Skip to content

Commit b5fc6d4

Browse files
fanquakefanquake
committed
guix: use glibc 2.31
Set minimum required glibc to 2.31. The glibc 2.31 branch is still maintained: https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/release/2.31/master. Remove the stack-protector check from test-security-check, as the test no-longer fails, and given the control we have of the end, the actual security-check test seems sufficient (this might also be applied to some of the other checks). Drops runtime support for Ubuntu Bionic 18.04 and RHEL-8 from the release binaries.
1 parent 5ee6b76 commit b5fc6d4

10 files changed

+50
-462
lines changed

‎contrib/devtools/symbol-check.py‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,31 +14,31 @@
1414

1515
import lief
1616

17-
# Debian 10 (Buster) EOL: 2024. https://wiki.debian.org/LTS
17+
# Debian 11 (Bullseye) EOL: 2026. https://wiki.debian.org/LTS
1818
#
19-
# - libgcc version 8.3.0 (https://packages.debian.org/search?suite=buster&arch=any&searchon=names&keywords=libgcc1)
20-
# - libc version 2.28 (https://packages.debian.org/search?suite=buster&arch=any&searchon=names&keywords=libc6)
19+
# - libgcc version 10.2.1 (https://packages.debian.org/bullseye/libgcc-s1)
20+
# - libc version 2.31 (https://packages.debian.org/source/bullseye/glibc)
2121
#
22-
# Ubuntu 18.04 (Bionic) EOL: 2028. https://wiki.ubuntu.com/ReleaseTeam
22+
# Ubuntu 20.04 (Focal) EOL: 2030. https://wiki.ubuntu.com/ReleaseTeam
2323
#
24-
# - libgcc version 8.4.0 (https://packages.ubuntu.com/bionic/libgcc1)
25-
# - libc version 2.27 (https://packages.ubuntu.com/bionic/libc6)
24+
# - libgcc version 10.5.0 (https://packages.ubuntu.com/focal/libgcc1)
25+
# - libc version 2.31 (https://packages.ubuntu.com/focal/libc6)
2626
#
27-
# CentOS Stream 8 EOL: 2024. https://wiki.centos.org/About/Product
27+
# CentOS Stream 9 EOL: 2027. https://www.centos.org/cl-vs-cs/#end-of-life
2828
#
29-
# - libgcc version 8.5.0 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
30-
# - libc version 2.28 (http://mirror.centos.org/centos/8-stream/AppStream/x86_64/os/Packages/)
29+
# - libgcc version 12.2.1 (https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/Packages/)
30+
# - libc version 2.34 (https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/Packages/)
3131
#
3232
# See https://gcc.gnu.org/onlinedocs/libstdc++/manual/abi.html for more info.
3333

3434
MAX_VERSIONS = {
3535
'GCC': (4,3,0),
3636
'GLIBC': {
37-
lief.ELF.ARCH.x86_64: (2,27),
38-
lief.ELF.ARCH.ARM: (2,27),
39-
lief.ELF.ARCH.AARCH64:(2,27),
40-
lief.ELF.ARCH.PPC64: (2,27),
41-
lief.ELF.ARCH.RISCV: (2,27),
37+
lief.ELF.ARCH.x86_64: (2,31),
38+
lief.ELF.ARCH.ARM: (2,31),
39+
lief.ELF.ARCH.AARCH64:(2,31),
40+
lief.ELF.ARCH.PPC64: (2,31),
41+
lief.ELF.ARCH.RISCV: (2,31),
4242
},
4343
'LIBATOMIC': (1,0),
4444
'V': (0,5,0), # xkb (bitcoin-qt only)

‎contrib/devtools/test-security-check.py‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -59,32 +59,32 @@ def test_ELF(self):
5959
arch = get_arch(cc, source, executable)
6060

6161
if arch == lief.ARCHITECTURES.X86:
62-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
63-
(1, executable+': failed PIE NX RELRO Canary CONTROL_FLOW'))
64-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
65-
(1, executable+': failed PIE RELRO Canary CONTROL_FLOW'))
66-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
62+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
63+
(1, executable+': failed PIE NX RELRO CONTROL_FLOW'))
64+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
6765
(1, executable+': failed PIE RELRO CONTROL_FLOW'))
68-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
66+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
67+
(1, executable+': failed PIE RELRO CONTROL_FLOW'))
68+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
6969
(1, executable+': failed RELRO CONTROL_FLOW'))
70-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
70+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
7171
(1, executable+': failed separate_code CONTROL_FLOW'))
72-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
72+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
7373
(1, executable+': failed CONTROL_FLOW'))
74-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code', '-fcf-protection=full']),
74+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code', '-fcf-protection=full']),
7575
(0, ''))
7676
else:
77-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
78-
(1, executable+': failed PIE NX RELRO Canary'))
79-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fno-stack-protector','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
80-
(1, executable+': failed PIE RELRO Canary'))
81-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
77+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-zexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
78+
(1, executable+': failed PIE NX RELRO'))
79+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
80+
(1, executable+': failed PIE RELRO'))
81+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-no-pie','-fno-PIE', '-Wl,-z,separate-code']),
8282
(1, executable+': failed PIE RELRO'))
83-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
83+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-znorelro','-pie','-fPIE', '-Wl,-z,separate-code']),
8484
(1, executable+': failed RELRO'))
85-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
85+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,noseparate-code']),
8686
(1, executable+': failed separate_code'))
87-
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-fstack-protector-all','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
87+
self.assertEqual(call_security_check(cc, source, executable, ['-Wl,-znoexecstack','-Wl,-zrelro','-Wl,-z,now','-pie','-fPIE', '-Wl,-z,separate-code']),
8888
(0, ''))
8989

9090
clean_files(source, executable)

‎contrib/guix/manifest.scm‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ chain for " target " development."))
9898
#:key
9999
(base-gcc-for-libc linux-base-gcc)
100100
(base-kernel-headers base-linux-kernel-headers)
101-
(base-libc glibc-2.27)
101+
(base-libc glibc-2.31)
102102
(base-gcc linux-base-gcc))
103103
"Convenience wrapper around MAKE-CROSS-TOOLCHAIN with default values
104104
desirable for building Bitcoin Core release binaries."
@@ -440,24 +440,21 @@ inspecting signatures in Mach-O binaries.")
440440
(("-rpath=") "-rpath-link="))
441441
#t))))))))
442442

443-
(define-public glibc-2.27
443+
(define-public glibc-2.31
444+
(let ((commit "8e30f03744837a85e33d84ccd34ed3abe30d37c3"))
444445
(package
445-
(inherit glibc-2.31)
446-
(version "2.27")
446+
(inherit glibc) ;; 2.35
447+
(version "2.31")
447448
(source (origin
448449
(method git-fetch)
449450
(uri (git-reference
450451
(url "https://sourceware.org/git/glibc.git")
451-
(commit "73886db6218e613bd6d4edf529f11e008a6c2fa6")))
452-
(file-name (git-file-name "glibc" "73886db6218e613bd6d4edf529f11e008a6c2fa6"))
452+
(commit commit)))
453+
(file-name (git-file-name "glibc" commit))
453454
(sha256
454455
(base32
455-
"0azpb9cvnbv25zg8019rqz48h8i2257ngyjg566dlnp74ivrs9vq"))
456-
(patches (search-our-patches "glibc-2.27-riscv64-Use-__has_include-to-include-asm-syscalls.h.patch"
457-
"glibc-2.27-fcommon.patch"
458-
"glibc-2.27-guix-prefix.patch"
459-
"glibc-2.27-no-librt.patch"
460-
"glibc-2.27-powerpc-ldbrx.patch"))))
456+
"1zi0s9yy5zkisw823vivn7zlj8w6g9p3mm7lmlqiixcxdkz4dbn6"))
457+
(patches (search-our-patches "glibc-guix-prefix.patch"))))
461458
(arguments
462459
(substitute-keyword-arguments (package-arguments glibc)
463460
((#:configure-flags flags)
@@ -473,12 +470,13 @@ inspecting signatures in Mach-O binaries.")
473470
(lambda* (#:key outputs #:allow-other-keys)
474471
;; Install the rpc data base file under `$out/etc/rpc'.
475472
;; Otherwise build will fail with "Permission denied."
473+
;; Can be removed when we are building 2.32 or later.
476474
(let ((out (assoc-ref outputs "out")))
477475
(substitute* "sunrpc/Makefile"
478476
(("^\\$\\(inst_sysconfdir\\)/rpc(.*)$" _ suffix)
479477
(string-append out "/etc/rpc" suffix "\n"))
480478
(("^install-others =.*$")
481-
(string-append "install-others = " out "/etc/rpc\n"))))))))))))
479+
(string-append "install-others = " out "/etc/rpc\n")))))))))))))
482480

483481
(packages->manifest
484482
(append

‎contrib/guix/patches/glibc-2.27-fcommon.patch‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

‎contrib/guix/patches/glibc-2.27-no-librt.patch‎

Lines changed: 0 additions & 53 deletions
This file was deleted.

0 commit comments

Comments
 (0)