Here's how it works. `go build` on a pure Go code only executes the compiler and linker of the go toolchain. If you add cgo to the mix, `go build` might invok

Here's how it works. `go build` on a pure Go code only executes the compiler and linker of the go toolchain. If you add cgo to the mix, `go build` might invoke system C++ compiler (gcc, clang, mingw) to compile the C part of the code and system C++ linker. The issue was that gcc allows arbitrary plugins and if the right cgo flags were provided, gcc would load and execute such plugin, leading to executing whatever code was in the plugin. That hole was plugged in 1.10. This is the whole story. There are no other vectors of executing code that is not part of Go toolchain. Then again, what is your threat model? If you worry that blindly compiling my evil package will execute my evil code during build, you should also worry that linking my evil package will execute my evil code when you run your compiled executable.