What causes "parsing $CGO_%s_ALLOW: %v" in golang/go?

Fix the regexp syntax to be RE2-compatible (no lookbehind/lookahead, balanced brackets/parens).

parsing $CGO_%s_ALLOW: %v

Error message

parsing $CGO_%s_ALLOW: %v

What it means

Thrown by checkFlags when the CGO_<NAME>_ALLOW environment variable (e.g. CGO_CFLAGS_ALLOW, CGO_LDFLAGS_ALLOW) is set to a string that is not a valid Go regexp. The value is compiled with regexp.Compile; a parse failure surfaces as this wrapped error. ALLOW/DISALLOW are user escape-hatches to permit or block specific cgo flags.

Source

Thrown at src/cmd/go/internal/work/security.go:377

			fl == "-Wl,-static" || fl == "-Wl,--static" ||
			fl == "-Wl,-Bstatic" {
			return fmt.Errorf("flag %q triggers external linking", fl)
		}
	}
	return nil
}

func checkFlags(name, source string, list []string, invalid, valid []*lazyregexp.Regexp, validNext []string, checkOverrides bool) error {
	// Let users override rules with $CGO_CFLAGS_ALLOW, $CGO_CFLAGS_DISALLOW, etc.
	var (
		allow    *regexp.Regexp
		disallow *regexp.Regexp
	)
	if checkOverrides {
		if env := cfg.Getenv("CGO_" + name + "_ALLOW"); env != "" {
			r, err := regexp.Compile(env)
			if err != nil {
				return fmt.Errorf("parsing $CGO_%s_ALLOW: %v", name, err)
			}
			allow = r
		}
		if env := cfg.Getenv("CGO_" + name + "_DISALLOW"); env != "" {
			r, err := regexp.Compile(env)
			if err != nil {
				return fmt.Errorf("parsing $CGO_%s_DISALLOW: %v", name, err)
			}
			disallow = r
		}
	}

Args:
	for i := 0; i < len(list); i++ {
		arg := list[i]
		if disallow != nil && disallow.FindString(arg) == arg {
			goto Bad
		}

View on GitHub (pinned to b6b368adc5)

Solutions

Fix the regexp syntax to be RE2-compatible (no lookbehind/lookahead, balanced brackets/parens).
Test locally: `go run` a tiny program calling `regexp.Compile(os.Getenv("CGO_CFLAGS_ALLOW"))`.
Unset the variable if you no longer need the override: `unset CGO_CFLAGS_ALLOW`.
Prefer simpler character classes and escape literal regex metacharacters.

Example fix

// before
// export CGO_CFLAGS_ALLOW=[-O

// after
// export CGO_CFLAGS_ALLOW=-O[0-9]

Defensive patterns

Strategy: validation

Validate before calling

// Validate CGO_CFLAGS_ALLOW regexp before building
if v := os.Getenv("CGO_CFLAGS_ALLOW"); v != "" {
    if _, err := regexp.Compile(v); err != nil {
        log.Fatalf("fix CGO_CFLAGS_ALLOW: %v", err)
    }
}

Prevention

Test RE2 regexps with regexp.Compile in isolation first.
Avoid PCRE-only features (lookahead, backreferences).
Unset unused CGO_*_ALLOW variables.

When it happens

Trigger: Set `CGO_CFLAGS_ALLOW=[invalid` (or any malformed regexp) in the environment and run a cgo build. checkFlags enters the checkOverrides branch (note: for the internal-link variants checkOverrides is false, so this fires from the general compiler/linker flag checkers), compiles the env value, and regexp.Compile returns an error.

Common situations: A shell-quoting bug turns a glob into an unbalanced bracket; copy-pasting a PCRE-only construct (e.g. lookahead `(?=...)`) Go's RE2 rejects; a CI secret-injection mangles the variable.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/0e2c2f847eb471ac. Report an issue: GitHub.