Updating linux 64bit to build static-pie instead of pie and updating to version to 3.1

cr: https://code.amazon.com/reviews/CR-53305925

README.md

@@ -15,6 +15,7 @@ SSM Agent also enables the Session Manager capability that lets you manage your
 
 * [SSM Run Command Prerequisites](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/remote-commands-prereq.html)
 * [SSM Session Manager Prerequisites and supported Operating Systems](http://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-prerequisites.html)
+* Linux systems require kernel version 3.2 or above
 
 ### Setup
 

VERSION

-3.0.0.0
\ No newline at end of file
+3.1.0.0
\ No newline at end of file

agent/version/version.go

@@ -19,4 +19,4 @@
 package version
 
 // Version is the version of the Agent
-const Version = "3.0.0.0"
+const Version = "3.1.0.0"

makefile

 COPY := cp -p
 GO_BUILD_NOPIE := CGO_ENABLED=0 go build -ldflags "-s -w" -trimpath
 GO_BUILD_PIE := go build -ldflags "-s -w -extldflags=-Wl,-z,now,-z,relro,-z,defs" -buildmode=pie -trimpath
+GO_BUILD_STATIC_PIE := go build -ldflags '-linkmode external -s -w -extldflags "-static-pie -Wl,-z,relro,-z,defs"' -buildmode=pie -trimpath  -tags 'osusergo netgo static_build'
 
 # Default build configuration, can be overridden at build time.
 GOARCH?=$(shell go env GOARCH)
@@ -135,7 +136,7 @@ build-any-%: checkstyle copy-src pre-build
 
 # Pre-defined recipes for various supported builds:
 
-# Production binaries are built using GO_BUILD_PIE
+# Production 64bit linux binaries are built using GO_BUILD_STATIC_PIE
 .PHONY: build-linux
 build-linux: GOARCH=amd64
 build-linux: GOOS=linux
@@ -154,6 +155,7 @@ build-darwin: GOOS=darwin
 build-darwin: GO_BUILD=$(GO_BUILD_NOPIE)
 build-darwin: build-any-darwin-amd64
 
+# Production windows binaries are built using GO_BUILD_PIE
 .PHONY: build-windows
 build-windows: GOOS=windows
 build-windows: GOARCH=amd64

packaging/linux/amazon-ssm-agent.spec

@@ -41,6 +41,26 @@ This package provides Amazon SSM Agent for managing EC2 Instances using SSM APIs
 # Uninstall:     %preun
 # Upgrade:       %pre, %posttrans
 
+%pretrans
+# Verify kernel version
+if [[ $1 -eq 0 ]] ; then
+    REQ_KERNEL_MAJOR_VERSION=3
+    REQ_KERNEL_MINOR_VERSION=2
+
+    KERNEL_MAJOR_VERSION=`uname -r | awk -F. '{print $1}'`
+    KERNEL_MINOR_VERSION=`uname -r | awk -F. '{print $2}'`
+
+    if [ $KERNEL_MAJOR_VERSION -gt $REQ_KERNEL_MAJOR_VERSION ] || \
+        ( [ $KERNEL_MAJOR_VERSION -eq $REQ_KERNEL_MAJOR_VERSION ] && \
+          [ $KERNEL_MINOR_VERSION -ge $REQ_KERNEL_MINOR_VERSION ] ); then
+        exit 0
+    else
+        echo "FATAL: Minimum required kernel version is ${REQ_KERNEL_MAJOR_VERSION}.${REQ_KERNEL_MINOR_VERSION}"
+        echo "       System is running kernel version ${KERNEL_MAJOR_VERSION}.${KERNEL_MINOR_VERSION}"
+        exit 1
+    fi
+fi
+
 %pre
 # Stop the agent before the upgrade
 if [ $1 -ge 2 ]; then