Build PIE executable and fix gomodcache permissions

2 files changed, 11 insertions, 4 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 019ec0327ee2..20a2c92dbae6 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = authelia-git
 	pkgdesc = The Cloud ready multi-factor authentication portal for your Apps.
 	pkgver = 4.38.7.r0.gfd4cea412
-	pkgrel = 1
+	pkgrel = 2
 	url = https://github.com/authelia/authelia
 	arch = x86_64
 	arch = aarch64
diff --git a/PKGBUILD b/PKGBUILD
index a743687ebb45..19ea87ac055a 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -2,7 +2,7 @@
 pkgname=authelia-git
 _pkgname=authelia
 pkgver=4.38.7.r0.gfd4cea412
-pkgrel=1
+pkgrel=2
 pkgdesc="The Cloud ready multi-factor authentication portal for your Apps."
 arch=('x86_64' 'aarch64' 'armv7h')
 url="https://github.com/authelia/authelia"
@@ -31,7 +31,7 @@ pkgver() {
 }
 
 build() {
-  export GOPATH="$srcdir/gopath" PATH="$PATH:$srcdir/gopath/bin"
+  export GOPATH="$srcdir/gopath" PATH="$PATH:$srcdir/gopath/bin" CGO_CPPFLAGS="-D_FORTIFY_SOURCE=2 -fstack-protector-strong" CGO_LDFLAGS="-Wl,-z,relro,-z,now"
   cd "$srcdir/$_pkgname/web"
 
   COMMIT=$(git rev-parse HEAD)
@@ -45,7 +45,14 @@ build() {
   pnpm build
   cd ..
   cp -R api internal/server/public_html/
-  go build -ldflags "-w ${XOPTIONS}" -trimpath -o authelia cmd/authelia/*.go
+  go build \
+    -trimpath \
+    -buildmode=pie \
+    -mod=readonly \
+    -modcacherw \
+    -ldflags "-linkmode external -s -w ${XOPTIONS}" \
+    -o authelia \
+    cmd/authelia/*.go
 }
 
 package() {