link: remove -z,now (BIND_NOW) from CC toolchain extldflags

[hunshcn]

Summary

Fixes #4377.

The CC toolchain (rules_cc) typically passes -Wl,-z,relro,-z,now to the linker for security hardening. However, -z,now forces all dynamic symbols to be resolved at load time (BIND_NOW), which breaks Go libraries that use dlopen/dlsym to load symbols at runtime.

For example, NVIDIA's go-nvml declares NVML C functions in its header file, which CGO compiles into undefined dynamic symbols. At runtime, go-nvml loads these symbols via dlopen("libnvidia-ml.so.1", RTLD_LAZY | RTLD_GLOBAL) inside nvml.Init(). With BIND_NOW, the dynamic linker fails immediately at program start:

symbol lookup error: undefined symbol: nvmlComputeInstanceDestroy

The same code works with go build because the standard Go toolchain does not pass -z,relro or -z,now to the linker.

Root Cause

rules_cc: unix_cc_configure.bzl    →  adds -Wl,-z,relro,-z,now to CC toolchain
rules_go: context.bzl              →  picks up as ld_executable_options
rules_go: mode.bzl                 →  extldflags_from_cc_toolchain() returns them
rules_go: link.bzl                 →  passes as -extldflags to Go linker

The resulting binary has FLAGS: BIND_NOW in its ELF dynamic section, while go build produces a binary without it.

Fix

Add -Wl,-z,relro,-z,now and -Wl,-z,now to _LINKER_OPTIONS_DENYLIST in context.bzl, consistent with how -Wl,--gc-sections and -pie are already filtered for the same reason (CC toolchain defaults incompatible with Go binaries).

Since go build does not pass -z,relro either, filtering the compound flag entirely aligns with go build behavior.

Test plan

• Added bind_now_test.go that inspects the ELF dynamic section of a non-PIE cgo binary to verify DF_BIND_NOW / DF_1_NOW flags are not set (PIE excluded because the Go linker itself sets BIND_NOW for -buildmode=pie)
• Verified with a minimal reproduction repository that the fix resolves the runtime symbol lookup error (the repo also includes a user-level workaround using gc_linkopts = ["-extldflags", "-Wl,-z,lazy"])

[hunshcn]

@fmeum @tyler-french PTAL

[hunshcn]

I have replaced the previous go_test-based bind_now_test.go (which hardcoded "BIND_NOW should not be set") with a go_bazel_test that builds the same cgo source with both bazel build and native go build, then asserts their BIND_NOW flags match. This covers both auto and pie link modes via table-driven subtests, making the test future-proof — if Go changes its default BIND_NOW behavior, the test adapts automatically.

[fmeum]

I like the idea, but CI is red 🙃

[hunshcn]

fixed, only test on linux

[fmeum]

Great test coverage!