Merge branch 'develop' into hardenBinaries

cmd/beacon-chain/BUILD.bazel

@@ -137,6 +137,7 @@ docker_push(
 go_binary(
     name = "beacon-chain",
     embed = [":go_default_library"],
+    linkmode = "pie",
     visibility = [
         "//beacon-chain:__subpackages__",
         "//testing/endtoend:__pkg__",

cmd/client-stats/BUILD.bazel

@@ -27,5 +27,6 @@ go_library(
 go_binary(
     name = "client-stats",
     embed = [":go_default_library"],
+    linkmode = "pie",
     visibility = ["//visibility:public"],
 )

cmd/validator/BUILD.bazel

@@ -132,6 +132,7 @@ docker_push(
 go_binary(
     name = "validator",
     embed = [":go_default_library"],
+    linkmode = "pie",
     pure = "off",  # Enabled unless there is a valid reason to include cgo dep.
     visibility = [
         "//testing/endtoend:__pkg__",

third_party/herumi/bls_eth_go_binary.BUILD

@@ -75,8 +75,11 @@ cc_library(
     ],
     copts = OPTS + [
         "-std=c++03",
+        "-fPIC",
     ],
-    linkopts = select({
+    linkopts = [
+         "-Wl,-z,notext",
+        ] + select({
         ":use_gmp": ["-lgmp"],
         "//conditions:default": [],
     }) + select({