependency is:

go list -f "{{if .CgoFiles}}{{.ImportPath}}{{end}}" $(go list -f "{{.ImportPath}}{{range .Deps}} {{.}}{{end}}")

The output of that is:

net
os/user
runtime/cgo

so it might be not-safe to do this, but i'm not an expert on CGO

Those packages are well-known ones in the standard library that can use cgo if it's enabled. The net one for example is mostly around the use of the DNS resolver. There are some niche use cases where the pure Go implementation might cause an issue over the glibc implementation but the uses of cgo in net and os/user are well understood (check the source or Google) and only effect niche scenarios.

Ah ok, nice!

[kian99]

@troyanov Can you please sign your commit?

[troyanov]

@troyanov Can you please sign your commit?

Sure. Should be signed now.