build: mkrpm.sh improvements #6196
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@rusty-snake By the way, do you use mkrpm.sh? |
glitsj16
approved these changes
Feb 6, 2024
rusty-snake
reviewed
Feb 6, 2024
| @@ -47,7 +47,7 @@ build_redhat_package: | |||
| - dnf update -y | |||
| - dnf install -y rpm-build gcc make | |||
| - ./ci/printenv.sh | |||
| - ./configure --prefix=/usr || (cat config.log; exit 1) | |||
| - ./configure || (cat config.log; exit 1) | |||
There was a problem hiding this comment.
Note that this will install profiles in /usr/local/etc IIRC.
My own highly customized one. |
rusty-snake
approved these changes
Feb 6, 2024
kmk3
force-pushed
the
build-mkrpm-improvements
branch
from
7bed5a8
to
3b106e2
Compare
To clarify, whenever running Passing I removed Basically the workflow is:
(Though currently mkrpm.sh generates a separate dist archive by itself) From the build log of $ ./configure || (cat config.log; exit 1)
[...]
checking for linux/seccomp.h... yes
configure: creating ./config.status
config.status: creating config.mk
config.status: creating config.sh
Compile options:
CC: gcc
CFLAGS: -g -O2
CPPFLAGS:
LDFLAGS:
EXTRA_CFLAGS: -mindirect-branch=thunk -fstack-clash-protection -fstack-protector-strong
DEPS_CFLAGS: -MMD -MP
EXTRA_LDFLAGS:
LIBS:
fatal warnings:
gcov instrumentation:
install as a SUID executable: -DHAVE_SUID
install contrib scripts: yes
prefix: /usr/local
sysconfdir: ${prefix}/etc
Spectre compiler patch: yes
$ make rpms
./platform/rpm/mkrpm.sh
Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.MyB3M4
[...]
+ ./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --prefix=/usr --disable-userns --disable-contrib-install
configure: WARNING: unrecognized options: --disable-dependency-tracking
[...]
checking for linux/seccomp.h... yes
configure: creating ./config.status
config.status: creating config.mk
config.status: creating config.sh
configure: WARNING: unrecognized options: --disable-dependency-tracking
Compile options:
CC: gcc
CFLAGS: -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -march=x86-64-v2 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
CPPFLAGS:
LDFLAGS: -Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1
EXTRA_CFLAGS: -fstack-clash-protection -fstack-protector-strong
DEPS_CFLAGS: -MMD -MP
EXTRA_LDFLAGS:
LIBS:
fatal warnings:
gcov instrumentation:
install as a SUID executable: -DHAVE_SUID
install contrib scripts: no
prefix: /usr
sysconfdir: /etc
Spectre compiler patch: yes
[...]
+ make -j2
make[1]: Entering directory '/tmp/tmp.9aifQ1KP8u/BUILD/firejail-0.9.73'
[...]
+ /usr/bin/make install DESTDIR=/tmp/tmp.9aifQ1KP8u/BUILDROOT/firejail-0.9.73-1.x86_64 'INSTALL=/usr/bin/install -p'
make[1]: Entering directory '/tmp/tmp.9aifQ1KP8u/BUILD/firejail-0.9.73'Though from the output above it seems that rpmbuild itself already passes + ./configure --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --prefix=/usr --disable-userns --disable-contrib-install
[...]
prefix: /usrIn any case, I'll post a PR after this one that makes CI always pass |
To make the CI logs more informative, as currently nothing from the build itself is shown. Added on commit d684d99 ("Fix mkrpm.sh", 2016-02-16) / PR netblue30#297.
To abort the build if any error occurs. See also commit 7d9db83 ("fail build if any step in the script fails", 2019-06-21).
They are not being properly forwarded to mkrpm.sh (which re-runs ./configure before the actual build), so just remove them for now.
kmk3
force-pushed
the
build-mkrpm-improvements
branch
from
3b106e2
to
c0dce9e
Compare
If |
kmk3
force-pushed
the
build-mkrpm-improvements
branch
from
c0dce9e
to
543ba29
Compare
I see; removed the commit that adds another |
|
@kmk3 FYI CFLAGS="${CFLAGS:--O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer }" ; export CFLAGS ;
CXXFLAGS="${CXXFLAGS:--O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer }" ; export CXXFLAGS ;
FFLAGS="${FFLAGS:--O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -I/usr/lib64/gfortran/modules }" ; export FFLAGS ;
FCFLAGS="${FCFLAGS:--O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -I/usr/lib64/gfortran/modules }" ; export FCFLAGS ;
VALAFLAGS="${VALAFLAGS:--g}" ; export VALAFLAGS ;
RUSTFLAGS="${RUSTFLAGS:--Copt-level=3 -Cdebuginfo=2 -Ccodegen-units=1 -Cstrip=none -Cforce-frame-pointers=yes -Clink-arg=-Wl,-z,relro -Clink-arg=-Wl,-z,now --cap-lints=warn}" ; export RUSTFLAGS ;
LDFLAGS="${LDFLAGS:--Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -Wl,--build-id=sha1 }" ; export LDFLAGS ;
LT_SYS_LIBRARY_PATH="${LT_SYS_LIBRARY_PATH:-/usr/lib64:}" ; export LT_SYS_LIBRARY_PATH ;
CC="${CC:-gcc}" ; export CC ;
CXX="${CXX:-g++}" ; export CXX;
[ "-flto=auto -ffat-lto-objects"x != x ] &&
for file in $(find . -type f -name configure -print); do
/usr/bin/sed -r --in-place=.backup 's/^char \(\*f\) \(\) = /__attribute__ ((used)) char (*f) () = /g' $file;
diff -u $file.backup $file && mv $file.backup $file
/usr/bin/sed -r --in-place=.backup 's/^char \(\*f\) \(\);/__attribute__ ((used)) char (*f) ();/g' $file;
diff -u $file.backup $file && mv $file.backup $file
/usr/bin/sed -r --in-place=.backup 's/^char \$2 \(\);/__attribute__ ((used)) char \$2 ();/g' $file;
diff -u $file.backup $file && mv $file.backup $file
/usr/bin/sed --in-place=.backup '1{$!N;$!N};$!N;s/int x = 1;\nint y = 0;\nint z;\nint nan;/volatile int x = 1; volatile int y = 0; volatile int z, nan;/;P;D' $file;
diff -u $file.backup $file && mv $file.backup $file
/usr/bin/sed --in-place=.backup 's#^lt_cv_sys_global_symbol_to_cdecl=.*#lt_cv_sys_global_symbol_to_cdecl="sed -n -e '"'"'s/^T .* \\(.*\\)$/extern int \\1();/p'"'"' -e '"'"'s/^$symcode* .* \\(.*\\)$/extern char \\1;/p'"'"'"#' $file;
diff -u $file.backup $file && mv $file.backup $file
done;
[ "1" = 1 ] && for i in $(find $(dirname ./configure) -name config.guess -o -name config.sub) ; do
[ -f /usr/lib/rpm/redhat/$(basename $i) ] && /usr/bin/rm -f $i && /usr/bin/cp -fv /usr/lib/rpm/redhat/$(basename $i) $i ;
done ;
[ "1" = 1 ] && [ x != "x-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld" ] &&
for i in $(find . -name ltmain.sh) ; do
/usr/bin/sed -i.backup -e 's~compiler_flags=$~compiler_flags="-Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld"~' $i
done ;
./configure --build=x86_64-redhat-linux --host=x86_64-redhat-linux \
--program-prefix= \
--disable-dependency-tracking \
\
--prefix=/usr \
--exec-prefix=/usr \
--bindir=/usr/bin \
--sbindir=/usr/sbin \
--sysconfdir=/etc \
--datadir=/usr/share \
--includedir=/usr/include \
--libdir=/usr/lib64 \
--libexecdir=/usr/libexec \
--localstatedir=/var \
$(grep -q "runstatedir=DIR" ./configure && echo '--runstatedir=/run') \
--sharedstatedir=/var/lib \
--mandir=/usr/share/man \
--infodir=/usr/share/info |
Thanks for the details.
Good to know the default flags. The hardening seems similar to what is already Maybe
Strangely
Even though it is defined in the committed script: $ git grep -n "runstatedir=DIR" ./configure
configure:1362: --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run]This might be an issue if the directory is eventually made configurable (such |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a follow-up to #6126.
Relates to #297.