fix: Add extldflags to linux builds (backport #3666) (#3667)

* fix: Add extldflags to linux builds (#3666)

* Add extldflags to linux builds

(cherry picked from commit b53ebdf)

* Fix changelog

---------

Co-authored-by: Eric Warehime <[email protected]>

Author: mergify[bot]

.goreleaser.yml

@@ -104,7 +104,7 @@ builds:
     ldflags:
       - -s -w
       - -linkmode=external
-      - -extldflags "-Wl,-z,muldefs -static"
+      - -extldflags "-Wl,-z,muldefs -static -z noexecstack"
       - -X main.commit={{.Commit}}
       - -X main.date={{ .CommitDate }}
       - -X github.com/cosmos/cosmos-sdk/version.Name=gaia

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## UNRELEASED
 
+## v23.0.1
+
+*March 25, 2025*
+
+### BUG FIXES
+- Add linker flags for noexec linux builds
+  ([\#3666](https://github.com/cosmos/gaia/pull/3666))
+
+## v23.0.0
+
+*March 14, 2025*
+
 ### DEPENDENCIES
 
 - Bump Go to 1.23 [\#3556](https://github.com/cosmos/gaia/pull/3556)

Makefile

@@ -71,15 +71,23 @@ ldflags = -X github.com/cosmos/cosmos-sdk/version.Name=gaia \
 		  -X "github.com/cosmos/cosmos-sdk/version.BuildTags=$(build_tags_comma_sep)" \
 			-X github.com/cometbft/cometbft/version.TMCoreSemVer=$(TM_VERSION)
 
+UNAME_S = $(shell uname -s)
+ifeq ($(UNAME_S),Linux)
+  extldflags += -z noexecstack
+endif
 ifeq (cleveldb,$(findstring cleveldb,$(GAIA_BUILD_OPTIONS)))
   ldflags += -X github.com/cosmos/cosmos-sdk/types.DBBackend=cleveldb
 endif
 ifeq ($(LINK_STATICALLY),true)
-  ldflags += -linkmode=external -extldflags "-Wl,-z,muldefs -static"
+  extldflags += -Wl,-z,muldefs -static -z noexecstack
+  ldflags += -linkmode=external
 endif
 ifeq (,$(findstring nostrip,$(GAIA_BUILD_OPTIONS)))
   ldflags += -w -s
 endif
+extldflags += $(EXTLDFLAGS)
+extldflags := $(strip $(extldflags))
+ldflags += -extldflags "$(extldflags)"
 ldflags += $(LDFLAGS)
 ldflags := $(strip $(ldflags))