fix: updated makefile for security hardening (#78)

Signed-off-by: Marc-Philippe Fuller <[email protected]>

Makefile

@@ -1,6 +1,13 @@
 .PHONY: build test unittest lint clean prepare update docker
 
 GO=CGO_ENABLED=1 GO111MODULE=on go
+
+# see https://shibumi.dev/posts/hardening-executables
+CGO_CPPFLAGS="-D_FORTIFY_SOURCE=2"
+CGO_CFLAGS="-O2 -pipe -fno-plt"
+CGO_CXXFLAGS="-O2 -pipe -fno-plt"
+CGO_LDFLAGS="-Wl,-O1,–sort-common,–as-needed,-z,relro,-z,now"
+
 ARCH=$(shell uname -m)
 
 MICROSERVICES=cmd/device-rfid-llrp
@@ -11,14 +18,17 @@ VERSION=$(shell cat ./VERSION 2>/dev/null || echo 0.0.0)
 
 GIT_SHA=$(shell git rev-parse HEAD)
 GOFLAGS=-ldflags "-X github.com/edgexfoundry/device-rfid-llrp.Version=$(VERSION)"
+CGOFLAGS=-ldflags "-linkmode=external -X github.com/edgexfoundry/app-functions-sdk-go/v2/internal.SDKVersion=$(SDKVERSION) \
+					-X github.com/edgexfoundry/app-functions-sdk-go/v2/internal.ApplicationVersion=$(APPVERSION) \
+					-X edgexfoundry/app-rfid-llrp-inventory.Version=$(APPVERSION)" -trimpath -mod=readonly -buildmode=pie
 
 build: $(MICROSERVICES)
 
 tidy:
 	go mod tidy
 
 cmd/device-rfid-llrp:
-	$(GO) build $(GOFLAGS) -o $@ ./cmd
+	$(GO) build $(CGOFLAGS) -o $@ ./cmd
 
 unittest:
 	$(GO) test ./... -coverprofile=coverage.out ./...