Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 21 Mar 2019 at 07:46, Tomasz Kłoczko <kloczko.tomasz@xxxxxxxxx> wrote:
>
> On Thu, 21 Mar 2019 at 11:37, Stephen John Smoogen <smooge@xxxxxxxxx> wrote:
> [..]
> > > Even gcc themselves "is not written with recent gcc in mind".
> > >
> > > $ grep '\[\-W' gcc.log| awk -F\[ '{print $2}'|awk -F\] '{print
> > > $1}'|sort | uniq -c | sort -nr| head -n 20
> > >     485 -Wmissing-profile
> > >     106 -Wformat-security
> > >      81 -Wmaybe-uninitialized
> > >      44 -Wimplicit-fallthrough=
> > >      24 -Wunused-function
> > >      20 -Wpointer-sign
> > >      20 -Wimplicit-function-declaration
> > >      19 -Wstringop-truncation
> > >       8 -Wformat-truncation=
> > >       8 -Wcast-qual
> > >       7 -Wcast-function-type
> > >       4 -Wcpp
> > >       4 -Wbuiltin-declaration-mismatch
> > >       3 -Wparentheses
> > >       2 -Wunused-value
> > >       2 -Wunused-parameter
> > >       2 -Wmissing-prototypes
> > >       2 -Wmisleading-indentation
> > >       2 -Wint-to-pointer-cast
> > >       2 -Wdiscarded-qualifiers
> > >
> > > BTW: each Fedora package build should have as part of the build report
> > > something like above.
> > >
> >
> > Could you explain why it should? I am not sure what those flags
> > actually mean and why it would tell me anything about a package build.
> > If upstream decides that libX needs to be compiled with
> > -Wmissing-prototypes but nothing else.. what is it to me?
>
> That list is not in order of importance but how often some warning
> happened, and I think that you are fully aware that on that list are
> things far more important than missing prototype.
>


When people see lists like this they are going to assume it is order
of importance because if X is used N many more times, it must be much
more important than Y. Most packagers are not because most packages
are just things they do so they can get what they really want done.
That may be a sad state to some, but the majority of packages in
Fedora are the commons on which the cattle (packages people do things
with) graze on. If I am a perl/python/erlang/nodejs/ghc/R packager and
I get a report that something down in my stack has 2
-Wmisleading-indentations and 485 -Wmissing-profiles.. I am going to
assume that the upstream wanted it that way since all I did was copy
this spec file from another one and use the defaults. If I get
something with the tool I actually am familiar with
(perl/python/erlang/etc) I might be better atuned to knowing that flag
X or dependency Y is important.. but in the end I might really just
want emacs-nethack.el to be a package and I won't have a clue if any
of the above was important. So we need to make sure it is clear when
we add something to a report why it is important.


> kloczek
> --
> Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH
> _______________________________________________
> devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
> To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
> Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx



-- 
Stephen J Smoogen.
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Users]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]

  Powered by Linux