Bug 32506 - [PKG REQUEST] A default configuration to build all GCC binaries in PIE mode
Summary: [PKG REQUEST] A default configuration to build all GCC binaries in PIE mode
Status: RESOLVED WONTFIX
Alias: None
Product: Mageia
Classification: Unclassified
Component: New RPM package request (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal enhancement
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact:
URL:
Whiteboard:
Keywords:
: 33215 (view as bug list)
Depends on:
Blocks:
 
Reported: 2023-11-11 02:23 CET by Kristoffer Grundström
Modified: 2024-06-17 04:03 CEST (History)
2 users (show)

See Also:
Source RPM: gcc-PIE
CVE:
Status comment:


Attachments
Proposal spec file (15.91 KB, text/x-rpm-spec)
2023-11-11 02:24 CET, Kristoffer Grundström
Details
A spec to develop (1.07 KB, text/x-matlab)
2024-06-17 04:03 CEST, Kristoffer Grundström
Details

Description Kristoffer Grundström 2023-11-11 02:23:40 CET
Description of problem: This package contains a configuration file (spec) that changes the compilers default setting to build all ELF binaries in the Position
Independend Executable (PIE) variant. This enables better address space randomization (ASLR).

Version-Release number of selected component (if applicable): 13
Comment 1 Kristoffer Grundström 2023-11-11 02:24:24 CET
Created attachment 14145 [details]
Proposal spec file

CC: (none) => lovaren

Comment 2 Lewis Smith 2023-11-15 22:24:38 CET
Can you explain where this would apply. An optional component for users? For all Mageia compiled packages? Which compilers?

Severity: normal => enhancement
CC: (none) => lewyssmith

Comment 3 sturmvogel 2023-11-16 11:36:52 CET
Unfortunately Kristoffer posted the original openSUSE/SUSE spec which can not even be used by Mageia. A quick glance over the spec file shows clearly that it can not be used easily for Mageia. 

- It references openSUSE/SUSE packages
- it does not follow Mageias naming convention for packages
- it uses openSUSE/SUSE package naming conventions and structures
- …

That means using this spec would produce a complette set of gcc packages which can not be used on Mageia but would definitely break the complete development tools…

Additionally, a new package request should contain a description, what it is used for and why it would be good to have it (advantages).

So again this is only a dumped spec file without explanation for the usecase, which would need a heavy rework by a maintainer to be able to use it for Mageia…
Comment 4 Lewis Smith 2023-11-16 21:21:04 CET
Yes Kristoffer, you need to give a better defined case for adding this thing.
Comment 5 sturmvogel 2024-05-15 09:04:44 CEST
*** Bug 33215 has been marked as a duplicate of this bug. ***
Comment 6 sturmvogel 2024-05-15 16:04:12 CEST
No answer from TO. 

But the duplicate bug 33215 shows that this package is only needed for ghc-bootstrap.
So technically it is a package dependency for another package which won't get build for Mageia. See bug 31446

Closing then...

Status: NEW => RESOLVED
Resolution: (none) => WONTFIX

Comment 7 Kristoffer Grundström 2024-05-15 16:19:50 CEST
(In reply to sturmvogel from comment #6)
> No answer from TO. 
> 
> But the duplicate bug 33215 shows that this package is only needed for
> ghc-bootstrap.
> So technically it is a package dependency for another package which won't
> get build for Mageia. See bug 31446
> 
> Closing then...

I am trying to get it built for Mageia since we already have dependencies for it in the official repos (ghc-rpm-macros, llvm, libnuma plus many more). To have gcc-PIE would make it a lot easier.
Comment 8 Kristoffer Grundström 2024-05-15 21:07:30 CEST
(In reply to sturmvogel from comment #3)
> Unfortunately Kristoffer posted the original openSUSE/SUSE spec which can
> not even be used by Mageia. A quick glance over the spec file shows clearly
> that it can not be used easily for Mageia. 
> 
> - It references openSUSE/SUSE packages
> - it does not follow Mageias naming convention for packages
> - it uses openSUSE/SUSE package naming conventions and structures
> - …
> 
> That means using this spec would produce a complette set of gcc packages
> which can not be used on Mageia but would definitely break the complete
> development tools…
> 
> Additionally, a new package request should contain a description, what it is
> used for and why it would be good to have it (advantages).
> 
> So again this is only a dumped spec file without explanation for the
> usecase, which would need a heavy rework by a maintainer to be able to use
> it for Mageia…

Is there a workaround to get ghc-bootstrap built even though it needs gcc-PIE?
Comment 9 Kristoffer Grundström 2024-06-16 15:17:51 CEST
Could we perhaps create a standalone package for gcc then to meet halfway?
That way we have it if one needs it and it won't install together with gcc if one doesn't specifically tell urpmi, dnf or yum to install it as well.
You know there's a good saying that I like:

"It's better to have and not need it than to need it and not have it."

I'm working on making a spec file that anyone is free to continue on if they wish to help.
Comment 10 Kristoffer Grundström 2024-06-17 04:03:55 CEST
Created attachment 14572 [details]
A spec to develop

I took the liberty of starting the rewrite of the gcc spec file to only build gcc-PIE if that's even possible as so many are against including PIE for the ordinary gcc package. Feel free to adapt it and think of this as a standalone package for gcc.

Attachment 14145 is obsolete: 0 => 1


Note You need to log in before you can comment on or make changes to this bug.