Skip to content

Commit 34d1d6a

Browse files
fanquakefanquake
committed
Merge bitcoin/bitcoin#22381: guix: Test security-check sanity before performing them (with macOS)
5b4703c guix: Test security-check sanity before performing them (Carl Dong) 6cf3345 scripts: adjust test-symbol-check for guix release environment (fanquake) 1946b5f scripts: more robustly test macOS symbol checks (fanquake) a8127b3 build: Use and test PE binutils with --reloc-section (Carl Dong) 678348d guix: Patch binutils to add security-related disable flags (Carl Dong) 9fdc8af devtools: Improve *-check.py tool detection (Carl Dong) bda62ea ci: skip running the Linux test-security-check target for now (fanquake) d6ef354 lint: Run mypy with --show-error-codes (Carl Dong) Pull request description: This is #20980 rebased (to include the Boost Process fix), and with an additional commit (892d6897f1e613084aa0517a660eab2412308e6e) to fix running the `test-security-check` target for the macOS build. It should pass inside Guix, as well as when cross-compiling on Ubuntu, or building natively on macOS. Note that the `test-security-check` may output some warnings (similar too): ```bash ld: warning: passed two min versions (10.14, 11.4) for platform macOS. Using 11.4. ld: warning: passed two min versions (10.14, 11.4) for platform macOS. Using 11.4. ld: warning: passed two min versions (10.14, 10.14) for platform macOS. Using 10.14. ``` but those can be ignored, and come about due to us passing `-platform_version` when `-mmacosx-version-min` is already part of `CC`. Guix builds: ```bash 71ed0c7a13a4726300779ffc87f7d271086a2744c36896fe6dc51fe3dc33df2e guix-build-5b4703c6a70d/output/aarch64-linux-gnu/SHA256SUMS.part 9273980a17052c8ec45b77579781c14ab5d189fa25aa29907d5115513dd302b1 guix-build-5b4703c6a70d/output/aarch64-linux-gnu/bitcoin-5b4703c6a70d-aarch64-linux-gnu-debug.tar.gz 9c042179af43c8896eb95a34294df15d4910308dcdba40b2010cd36e192938b8 guix-build-5b4703c6a70d/output/aarch64-linux-gnu/bitcoin-5b4703c6a70d-aarch64-linux-gnu.tar.gz 1ceddecac113f50a952ba6a201cdcdb722e3dc804e663f219bfac8268ce42bf0 guix-build-5b4703c6a70d/output/arm-linux-gnueabihf/SHA256SUMS.part 759597c4e925e75db4a2381c06cda9b9f4e4674c23436148676b31c9be05c7aa guix-build-5b4703c6a70d/output/arm-linux-gnueabihf/bitcoin-5b4703c6a70d-arm-linux-gnueabihf-debug.tar.gz 34e3b6beabaf8c95d7c2ca0d2c3ac4411766694ef43e00bd9783badbbaf045a7 guix-build-5b4703c6a70d/output/arm-linux-gnueabihf/bitcoin-5b4703c6a70d-arm-linux-gnueabihf.tar.gz e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 guix-build-5b4703c6a70d/output/dist-archive/SKIPATTEST.TAG 3664f6ceee7898caa374281fd877a7597fe491fa2e9f0c174c28d889d60b559c guix-build-5b4703c6a70d/output/dist-archive/bitcoin-5b4703c6a70d.tar.gz d6bc35ba0750c1440bb32831b8c12cddee62f6dce10fec2650897444c2bf4748 guix-build-5b4703c6a70d/output/powerpc64-linux-gnu/SHA256SUMS.part a836edf6474ba0c16c19bb217549bac7936c1b44306ed512df58f607ee5568f2 guix-build-5b4703c6a70d/output/powerpc64-linux-gnu/bitcoin-5b4703c6a70d-powerpc64-linux-gnu-debug.tar.gz 7cc91c6805d5069ca3bd1771e77d95f83eb184b137198cbf84d1d11d0a5c5afe guix-build-5b4703c6a70d/output/powerpc64-linux-gnu/bitcoin-5b4703c6a70d-powerpc64-linux-gnu.tar.gz 93b4cb7b83c4975120ad5de5a92f050f5760a2a3f2c37c204c647f5a581c924a guix-build-5b4703c6a70d/output/powerpc64le-linux-gnu/SHA256SUMS.part 2266e2c5d0dafa28c6c057ccfc1c439baeab1d714d8c3f64a83015d2827116d2 guix-build-5b4703c6a70d/output/powerpc64le-linux-gnu/bitcoin-5b4703c6a70d-powerpc64le-linux-gnu-debug.tar.gz 85f41f42c319b83d049d6fd2e2278c07b40a1e28a2eac596427822c0eef9dc3f guix-build-5b4703c6a70d/output/powerpc64le-linux-gnu/bitcoin-5b4703c6a70d-powerpc64le-linux-gnu.tar.gz 1499ca9119926083d8c3714ca10d8d4c8d864cbeee8848fd8445b7a1d081222d guix-build-5b4703c6a70d/output/riscv64-linux-gnu/SHA256SUMS.part 1995fc1a2e45c49d4b0718aff5dcdac931917e8ae9e762fd23f1126abcecc248 guix-build-5b4703c6a70d/output/riscv64-linux-gnu/bitcoin-5b4703c6a70d-riscv64-linux-gnu-debug.tar.gz 266889eb58429a470f0fd7bb123f2ae09b0aef86c47b0390938b3634a8f748a9 guix-build-5b4703c6a70d/output/riscv64-linux-gnu/bitcoin-5b4703c6a70d-riscv64-linux-gnu.tar.gz cdc3a0dcf80b110443dac5ddf8bc951001a776a651c898c5ea49bb2d487bfe29 guix-build-5b4703c6a70d/output/x86_64-apple-darwin18/SHA256SUMS.part 8538d1eab96c97866b24546c453d95822f24cf9c6638b42ba523eb7aa441cb26 guix-build-5b4703c6a70d/output/x86_64-apple-darwin18/bitcoin-5b4703c6a70d-osx-unsigned.dmg d1b73133f1da68586b07292a8425f7f851e93f599c016376f23728c041cf39cc guix-build-5b4703c6a70d/output/x86_64-apple-darwin18/bitcoin-5b4703c6a70d-osx-unsigned.tar.gz 5ad94c5f8a5f29405955ff3ab35d137de1acc04398d6c8298fb187b57a6e316a guix-build-5b4703c6a70d/output/x86_64-apple-darwin18/bitcoin-5b4703c6a70d-osx64.tar.gz 8c6d7b3f847faa7b4d16ceecf228f26f146ea982615c1d7a00c57f9230a0c484 guix-build-5b4703c6a70d/output/x86_64-linux-gnu/SHA256SUMS.part d0a8c99750319ad8046cfa132a54e5c13a08351f94439ae9af0f8e5486c2c2ea guix-build-5b4703c6a70d/output/x86_64-linux-gnu/bitcoin-5b4703c6a70d-x86_64-linux-gnu-debug.tar.gz d816bb26dd4b0e309f2f576b1cccc6d78743fb2f357daad2da09bb1177330971 guix-build-5b4703c6a70d/output/x86_64-linux-gnu/bitcoin-5b4703c6a70d-x86_64-linux-gnu.tar.gz 65caaa7f648c7eab1eb82c3331a2ca25b8cd4fe41439de55604501e02571de55 guix-build-5b4703c6a70d/output/x86_64-w64-mingw32/SHA256SUMS.part 5bf6f7328cbceb0db22a2d7babb07b60cb6dcc19a6db84a1698589b7f5173a06 guix-build-5b4703c6a70d/output/x86_64-w64-mingw32/bitcoin-5b4703c6a70d-win-unsigned.tar.gz 7aabcb56115decef78d3797840b6e49dbc9b202d56f892490e92616fb06fec9e guix-build-5b4703c6a70d/output/x86_64-w64-mingw32/bitcoin-5b4703c6a70d-win64-debug.zip 2f369694648ff9dc5ca1261a1e5874b1c7408ccf2802f9caef56c1334e8a5b7c guix-build-5b4703c6a70d/output/x86_64-w64-mingw32/bitcoin-5b4703c6a70d-win64-setup-unsigned.exe 1c1f92513c4aad38419ff49a7b80bf10e6b1eca01ee8c5e3b2acd1768cf1e3d5 guix-build-5b4703c6a70d/output/x86_64-w64-mingw32/bitcoin-5b4703c6a70d-win64.zip ``` ACKs for top commit: hebasto: Approach ACK 5b4703c. Tree-SHA512: 2cd92a245ea64ef7176cf402a1fa5348a9421c30a4d30d01c950c48f6dcc15cf22ce69ffe1657be97e5fccc14bd933d64683c4439b695528ce3dc34d72dda927
2 parents df2b5da + 5b4703c commit 34d1d6a

File tree

12 files changed

+262
-51
lines changed

12 files changed

+262
-51
lines changed

‎Makefile.am

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ DIST_SHARE = \
5858

5959
BIN_CHECKS=$(top_srcdir)/contrib/devtools/symbol-check.py \
6060
$(top_srcdir)/contrib/devtools/security-check.py \
61+
$(top_srcdir)/contrib/devtools/utils.py \
6162
$(top_srcdir)/contrib/devtools/pixie.py
6263

6364
WINDOWS_PACKAGING = $(top_srcdir)/share/pixmaps/bitcoin.ico \
@@ -366,14 +367,14 @@ clean-local: clean-docs
366367

367368
test-security-check:
368369
if TARGET_DARWIN
369-
$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_MACHO
370-
$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_MACHO
370+
$(AM_V_at) CC='$(CC)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_MACHO
371+
$(AM_V_at) CC='$(CC)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_MACHO
371372
endif
372373
if TARGET_WINDOWS
373-
$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_PE
374-
$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_PE
374+
$(AM_V_at) CC='$(CC)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_PE
375+
$(AM_V_at) CC='$(CC)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_PE
375376
endif
376377
if TARGET_LINUX
377-
$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_ELF
378-
$(AM_V_at) $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_ELF
378+
$(AM_V_at) CC='$(CC)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-security-check.py TestSecurityChecks.test_ELF
379+
$(AM_V_at) CC='$(CC)' CPPFILT='$(CPPFILT)' $(PYTHON) $(top_srcdir)/contrib/devtools/test-symbol-check.py TestSymbolChecks.test_ELF
379380
endif

‎ci/test/00_setup_env_native_multiprocess.sh

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,4 @@ export DEP_OPTS="DEBUG=1 MULTIPROCESS=1"
1313
export GOAL="install"
1414
export BITCOIN_CONFIG="--enable-debug CC=clang CXX=clang++" # Use clang to avoid OOM
1515
export TEST_RUNNER_ENV="BITCOIND=bitcoin-node"
16-
export RUN_SECURITY_TESTS="true"
1716
export PIP_PACKAGES="lief"

‎configure.ac

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -900,6 +900,7 @@ if test x$use_hardening != xno; then
900900
])
901901
fi
902902

903+
AX_CHECK_LINK_FLAG([[-Wl,--enable-reloc-section]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--enable-reloc-section"],, [[$LDFLAG_WERROR]])
903904
AX_CHECK_LINK_FLAG([[-Wl,--dynamicbase]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--dynamicbase"],, [[$LDFLAG_WERROR]])
904905
AX_CHECK_LINK_FLAG([[-Wl,--nxcompat]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--nxcompat"],, [[$LDFLAG_WERROR]])
905906
AX_CHECK_LINK_FLAG([[-Wl,--high-entropy-va]], [HARDENED_LDFLAGS="$HARDENED_LDFLAGS -Wl,--high-entropy-va"],, [[$LDFLAG_WERROR]])

‎contrib/devtools/symbol-check.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,13 @@
1212
'''
1313
import subprocess
1414
import sys
15-
import os
1615
from typing import List, Optional
1716

1817
import lief
1918
import pixie
2019

20+
from utils import determine_wellknown_cmd
21+
2122
# Debian 8 (Jessie) EOL: 2020. https://wiki.debian.org/DebianReleases#Production_Releases
2223
#
2324
# - g++ version 4.9.2 (https://packages.debian.org/search?suite=jessie&arch=any&searchon=names&keywords=g%2B%2B)
@@ -60,7 +61,6 @@
6061
'_edata', '_end', '__end__', '_init', '__bss_start', '__bss_start__', '_bss_end__', '__bss_end__', '_fini', '_IO_stdin_used', 'stdin', 'stdout', 'stderr',
6162
'environ', '_environ', '__environ',
6263
}
63-
CPPFILT_CMD = os.getenv('CPPFILT', '/usr/bin/c++filt')
6464

6565
# Allowed NEEDED libraries
6666
ELF_ALLOWED_LIBRARIES = {
@@ -140,7 +140,7 @@ class CPPFilt(object):
140140
Use a pipe to the 'c++filt' command.
141141
'''
142142
def __init__(self):
143-
self.proc = subprocess.Popen(CPPFILT_CMD, stdin=subprocess.PIPE, stdout=subprocess.PIPE, universal_newlines=True)
143+
self.proc = subprocess.Popen(determine_wellknown_cmd('CPPFILT', 'c++filt'), stdin=subprocess.PIPE, stdout=subprocess.PIPE, universal_newlines=True)
144144

145145
def __call__(self, mangled):
146146
self.proc.stdin.write(mangled + '\n')

‎contrib/devtools/test-security-check.py

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99
import subprocess
1010
import unittest
1111

12+
from utils import determine_wellknown_cmd
13+
1214
def write_testcode(filename):
1315
with open(filename, 'w', encoding="utf8") as f:
1416
f.write('''
@@ -25,15 +27,15 @@ def clean_files(source, executable):
2527
os.remove(executable)
2628

2729
def call_security_check(cc, source, executable, options):
28-
subprocess.run([cc,source,'-o',executable] + options, check=True)
30+
subprocess.run([*cc,source,'-o',executable] + options, check=True)
2931
p = subprocess.run(['./contrib/devtools/security-check.py',executable], stdout=subprocess.PIPE, universal_newlines=True)
3032
return (p.returncode, p.stdout.rstrip())
3133

3234
class TestSecurityChecks(unittest.TestCase):
3335
def test_ELF(self):
3436
source = 'test1.c'
3537
executable = 'test1'
36-
cc = 'gcc'
38+
cc = determine_wellknown_cmd('CC', 'gcc')
3739
write_testcode(source)
3840

3941
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
@@ -54,26 +56,28 @@ def test_ELF(self):
5456
def test_PE(self):
5557
source = 'test1.c'
5658
executable = 'test1.exe'
57-
cc = 'x86_64-w64-mingw32-gcc'
59+
cc = determine_wellknown_cmd('CC', 'x86_64-w64-mingw32-gcc')
5860
write_testcode(source)
5961

60-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--no-nxcompat','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
61-
(1, executable+': failed DYNAMIC_BASE HIGH_ENTROPY_VA NX RELOC_SECTION'))
62-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
63-
(1, executable+': failed DYNAMIC_BASE HIGH_ENTROPY_VA RELOC_SECTION'))
64-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
65-
(1, executable+': failed HIGH_ENTROPY_VA RELOC_SECTION'))
66-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--dynamicbase','-Wl,--high-entropy-va','-no-pie','-fno-PIE']),
67-
(1, executable+': failed RELOC_SECTION'))
68-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--dynamicbase','-Wl,--high-entropy-va','-pie','-fPIE']),
62+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--no-nxcompat','-Wl,--disable-reloc-section','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
63+
(1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA NX RELOC_SECTION'))
64+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--disable-reloc-section','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
65+
(1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA RELOC_SECTION'))
66+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-no-pie','-fno-PIE']),
67+
(1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA'))
68+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--no-dynamicbase','-Wl,--no-high-entropy-va','-pie','-fPIE']),
69+
(1, executable+': failed PIE DYNAMIC_BASE HIGH_ENTROPY_VA')) # -pie -fPIE does nothing unless --dynamicbase is also supplied
70+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--dynamicbase','-Wl,--no-high-entropy-va','-pie','-fPIE']),
71+
(1, executable+': failed HIGH_ENTROPY_VA'))
72+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,--nxcompat','-Wl,--enable-reloc-section','-Wl,--dynamicbase','-Wl,--high-entropy-va','-pie','-fPIE']),
6973
(0, ''))
7074

7175
clean_files(source, executable)
7276

7377
def test_MACHO(self):
7478
source = 'test1.c'
7579
executable = 'test1'
76-
cc = 'clang'
80+
cc = determine_wellknown_cmd('CC', 'clang')
7781
write_testcode(source)
7882

7983
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-no_pie','-Wl,-flat_namespace','-Wl,-allow_stack_execute','-fno-stack-protector']),
@@ -95,4 +99,3 @@ def test_MACHO(self):
9599

96100
if __name__ == '__main__':
97101
unittest.main()
98-

‎contrib/devtools/test-symbol-check.py

Lines changed: 27 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,41 +7,51 @@
77
'''
88
import os
99
import subprocess
10+
from typing import List
1011
import unittest
1112

12-
def call_symbol_check(cc, source, executable, options):
13-
subprocess.run([cc,source,'-o',executable] + options, check=True)
13+
from utils import determine_wellknown_cmd
14+
15+
def call_symbol_check(cc: List[str], source, executable, options):
16+
subprocess.run([*cc,source,'-o',executable] + options, check=True)
1417
p = subprocess.run(['./contrib/devtools/symbol-check.py',executable], stdout=subprocess.PIPE, universal_newlines=True)
1518
os.remove(source)
1619
os.remove(executable)
1720
return (p.returncode, p.stdout.rstrip())
1821

22+
def get_machine(cc: List[str]):
23+
p = subprocess.run([*cc,'-dumpmachine'], stdout=subprocess.PIPE, universal_newlines=True)
24+
return p.stdout.rstrip()
25+
1926
class TestSymbolChecks(unittest.TestCase):
2027
def test_ELF(self):
2128
source = 'test1.c'
2229
executable = 'test1'
23-
cc = 'gcc'
30+
cc = determine_wellknown_cmd('CC', 'gcc')
31+
32+
# there's no way to do this test for RISC-V at the moment; we build for
33+
# RISC-V in a glibc 2.27 envinonment and we allow all symbols from 2.27.
34+
if 'riscv' in get_machine(cc):
35+
self.skipTest("test not available for RISC-V")
2436

25-
# renameat2 was introduced in GLIBC 2.28, so is newer than the upper limit
26-
# of glibc for all platforms
37+
# nextup was introduced in GLIBC 2.24, so is newer than our supported
38+
# glibc (2.17), and available in our release build environment (2.24).
2739
with open(source, 'w', encoding="utf8") as f:
2840
f.write('''
2941
#define _GNU_SOURCE
30-
#include <stdio.h>
31-
#include <linux/fs.h>
42+
#include <math.h>
3243
33-
int renameat2(int olddirfd, const char *oldpath,
34-
int newdirfd, const char *newpath, unsigned int flags);
44+
double nextup(double x);
3545
3646
int main()
3747
{
38-
renameat2(0, "test", 0, "test_", RENAME_EXCHANGE);
48+
nextup(3.14);
3949
return 0;
4050
}
4151
''')
4252

43-
self.assertEqual(call_symbol_check(cc, source, executable, []),
44-
(1, executable + ': symbol renameat2 from unsupported version GLIBC_2.28\n' +
53+
self.assertEqual(call_symbol_check(cc, source, executable, ['-lm']),
54+
(1, executable + ': symbol nextup from unsupported version GLIBC_2.24\n' +
4555
executable + ': failed IMPORTED_SYMBOLS'))
4656

4757
# -lutil is part of the libc6 package so a safe bet that it's installed
@@ -82,7 +92,7 @@ def test_ELF(self):
8292
def test_MACHO(self):
8393
source = 'test1.c'
8494
executable = 'test1'
85-
cc = 'clang'
95+
cc = determine_wellknown_cmd('CC', 'clang')
8696

8797
with open(source, 'w', encoding="utf8") as f:
8898
f.write('''
@@ -96,7 +106,7 @@ def test_MACHO(self):
96106
97107
''')
98108

99-
self.assertEqual(call_symbol_check(cc, source, executable, ['-lexpat']),
109+
self.assertEqual(call_symbol_check(cc, source, executable, ['-lexpat', '-Wl,-platform_version','-Wl,macos', '-Wl,11.4', '-Wl,11.4']),
100110
(1, 'libexpat.1.dylib is not in ALLOWED_LIBRARIES!\n' +
101111
f'{executable}: failed DYNAMIC_LIBRARIES MIN_OS SDK'))
102112

@@ -113,7 +123,7 @@ def test_MACHO(self):
113123
}
114124
''')
115125

116-
self.assertEqual(call_symbol_check(cc, source, executable, ['-framework', 'CoreGraphics']),
126+
self.assertEqual(call_symbol_check(cc, source, executable, ['-framework', 'CoreGraphics', '-Wl,-platform_version','-Wl,macos', '-Wl,11.4', '-Wl,11.4']),
117127
(1, f'{executable}: failed MIN_OS SDK'))
118128

119129
source = 'test3.c'
@@ -126,13 +136,13 @@ def test_MACHO(self):
126136
}
127137
''')
128138

129-
self.assertEqual(call_symbol_check(cc, source, executable, ['-mmacosx-version-min=10.14']),
139+
self.assertEqual(call_symbol_check(cc, source, executable, ['-Wl,-platform_version','-Wl,macos', '-Wl,10.14', '-Wl,11.4']),
130140
(1, f'{executable}: failed SDK'))
131141

132142
def test_PE(self):
133143
source = 'test1.c'
134144
executable = 'test1.exe'
135-
cc = 'x86_64-w64-mingw32-gcc'
145+
cc = determine_wellknown_cmd('CC', 'x86_64-w64-mingw32-gcc')
136146

137147
with open(source, 'w', encoding="utf8") as f:
138148
f.write('''
@@ -182,4 +192,3 @@ def test_PE(self):
182192

183193
if __name__ == '__main__':
184194
unittest.main()
185-

‎contrib/devtools/utils.py

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/usr/bin/env python3
2+
# Copyright (c) 2021 The Bitcoin Core developers
3+
# Distributed under the MIT software license, see the accompanying
4+
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
5+
'''
6+
Common utility functions
7+
'''
8+
import shutil
9+
import sys
10+
import os
11+
from typing import List
12+
13+
14+
def determine_wellknown_cmd(envvar, progname) -> List[str]:
15+
maybe_env = os.getenv(envvar)
16+
maybe_which = shutil.which(progname)
17+
if maybe_env:
18+
return maybe_env.split(' ') # Well-known vars are often meant to be word-split
19+
elif maybe_which:
20+
return [ maybe_which ]
21+
else:
22+
sys.exit(f"{progname} not found")

‎contrib/guix/libexec/build.sh

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -299,10 +299,11 @@ mkdir -p "$DISTSRC"
299299
# Build Bitcoin Core
300300
make --jobs="$JOBS" ${V:+V=1}
301301

302-
# Perform basic ELF security checks on a series of executables.
302+
# Check that symbol/security checks tools are sane.
303+
make test-security-check ${V:+V=1}
304+
# Perform basic security checks on a series of executables.
303305
make -C src --jobs=1 check-security ${V:+V=1}
304-
# Check that executables only contain allowed gcc, glibc and libstdc++
305-
# version symbols for Linux distro back-compatibility.
306+
# Check that executables only contain allowed version symbols.
306307
make -C src --jobs=1 check-symbols ${V:+V=1}
307308

308309
mkdir -p "$OUTDIR"

‎contrib/guix/manifest.scm

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,10 @@ http://www.linuxfromscratch.org/hlfs/view/development/chapter05/gcc-pass1.html"
8080
(("-rpath=") "-rpath-link="))
8181
#t))))))))
8282

83+
(define (make-binutils-with-mingw-w64-disable-flags xbinutils)
84+
(package-with-extra-patches xbinutils
85+
(search-our-patches "binutils-mingw-w64-disable-flags.patch")))
86+
8387
(define (make-cross-toolchain target
8488
base-gcc-for-libc
8589
base-kernel-headers
@@ -168,7 +172,7 @@ desirable for building Bitcoin Core release binaries."
168172

169173
(define (make-mingw-pthreads-cross-toolchain target)
170174
"Create a cross-compilation toolchain package for TARGET"
171-
(let* ((xbinutils (cross-binutils target))
175+
(let* ((xbinutils (make-binutils-with-mingw-w64-disable-flags (cross-binutils target)))
172176
(pthreads-xlibc mingw-w64-x86_64-winpthreads)
173177
(pthreads-xgcc (make-gcc-with-pthreads
174178
(cross-gcc target

0 commit comments

Comments
 (0)