What's this change? Should it be in a separate commit?

We're no longer keeping resulting binary in the image it was build, so we need a more static build.
But it's likely that CGO_ENABLED=0 is only needed really, @terinjokes ?

CGO_ENABLED=0 will give you a statically-compiled Go binary, the 'extldflags' shouldn't be necessary.

What's the reason for adding a new Makefile target rather than modifying the existing build target(s)?

What's the advantage of this over using the 'scratch' image and adding ca-certificates as necessary e.g. https://blog.codeship.com/building-minimal-docker-containers-for-go-applications/? It would be good to explain the rationale in your commit message.

gcr.io/distroless/base already is a minimal docker image with ca certs included
why maintain our own?

What else does it pull in? Can we include that rationale in the commit message so that future contributors understand why we chose distroless?

I already updated commit message, ca-cert is all we should need
see https://github.com/GoogleCloudPlatform/distroless

I was struggling to find info as to what the distroless base image contains, but this covers it:

https://github.com/GoogleCloudPlatform/distroless/blob/master/base/README.md

We don't need glibc or libssl if the binary is statically compiled.

The code to use scratch would look roughly like:

# Build stage
FROM golang:1.8 as build
WORKDIR /go/src/github.com/foo/bar
RUN apt-get update
RUN apt-get upgrade -y ca-certificates
RUN apt-get install -y git make
COPY . /go/src/github.com/foo/bar
RUN make # or similar

# Main stage
FROM scratch
COPY --from=build /etc/ssl/certs /etc/ssl/certs
COPY --from=build /go/bin/example /
ENTRYPOINT ["/example"]

...which gives you an image containing only the statically-compiled binary and the CA certificates copied from Debian.

I'm not suggesting you change it, I think using distroless is fine.