What causes "parsing $CGO_%s_DISALLOW: %v" in golang/go?

Correct the regexp to be RE2-valid (balanced grouping, no backreferences).

parsing $CGO_%s_DISALLOW: %v

Error message

parsing $CGO_%s_DISALLOW: %v

What it means

Thrown by checkFlags when the CGO_<NAME>_DISALLOW environment variable (e.g. CGO_CFLAGS_DISALLOW, CGO_LDFLAGS_DISALLOW) holds a string that fails regexp.Compile. DISALLOW is the user-side blocklist for cgo flags; a parse error means the blocklist cannot be applied and the build aborts rather than silently allowing everything.

Source

Thrown at src/cmd/go/internal/work/security.go:384

func checkFlags(name, source string, list []string, invalid, valid []*lazyregexp.Regexp, validNext []string, checkOverrides bool) error {
	// Let users override rules with $CGO_CFLAGS_ALLOW, $CGO_CFLAGS_DISALLOW, etc.
	var (
		allow    *regexp.Regexp
		disallow *regexp.Regexp
	)
	if checkOverrides {
		if env := cfg.Getenv("CGO_" + name + "_ALLOW"); env != "" {
			r, err := regexp.Compile(env)
			if err != nil {
				return fmt.Errorf("parsing $CGO_%s_ALLOW: %v", name, err)
			}
			allow = r
		}
		if env := cfg.Getenv("CGO_" + name + "_DISALLOW"); env != "" {
			r, err := regexp.Compile(env)
			if err != nil {
				return fmt.Errorf("parsing $CGO_%s_DISALLOW: %v", name, err)
			}
			disallow = r
		}
	}

Args:
	for i := 0; i < len(list); i++ {
		arg := list[i]
		if disallow != nil && disallow.FindString(arg) == arg {
			goto Bad
		}
		if allow != nil && allow.FindString(arg) == arg {
			continue Args
		}
		for _, re := range invalid {
			if re.FindString(arg) == arg { // must be complete match
				goto Bad
			}

View on GitHub (pinned to b6b368adc5)

Solutions

Correct the regexp to be RE2-valid (balanced grouping, no backreferences).
Validate with `regexp.Compile` in a scratch `go run` before exporting.
Unset the variable if unused: `unset CGO_CFLAGS_DISALLOW`.
Keep the blocklist minimal and well-tested.

Example fix

// before
// export CGO_CFLAGS_DISALLOW=(-D.*

// after
// export CGO_CFLAGS_DISALLOW=-D[A-Z_]+

Defensive patterns

Strategy: validation

Validate before calling

// Validate CGO_CFLAGS_DISALLOW regexp
if v := os.Getenv("CGO_CFLAGS_DISALLOW"); v != "" {
    if _, err := regexp.Compile(v); err != nil {
        log.Fatalf("fix CGO_CFLAGS_DISALLOW: %v", err)
    }
}

Prevention

Keep DISALLOW regexps simple and balanced.
Validate in CI before invoking go build.
Unset blocklists you no longer use.

When it happens

Trigger: Set `CGO_CFLAGS_DISALLOW=(unbalanced` in the environment and run a cgo build that reaches the general compiler-flag checker with checkOverrides=true. regexp.Compile returns an error, which is wrapped into this message.

Common situations: A misplaced parenthesis in a security-blocklist regexp; environment exported from a templating system that stripped a closing bracket; migrating a sed/awk pattern into a Go regexp without RE2 restrictions.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/391381c7e58c6494. Report an issue: GitHub.