add ldflags for static pie

Makefile

@@ -40,7 +40,7 @@ ifeq (, $(shell command -v ocb 2>/dev/null))
 	[ "$${machine}" != x86_64 ] || machine=amd64 ;\
 	echo "Installing ocb ($${os}/$${machine}) at $(OTELCOL_BUILDER_DIR)";\
 	mkdir -p $(OTELCOL_BUILDER_DIR) ;\
-	CGO_ENABLED=0 go install -trimpath -ldflags="-s -w" -buildmode=pie go.opentelemetry.io/collector/cmd/builder@v$(OTELCOL_BUILDER_VERSION) ;\
+	CGO_ENABLED=0 go install -trimpath -ldflags='-linkmode external -s -w -extldflags "--static-pie"' -buildmode=pie go.opentelemetry.io/collector/cmd/builder@v$(OTELCOL_BUILDER_VERSION) ;\
 	mv $$(go env GOPATH)/bin/builder $(OTELCOL_BUILDER) ;\
 	}
 else

cmd/builder/.goreleaser.yml

@@ -137,4 +137,3 @@ sboms:
     artifacts: archive
   - id: package
     artifacts: package
-

cmd/goreleaser/internal/configure.go

@@ -52,7 +52,7 @@ func Generate(dist string) config.Project {
 		DockerSigns:     DockerSigns(),
 		SBOMs:           SBOM(),
 		Version:         2,
-		Monorepo:				 config.Monorepo{
+		Monorepo: config.Monorepo{
 			TagPrefix: "v",
 		},
 	}
@@ -74,7 +74,7 @@ func Build(dist string) config.Build {
 		BuildDetails: config.BuildDetails{
 			Env:     []string{"CGO_ENABLED=0"},
 			Flags:   []string{"-trimpath", "-buildmode=pie"},
-			Ldflags: []string{"-s", "-w"},
+			Ldflags: []string{"-linkmode external", "-s", "-w", "-extldflags \"--static-pie\""},
 		},
 		Goos:   []string{"darwin", "linux", "windows"},
 		Goarch: Architectures,

distributions/otelcol-contrib/.goreleaser.yaml

@@ -42,8 +42,10 @@ builds:
     dir: _build
     binary: otelcol-contrib
     ldflags:
+      - -linkmode external
       - -s
       - -w
+      - -extldflags "--static-pie"
     flags:
       - -trimpath
       - -buildmode=pie

distributions/otelcol-k8s/.goreleaser.yaml

@@ -18,8 +18,10 @@ builds:
     dir: _build
     binary: otelcol-k8s
     ldflags:
+      - -linkmode external
       - -s
       - -w
+      - -extldflags "--static-pie"
     flags:
       - -trimpath
       - -buildmode=pie

distributions/otelcol-otlp/.goreleaser.yaml

@@ -41,8 +41,10 @@ builds:
     dir: _build
     binary: otelcol-otlp
     ldflags:
+      - -linkmode external
       - -s
       - -w
+      - -extldflags "--static-pie"
     flags:
       - -trimpath
       - -buildmode=pie

distributions/otelcol/.goreleaser.yaml

@@ -42,8 +42,10 @@ builds:
     dir: _build
     binary: otelcol
     ldflags:
+      - -linkmode external
       - -s
       - -w
+      - -extldflags "--static-pie"
     flags:
       - -trimpath
       - -buildmode=pie