[Quim Muntal (qmuntal)]

Default Linux builds to PIE on amd64, arm64, loong64, ppc64, ppc64le, and s390x to align with Microsoft's security policies. Windows and Darwin binaries already defaulted to PIE.

The default applies with or without cgo and crypto imports. Other Linux architectures retain their previous defaults. Linux -race and -asan builds remain non-PIE by default for runtime compatibility; explicit -asan -buildmode=pie remains available.

Add cross-architecture ELF/build-info checks and native crypto/cgo and race tests. Check ASan executable and test-binary defaults in the existing sanitizer suite, which verifies compiler/runtime prerequisites. Document the new dynamic-loader dependency for programs without crypto dependencies and the -buildmode=exe opt-out.

Validation:

• Cross-builds for 13 Linux architectures.
• Native Linux/amd64 and Linux/arm64 executables and test binaries with and without cgo, plus -race.
• Native Linux/amd64 ASan executables and test binaries default to EXE; explicit ASan PIE builds also pass.
• Sanitizer suite passes in the Mariner 2 and Azure Linux 3 CI images.
• Native crypto/cgo/race checks pass in the Azure Linux 4 CI image, where ASan checks use the existing missing-runtime detection.
• Compiler/linker regression suites and focused cmd/go scripts, plus Windows/arm64 caller checks.
• A non-PIE, no-crypto binary runs in an empty chroot.
• Patch application and index integrity checks.

Fixes #2236.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🔵 Needs a closer look

Missing upstream linker context and the new runtime-loader dependency across six Linux architectures require human review of deployment compatibility and native runtime validation beyond the cross-build checks.

No open issues 🎉

What changed in this PR

This PR makes PIE the default for Linux builds on six architectures starting with Go 1.28, aligning the Microsoft build of Go with Microsoft’s security policies.

Changes:

• Enable PIE by default where internal linking supports it, preserving existing defaults for other Linux architectures and -race builds.
• Add cross-architecture ELF/build-info checks and native crypto/cgo execution tests.
• Document the dynamic-loader requirement and -buildmode=exe opt-out for fully static builds.

Patches are happy!

File	Description
toolchaintest/​README.md	Add Linux PIE defaults to the documented test coverage.
toolchaintest/​buildmode_test.go	Test build modes across Linux architectures and native crypto/cgo configurations.
patches/​index.json	Register the new PIE patch and its integrity metadata.
patches/​0014-Default-to-PIE-on-Linux.patch	Enable the Linux PIE default for supported architectures, excluding race builds.
eng/​doc/​MigrationGuide.md	Summarize the default change and migration implications.
eng/​doc/​AdditionalFeatures.md	Explain architecture coverage, loader requirements, and static-build guidance.
docs/​go1.28.md	Announce the PIE default in the Go 1.28 release notes.

_{Review effort: Balanced}

[Quim Muntal (qmuntal)]

Submitted the following upstream PRs to add internal PIE mode support for 386, arm, and riscv64:

https://go-review.googlesource.com/c/go/+/856001
https://go-review.googlesource.com/c/go/+/856002
https://go-review.googlesource.com/c/go/+/856003